CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,036 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
1,779 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-20481 KEV | A vulnerability in the Remote Access VPN (RAVPN) service of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD)… | Patch first | 5.8 medium | 15.9% | 2024-10-23 |
| CVE-2026-58644 KEV | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | Patch first | 9.8 critical | 15.9% | 2026-07-14 |
| CVE-2026-21513 KEV | Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. | Patch first | 8.8 high | 15.9% | 2026-02-10 |
| CVE-2023-35311 KEV | Microsoft Outlook Security Feature Bypass Vulnerability | Patch first | 8.8 high | 15.5% | 2023-07-11 |
| CVE-2026-86218 KEV | N-central is vulnerable to a pre-auth remote code execution This issue affects N-central: before 2026.3.1.14. | Patch first | 9.8 critical | 15.4% | 2026-09-06 |
| CVE-2024-4947 KEV | Type Confusion in V8 in Google Chrome prior to 125.0.6422.60 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML p… | Patch first | 9.6 critical | 15.2% | 2024-05-15 |
| CVE-2015-0310 KEV | Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly re… | Patch first | 7.8 high | 15.1% | 2015-01-23 |
| CVE-2022-38028 KEV | Windows Print Spooler Elevation of Privilege Vulnerability | Patch first | 7.8 high | 14.9% | 2022-10-11 |
| CVE-2020-10181 KEV | goform/formEMR30 in Sumavision Enhanced Multimedia Router (EMR) 3.0.4.27 allows creation of arbitrary users with elevated privileges (administrator) o… | Patch first | 9.8 critical | 14.9% | 2020-03-11 |
| CVE-2022-20708 KEV | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Exe… | Patch first | 10.0 critical | 14.9% | 2022-02-10 |
| CVE-2026-56291 KEV | Joomla Extension - balbooa.com - Unauthenticated file upload in Balbooa Forms extension < 2.4.1 - The Joomla extension Balbooa Forms is vulnerable to… | Patch first | 9.8 critical | 14.9% | 2026-07-09 |
| CVE-2015-2360 KEV | win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows… | Patch first | 8.8 high | 14.8% | 2015-06-10 |
| CVE-2021-30883 KEV | A memory corruption issue was addressed with improved memory handling. This issue is fixed in iOS 15.0.2 and iPadOS 15.0.2, macOS Monterey 12.0.1, iOS… | Patch first | 7.8 high | 14.7% | 2021-08-24 |
| CVE-2026-18577 KEV | An incomplete patch for CVE-2026-18556 allows for authentication bypass and account takeover in N-central Versions through 2026.3.1 | Patch first | 8.1 high | 14.6% | 2026-08-02 |
| CVE-2026-82329 KEV | JFrog Artifactory contains an authentication weakness that, under default configuration, may allow an unauthenticated attacker with network access to… | Patch first | 9.8 critical | 14.4% | 2026-08-28 |
| CVE-2019-7193 KEV | This improper input validation vulnerability allows remote attackers to inject arbitrary code to the system. To fix the vulnerability, QNAP recommend… | Patch first | 9.8 critical | 14.4% | 2019-12-05 |
| CVE-2023-28204 KEV | An out-of-bounds read was addressed with improved input validation. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 and… | Patch first | 6.5 medium | 14.3% | 2023-06-23 |
| CVE-2022-26485 KEV | Removing an XSLT parameter during processing could have lead to an exploitable use-after-free. We have had reports of attacks in the wild abusing this… | Patch first | 8.8 high | 14.3% | 2022-12-22 |
| CVE-2018-0151 KEV | A vulnerability in the quality of service (QoS) subsystem of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attac… | Patch first | 9.8 critical | 14.2% | 2018-03-28 |
| CVE-2024-49039 KEV | Windows Task Scheduler Elevation of Privilege Vulnerability | Patch first | 8.8 high | 14.2% | 2024-11-12 |
| CVE-2021-22900 KEV | A vulnerability allowed multiple unrestricted uploads in Pulse Connect Secure before 9.1R11.4 that could lead to an authenticated administrator to per… | Patch first | 7.2 high | 14.1% | 2021-05-27 |
| CVE-2025-6554 KEV | Type confusion in V8 in Google Chrome prior to 138.0.7204.96 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chrom… | Patch first | 8.1 high | 14.1% | 2025-06-30 |
| CVE-2023-38180 KEV | .NET and Visual Studio Denial of Service Vulnerability | Patch first | 7.5 high | 14.1% | 2023-08-08 |
| CVE-2021-1789 KEV | A type confusion issue was addressed with improved state handling. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Secur… | Patch first | 8.8 high | 14% | 2021-04-02 |
| CVE-2025-31201 KEV | This issue was addressed by removing the vulnerable code. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS 18.4.1, visi… | Patch first | 9.8 critical | 14% | 2025-04-16 |
| CVE-2022-1364 KEV | Type confusion in V8 Turbofan in Google Chrome prior to 100.0.4896.127 allowed a remote attacker to potentially exploit heap corruption via a crafted… | Patch first | 8.8 high | 13.9% | 2022-07-26 |
| CVE-2017-12240 KEV | The DHCP relay subsystem of Cisco IOS 12.2 through 15.6 and Cisco IOS XE Software contains a vulnerability that could allow an unauthenticated, remote… | Patch first | 9.8 critical | 13.8% | 2017-09-29 |
| CVE-2026-5281 KEV | Use after free in Dawn in Google Chrome prior to 146.0.7680.178 allowed a remote attacker who had compromised the renderer process to execute arbitrar… | Patch first | 8.8 high | 13.7% | 2026-04-01 |
| CVE-2023-20867 KEV | A fully compromised ESXi host can force VMware Tools to fail to authenticate host-to-guest operations, impacting the confidentiality and integrity of… | Patch first | 3.9 low | 13.6% | 2023-06-13 |
| CVE-2024-38213 KEV | Windows Mark of the Web Security Feature Bypass Vulnerability | Patch first | 6.5 medium | 13.6% | 2024-08-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt