CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,036 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
1,779 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2015-4902 KEV | Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deploymen… | Patch first | 5.3 medium | 13.6% | 2015-10-22 |
| CVE-2026-22769 KEV | Dell RecoverPoint for Virtual Machines, versions prior to 6.0.3.1 HF1, contain a hardcoded credential vulnerability. This is considered critical as an… | Patch first | 10.0 critical | 13.5% | 2026-02-17 |
| CVE-2021-27876 KEV | An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which… | Patch first | 8.1 high | 13.5% | 2021-03-01 |
| CVE-2025-55177 KEV | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, an… | Patch first | 5.4 medium | 13.5% | 2025-08-29 |
| CVE-2026-34926 KEV | A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the se… | Patch first | 6.7 medium | 13.4% | 2026-05-21 |
| CVE-2023-41991 KEV | A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypa… | Patch first | 5.5 medium | 13.4% | 2023-09-21 |
| CVE-2021-30858 KEV | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing… | Patch first | 8.8 high | 13.4% | 2021-08-24 |
| CVE-2022-22948 KEV | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative acc… | Patch first | 6.5 medium | 13.3% | 2022-03-29 |
| CVE-2025-42999 KEV | SAP NetWeaver Visual Composer Metadata Uploader is vulnerable when a privileged user can upload untrusted or malicious content which, when deserialize… | Patch first | 9.1 critical | 12.9% | 2025-05-13 |
| CVE-2024-21410 KEV | Microsoft Exchange Server Elevation of Privilege Vulnerability | Patch first | 9.8 critical | 12.7% | 2024-02-13 |
| CVE-2022-22675 KEV | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS M… | Patch first | 7.8 high | 12.5% | 2022-05-26 |
| CVE-2026-46817 KEV | Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission). Supported versions that are affected are 12.2… | Patch first | 9.8 critical | 12.3% | 2026-05-28 |
| CVE-2023-32373 KEV | A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 an… | Patch first | 8.8 high | 12.2% | 2023-06-23 |
| CVE-2025-48927 KEV | The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the… | Patch first | 5.3 medium | 12.2% | 2025-05-28 |
| CVE-2023-36424 KEV | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Patch first | 7.8 high | 12.1% | 2023-11-14 |
| CVE-2021-28663 KEV | The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-af… | Patch first | 8.8 high | 12.1% | 2021-05-10 |
| CVE-2023-21715 KEV | Microsoft Publisher Security Feature Bypass Vulnerability | Patch first | 7.3 high | 12% | 2023-02-14 |
| CVE-2022-20775 KEV | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is… | Patch first | 7.8 high | 12% | 2022-09-30 |
| CVE-2026-96652 KEV | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'prot… | Patch first | 4.3 medium | 11.9% | 2026-09-23 |
| CVE-2020-8599 KEV | Trend Micro Apex One (2019) and OfficeScan XG server contain a vulnerable EXE file that could allow a remote attacker to write arbitrary data to an ar… | Patch first | 9.8 critical | 11.9% | 2020-03-18 |
| CVE-2026-15410 KEV | Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Co… | Patch first | 7.2 high | 11.8% | 2026-07-14 |
| CVE-2021-37973 KEV | Use after free in Portals in Google Chrome prior to 94.0.4606.61 allowed a remote attacker who had compromised the renderer process to potentially per… | Patch first | 9.6 critical | 11.7% | 2021-10-08 |
| CVE-2020-3118 KEV | A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute… | Patch first | 8.8 high | 11.7% | 2020-02-05 |
| CVE-2022-22587 KEV | A memory corruption issue was addressed with improved input validation. This issue is fixed in iOS 15.3 and iPadOS 15.3, macOS Big Sur 11.6.3, macOS M… | Patch first | 9.8 critical | 11.6% | 2022-03-18 |
| CVE-2023-41992 KEV | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attack… | Patch first | 7.8 high | 11.6% | 2023-09-21 |
| CVE-2022-20821 KEV | A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is… | Patch first | 6.5 medium | 11.5% | 2022-05-26 |
| CVE-2021-38648 KEV | Open Management Infrastructure Elevation of Privilege Vulnerability | Patch first | 7.8 high | 11.4% | 2021-09-15 |
| CVE-2026-88779 KEV | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and befor… | Patch first | 7.5 high | 11.4% | 2026-10-04 |
| CVE-2021-43890 KEV | We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt… | Patch first | 7.1 high | 11.3% | 2021-12-15 |
| CVE-2017-11292 KEV | Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the… | Patch first | 8.8 high | 11.2% | 2017-10-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt