CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
401,098 CVEs
1,733 on KEV
17,290 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-04
36,706 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2022-30011 | In HMS 1.0 when requesting appointment.php through POST, multiple parameters can lead to a SQL injection vulnerability. | Patch early | 9.8 critical | 18.7% | 2022-05-16 |
| CVE-2025-8356 | In Xerox FreeFlow Core version 8.0.4, an attacker can exploit a Path Traversal vulnerability to access unauthorized files on the server. This can lead… | Patch early | 9.8 critical | 18.7% | 2025-08-08 |
| CVE-2015-7545 | The (1) git-remote-ext and (2) unspecified other remote helper programs in Git before 2.3.10, 2.4.x before 2.4.10, 2.5.x before 2.5.4, and 2.6.x befor… | Patch early | 9.8 critical | 18.7% | 2016-04-13 |
| CVE-2022-28346 | An issue was discovered in Django 2.2 before 2.2.28, 3.2 before 3.2.13, and 4.0 before 4.0.4. QuerySet.annotate(), aggregate(), and extra() methods ar… | Patch early | 9.8 critical | 18.7% | 2022-04-12 |
| CVE-2021-3110 | The store system in PrestaShop 1.7.7.0 allows time-based boolean SQL injection via the module=productcomments controller=CommentGrade id_products[] pa… | Patch early | 9.8 critical | 18.7% | 2021-01-20 |
| CVE-2020-2733 | Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Monitoring and Diagnostics). The supported version that i… | Patch early | 9.8 critical | 18.6% | 2020-04-15 |
| CVE-2015-6420 | Serialized-object interfaces in certain Cisco Collaboration and Social Media; Endpoint Clients and Client Software; Network Application, Service, and… | Patch early | 9.8 critical | 18.6% | 2015-12-15 |
| CVE-2025-14706 | A vulnerability was identified in Shiguangwu sgwbox N3 2.0.25. This impacts an unknown function of the file /usr/sbin/http_eshell_server of the compon… | Patch early | 9.8 critical | 18.6% | 2025-12-15 |
| CVE-2025-14707 | A security flaw has been discovered in Shiguangwu sgwbox N3 2.0.25. Affected is an unknown function of the file /usr/sbin/http_eshell_server of the co… | Patch early | 9.8 critical | 18.6% | 2025-12-15 |
| CVE-2024-23472 | SolarWinds Access Rights Manager (ARM) is susceptible to Directory Traversal vulnerability. This vulnerability allows an authenticated user to arbitra… | Patch early | 9.6 critical | 18.6% | 2024-07-17 |
| CVE-2023-49237 | An issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davinci to un… | Patch early | 9.8 critical | 18.6% | 2024-01-09 |
| CVE-2019-1372 | An remote code execution vulnerability exists when Azure App Service/ Antares on Azure Stack fails to check the length of a buffer prior to copying me… | Patch early | 10.0 critical | 18.5% | 2019-10-10 |
| CVE-2022-32994 | Halo CMS v1.5.3 was discovered to contain an arbitrary file upload vulnerability via the component /api/admin/attachments/upload. | Patch early | 9.8 critical | 18.5% | 2022-06-27 |
| CVE-2025-5623 | A vulnerability was found in D-Link DIR-816 1.10CNB05. It has been classified as critical. This affects the function qosClassifier of the file /goform… | Patch early | 9.8 critical | 18.5% | 2025-06-05 |
| CVE-2022-24144 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. This vulnerability allows a… | Patch early | 9.8 critical | 18.5% | 2022-02-04 |
| CVE-2021-34730 | A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthe… | Patch early | 9.8 critical | 18.5% | 2021-08-18 |
| CVE-2018-8500 | A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory C… | Patch early | 9.8 critical | 18.5% | 2018-10-10 |
| CVE-2025-7206 | A vulnerability, which was classified as critical, has been found in D-Link DIR-825 2.10. This issue affects the function sub_410DDC of the file switc… | Patch early | 9.8 critical | 18.5% | 2025-07-09 |
| CVE-2021-38393 | A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior… | Patch early | 9.8 critical | 18.5% | 2021-08-30 |
| CVE-2024-2879 | The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficie… | Patch early | 9.8 critical | 18.4% | 2024-04-03 |
| CVE-2021-3239 | E-Learning System 1.0 suffers from an unauthenticated SQL injection vulnerability, which allows remote attackers to execute arbitrary code on the host… | Patch early | 9.8 critical | 18.4% | 2021-02-15 |
| CVE-2020-9547 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engin… | Patch early | 9.8 critical | 18.4% | 2020-03-02 |
| CVE-2020-9548 | FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.Ant… | Patch early | 9.8 critical | 18.3% | 2020-03-02 |
| CVE-2019-7139 | An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. T… | Patch early | 9.8 critical | 18.3% | 2019-04-10 |
| CVE-2023-25610 | A buffer underwrite ('buffer underflow') vulnerability in the administrative interface of Fortinet FortiOS version 7.2.0 through 7.2.3, version 7.0.0… | Patch early | 9.8 critical | 18.3% | 2025-03-24 |
| CVE-2002-0639 | Integer overflow in sshd in OpenSSH 2.9.9 through 3.3 allows remote attackers to execute arbitrary code during challenge response authentication (Chal… | Patch early | 9.8 critical | 18.3% | 2002-07-03 |
| CVE-2022-29307 | IonizeCMS v1.0.8.1 was discovered to contain a command injection vulnerability via the function copy_lang_content in application/models/lang_model.php… | Patch early | 9.8 critical | 18.3% | 2022-05-12 |
| CVE-2022-38142 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service po… | Patch early | 9.8 critical | 18.2% | 2022-10-31 |
| CVE-2023-30803 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated att… | Patch early | 9.8 critical | 18.2% | 2023-10-10 |
| CVE-2025-6793 | Marvell QConvergeConsole QLogicDownloadImpl Directory Traversal Arbitrary File Deletion and Information Disclosure Vulnerability. This vulnerability a… | Patch early | 9.4 critical | 18.2% | 2025-07-07 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt