CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,634 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
196,876 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-0185 KEV EXP | Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted Media Cent… | Patch first | 7.8 high | 69.8% | 2016-05-11 |
| CVE-2013-1690 KEV EXP | Mozilla Firefox before 22.0, Firefox ESR 17.x before 17.0.7, Thunderbird before 17.0.7, and Thunderbird ESR 17.x before 17.0.7 do not properly handle… | Patch first | 8.8 high | 69% | 2013-06-26 |
| CVE-2017-6077 KEV EXP | ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metac… | Patch first | 9.8 critical | 68.7% | 2017-02-22 |
| CVE-2015-4495 KEV EXP | The PDF reader in Mozilla Firefox before 39.0.3, Firefox ESR 38.x before 38.1.1, and Firefox OS before 2.2 allows remote attackers to bypass the Same… | Patch first | 8.8 high | 68.6% | 2015-08-08 |
| CVE-2019-18426 KEV EXP | A vulnerability in WhatsApp Desktop versions prior to 0.3.9309 when paired with WhatsApp for iPhone versions prior to 2.20.10 allows cross-site script… | Patch first | 8.2 high | 68.1% | 2020-01-21 |
| CVE-2016-4657 KEV EXP | WebKit in Apple iOS before 9.3.5 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web… | Patch first | 8.8 high | 66.8% | 2016-08-25 |
| CVE-2013-2729 KEV EXP | Integer overflow in Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allows attackers to execute arbitrary code… | Patch first | 9.8 critical | 66.6% | 2013-05-16 |
| CVE-2018-7445 KEV EXP | A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. Remote attackers with access to the… | Patch first | 9.8 critical | 65.8% | 2018-03-19 |
| CVE-2013-0629 KEV EXP | Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10, when a password is not configured, allows attackers to access restricted directories via unspecified vecto… | Patch first | 7.5 high | 65.8% | 2013-01-09 |
| CVE-2015-7645 KEV EXP | Adobe Flash Player 18.x through 18.0.0.252 and 19.x through 19.0.0.207 on Windows and OS X and 11.x through 11.2.202.535 on Linux allows remote attack… | Patch first | 7.8 high | 65.3% | 2015-10-15 |
| CVE-2019-0211 KEV EXP | In Apache HTTP Server 2.4 releases 2.4.17 to 2.4.38, with MPM event, worker or prefork, code executing in less-privileged child processes or threads (… | Patch first | 7.8 high | 65% | 2019-04-08 |
| CVE-2023-4911 KEV EXP | A buffer overflow was discovered in the GNU C Library's dynamic loader ld.so while processing the GLIBC_TUNABLES environment variable. This issue coul… | Patch first | 7.8 high | 63.8% | 2023-10-03 |
| CVE-2011-0609 KEV EXP | Unspecified vulnerability in Adobe Flash Player 10.2.154.13 and earlier on Windows, Mac OS X, Linux, and Solaris; 10.1.106.16 and earlier on Android;… | Patch first | 7.8 high | 63.5% | 2011-03-15 |
| CVE-2016-0151 KEV EXP | The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 m… | Patch first | 7.8 high | 62.8% | 2016-04-12 |
| CVE-2026-0770 KEV EXP | Langflow exec_globals Inclusion of Functionality from Untrusted Control Sphere Remote Code Execution Vulnerability. This vulnerability allows remote a… | Patch first | 9.8 critical | 62.6% | 2026-01-23 |
| CVE-2024-21338 KEV EXP | Windows Kernel Elevation of Privilege Vulnerability | Patch first | 7.8 high | 62.2% | 2024-02-13 |
| CVE-2018-6065 KEV EXP | Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 al… | Patch first | 8.8 high | 60.3% | 2018-11-14 |
| CVE-2020-8655 KEV EXP | An issue was discovered in EyesOfNetwork 5.3. The sudoers configuration is prone to a privilege escalation vulnerability, allowing the apache user to… | Patch first | 7.8 high | 59.9% | 2020-02-07 |
| CVE-2017-0101 KEV EXP | The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, Windows Ser… | Patch first | 7.8 high | 57.5% | 2017-03-17 |
| CVE-2025-32463 KEV EXP | Sudo before 1.9.17p1 allows local users to obtain root access because /etc/nsswitch.conf from a user-controlled directory is used with the --chroot op… | Patch first | 9.3 critical | 56.3% | 2025-06-30 |
| CVE-2015-1701 KEV EXP | Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privileges via a… | Patch first | 7.8 high | 56.2% | 2015-04-21 |
| CVE-2019-11708 KEV EXP | Insufficient vetting of parameters passed with the Prompt:Open IPC message between child and parent processes can result in the non-sandboxed parent p… | Patch first | 10.0 critical | 55.9% | 2019-07-23 |
| CVE-2016-0984 KEV EXP | Use-after-free vulnerability in Adobe Flash Player before 18.0.0.329 and 19.x and 20.x before 20.0.0.306 on Windows and OS X and before 11.2.202.569 o… | Patch first | 8.8 high | 54.5% | 2016-02-10 |
| CVE-2026-2441 KEV EXP | Use after free in CSS in Google Chrome prior to 145.0.7632.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… | Patch first | 8.8 high | 54.5% | 2026-02-13 |
| CVE-2019-0808 KEV EXP | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation… | Patch first | 7.8 high | 53.3% | 2019-04-09 |
| CVE-2019-0541 KEV EXP | A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vu… | Patch first | 8.8 high | 53.2% | 2019-01-08 |
| CVE-2015-2419 KEV EXP | JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)… | Patch first | 8.8 high | 53% | 2015-07-14 |
| CVE-2019-13272 KEV EXP | In the Linux kernel before 5.1.17, ptrace_link in kernel/ptrace.c mishandles the recording of the credentials of a process that wants to create a ptra… | Patch first | 7.8 high | 52.2% | 2019-07-17 |
| CVE-2019-13720 KEV EXP | Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Patch first | 8.8 high | 49.4% | 2019-11-25 |
| CVE-2014-4404 KEV EXP | Heap-based buffer overflow in IOHIDFamily in Apple iOS before 8 and Apple TV before 7 allows attackers to execute arbitrary code in a privileged conte… | Patch first | 7.8 high | 48.9% | 2014-09-18 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt