CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,634 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
217,209 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-14644 KEV | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core). Supported versions that are affected are 12.2.1.3.0… | Patch first | 9.8 critical | 94.5% | 2020-07-15 |
| CVE-2017-18368 KEV | The ZyXEL P660HN-T1A v1 TCLinux Fw $7.3.15.0 v001 / 3.40(ULM.0)b31 router distributed by TrueOnline has a command injection vulnerability in the Remot… | Patch first | 9.8 critical | 94.5% | 2019-05-02 |
| CVE-2024-55591 KEV | An Authentication Bypass Using an Alternate Path or Channel vulnerability [CWE-288] affecting FortiOS version 7.0.0 through 7.0.16 and FortiProxy vers… | Patch first | 9.8 critical | 94.4% | 2025-01-14 |
| CVE-2026-35616 KEV | A improper access control vulnerability in Fortinet FortiClientEMS 7.4.5 through 7.4.6 may allow an unauthenticated attacker to execute unauthorized c… | Patch first | 9.8 critical | 94% | 2026-04-04 |
| CVE-2025-11953 KEV | The Metro Development Server, which is opened by the React Native Community CLI, binds to external interfaces by default. The server exposes an endpoi… | Patch first | 9.8 critical | 94% | 2025-11-03 |
| CVE-2024-55956 KEV | In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can import and execute arbitrary Bash… | Patch first | 9.8 critical | 94% | 2024-12-13 |
| CVE-2026-1731 KEV | BeyondTrust Remote Support (RS) and certain older versions of Privileged Remote Access (PRA) contain a critical pre-authentication remote code executi… | Patch first | 9.8 critical | 93.9% | 2026-02-06 |
| CVE-2025-24016 KEV | Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an… | Patch first | 9.9 critical | 93.8% | 2025-02-10 |
| CVE-2020-7796 KEV | Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7 allows SSRF when WebEx zimlet is installed and zimlet JSP is enabled. | Patch first | 9.8 critical | 93.6% | 2020-02-18 |
| CVE-2021-44077 KEV | Zoho ManageEngine ServiceDesk Plus before 11306, ServiceDesk Plus MSP before 10530, and SupportCenter Plus before 11014 are vulnerable to unauthentica… | Patch first | 9.8 critical | 93.5% | 2021-11-29 |
| CVE-2025-54309 KEV | CrushFTP 10 before 10.8.5 and 11 before 11.3.4_23, when the DMZ proxy feature is not used, mishandles AS2 validation and consequently allows remote at… | Patch first | 9.0 critical | 93.5% | 2025-07-18 |
| CVE-2023-36846 KEV | A Missing Authentication for Critical Function vulnerability in Juniper Networks Junos OS on SRX Series allows an unauthenticated, network-based attac… | Patch first | 5.3 medium | 93.5% | 2023-08-17 |
| CVE-2024-28987 KEV | The SolarWinds Web Help Desk (WHD) software is affected by a hardcoded credential vulnerability, allowing remote unauthenticated user to access intern… | Patch first | 9.1 critical | 93.3% | 2024-08-21 |
| CVE-2026-39808 KEV | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.… | Patch first | 9.8 critical | 93.2% | 2026-04-14 |
| CVE-2021-40870 KEV | An issue was discovered in Aviatrix Controller 6.x before 6.5-1804.1922. Unrestricted upload of a file with a dangerous type is possible, which allows… | Patch first | 9.8 critical | 93% | 2021-09-13 |
| CVE-2024-6670 KEV | In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted pa… | Patch first | 9.8 critical | 92.9% | 2024-08-29 |
| CVE-2020-2551 KEV | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components). Supported versions that are affected… | Patch first | 9.8 critical | 92.8% | 2020-01-15 |
| CVE-2016-3427 KEV | Unspecified vulnerability in Oracle Java SE 6u113, 7u99, and 8u77; Java SE Embedded 8u77; and JRockit R28.3.9 allows remote attackers to affect confid… | Patch first | 9.8 critical | 92.3% | 2016-04-21 |
| CVE-2025-9242 KEV | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code.… | Patch first | 9.8 critical | 92.2% | 2025-09-17 |
| CVE-2022-37042 KEV | Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing auth… | Patch first | 9.8 critical | 92.1% | 2022-08-12 |
| CVE-2020-10148 KEV | The SolarWinds Orion API is vulnerable to an authentication bypass that could allow a remote attacker to execute API commands. This vulnerability coul… | Patch first | 9.8 critical | 92% | 2020-12-29 |
| CVE-2024-11680 KEV | ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Remote, unauthenticated attackers can exploit this flaw… | Patch first | 9.8 critical | 91.8% | 2024-11-26 |
| CVE-2026-20182 KEV | May 2026: This security advisory provides the details and fix information for a vulnerability that was discovered and fixed after the was disclosed i… | Patch first | 10.0 critical | 91.8% | 2026-05-14 |
| CVE-2026-71362 KEV | Adobe Commerce is affected by an Incorrect Authorization vulnerability that could result in privilege escalation. An attacker could leverage this vuln… | Patch first | 9.1 critical | 91.7% | 2026-08-11 |
| CVE-2022-26258 KEV | D-Link DIR-820L 1.05B03 was discovered to contain remote command execution (RCE) vulnerability via HTTP POST to get set ccp. | Patch first | 9.8 critical | 91.6% | 2022-03-28 |
| CVE-2026-93616 KEV | A directory traversal and file upload vulnerability allows an unauthenticated attacker to upload and execute arbitrary scripts on Check Point Manageme… | Patch first | 9.8 critical | 91.6% | 2026-09-22 |
| CVE-2026-3055 KEV | Insufficient input validation in NetScaler ADC and NetScaler Gateway when configured as a SAML IDP leading to memory overread | Patch first | 9.8 critical | 91.5% | 2026-03-23 |
| CVE-2022-26352 KEV | An issue was discovered in the ContentResource API in dotCMS 3.0 through 22.02. Attackers can craft a multipart form request to post a file whose file… | Patch first | 9.8 critical | 91.2% | 2022-07-17 |
| CVE-2021-35211 KEV | Microsoft discovered a remote code execution (RCE) vulnerability in the SolarWinds Serv-U product utilizing a Remote Memory Escape Vulnerability. If e… | Patch first | 9.0 critical | 91.2% | 2021-07-14 |
| CVE-2024-13160 KEV | Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthent… | Patch first | 9.8 critical | 91% | 2025-01-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt