CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
402,624 CVEs
1,734 on KEV
17,294 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-07
36,838 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-14481 | In the MMM::Agent::Helpers::Network::send_arp function in MySQL Multi-Master Replication Manager (MMM) mmm_agentd 2.2.1 (for Solaris), a specially cra… | In your normal cycle | 9.8 critical | 5.8% | 2018-05-09 |
| CVE-2016-9843 | The crc32_big function in crc32.c in zlib 1.2.8 might allow context-dependent attackers to have unspecified impact via vectors involving big-endian CR… | In your normal cycle | 9.8 critical | 5.8% | 2017-05-23 |
| CVE-2019-18956 | Divisa Proxia Suite 9 < 9.12.16, 9.11.19, 9.10.26, 9.9.8, 9.8.43 and 9.7.10, 10.0 < 10.0.32, and 10.1 < 10.1.5, SparkSpace 1.0 < 1.0.30, 1.1 < 1.1.2,… | In your normal cycle | 9.8 critical | 5.8% | 2019-12-17 |
| CVE-2022-37454 | The Keccak XKCP SHA-3 reference implementation before fdc6fef has an integer overflow and resultant buffer overflow that allows attackers to execute a… | In your normal cycle | 9.8 critical | 5.8% | 2022-10-21 |
| CVE-2016-4702 | Audio in Apple iOS before 10, OS X before 10.12, tvOS before 10, and watchOS before 3 allows remote attackers to execute arbitrary code or cause a den… | In your normal cycle | 9.8 critical | 5.8% | 2016-09-25 |
| CVE-2011-10019 | Spreecommerce versions prior to 0.60.2 contains a remote command execution vulnerability in its search functionality. The application fails to properl… | In your normal cycle | 9.8 critical | 5.8% | 2025-08-13 |
| CVE-2017-2767 | EMC Network Configuration Manager (NCM) 9.3.x, EMC Network Configuration Manager (NCM) 9.4.0.x, EMC Network Configuration Manager (NCM) 9.4.1.x, EMC N… | In your normal cycle | 9.8 critical | 5.8% | 2017-02-03 |
| CVE-2019-7850 | Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitra… | In your normal cycle | 9.8 critical | 5.8% | 2019-07-18 |
| CVE-2019-8088 | Adobe Experience Manager versions 6.5, 6.4, 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code e… | In your normal cycle | 9.8 critical | 5.8% | 2019-10-25 |
| CVE-2023-54335 | eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request.… | In your normal cycle | 9.8 critical | 5.8% | 2026-01-13 |
| CVE-2016-8027 | SQL injection vulnerability in core services in Intel Security McAfee ePolicy Orchestrator (ePO) 5.3.2 and earlier and 5.1.3 and earlier allows attack… | In your normal cycle | 10.0 critical | 5.7% | 2017-03-14 |
| CVE-2016-6999 | Integer overflow in Adobe Reader and Acrobat before 11.0.18, Acrobat and Acrobat Reader DC Classic before 15.006.30243, and Acrobat and Acrobat Reader… | In your normal cycle | 9.8 critical | 5.7% | 2016-10-13 |
| CVE-2019-10095 | bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings. This issue affec… | In your normal cycle | 9.8 critical | 5.7% | 2021-09-02 |
| CVE-2020-3323 | A vulnerability in the web-based management interface of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated… | In your normal cycle | 9.8 critical | 5.7% | 2020-07-16 |
| CVE-2020-19138 | Unrestricted Upload of File with Dangerous Type in DotCMS v5.2.3 and earlier allow remote attackers to execute arbitrary code via the component "/src/… | In your normal cycle | 9.8 critical | 5.7% | 2021-09-08 |
| CVE-2016-3147 | Buffer overflow in the collector.exe listener of the Landesk Management Suite 10.0.0.271 and earlier allows remote attackers to cause a denial of serv… | In your normal cycle | 9.8 critical | 5.7% | 2017-01-23 |
| CVE-2015-8778 | Integer overflow in the GNU C Library (aka glibc or libc6) before 2.23 allows context-dependent attackers to cause a denial of service (application cr… | In your normal cycle | 9.8 critical | 5.7% | 2016-04-19 |
| CVE-2018-8865 | In Lantech IDS 2102 2.0 and prior, a stack-based buffer overflow vulnerability has been identified which may allow remote code execution. A CVSS v3 ba… | In your normal cycle | 9.8 critical | 5.7% | 2018-05-04 |
| CVE-2019-17495 | A Cascading Style Sheets (CSS) injection vulnerability in Swagger UI before 3.23.11 allows attackers to use the Relative Path Overwrite (RPO) techniqu… | In your normal cycle | 9.8 critical | 5.7% | 2019-10-10 |
| CVE-2015-6016 | ZyXEL P-660HW-T1 2 devices with ZyNOS firmware 3.40(AXH.0), PMG5318-B20A devices with firmware 1.00AANC0b5, and NBG-418N devices have a default passwo… | In your normal cycle | 9.8 critical | 5.7% | 2015-12-31 |
| CVE-2018-11307 | An issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.5. Use of Jackson default typing along with a gadget class from iBatis allows… | In your normal cycle | 9.8 critical | 5.7% | 2019-07-09 |
| CVE-2016-4215 | Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous befor… | In your normal cycle | 9.8 critical | 5.7% | 2016-07-13 |
| CVE-2019-16942 | A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a… | In your normal cycle | 9.8 critical | 5.7% | 2019-10-01 |
| CVE-2025-71284 | Synway SMG Gateway Management Software contains an OS command injection vulnerability in the RADIUS configuration endpoint at /en/9-2radius.php where… | In your normal cycle | 9.8 critical | 5.7% | 2026-04-30 |
| CVE-2015-6764 | The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before 47.0.2… | In your normal cycle | 9.8 critical | 5.7% | 2015-12-06 |
| CVE-2016-5762 | Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitr… | In your normal cycle | 9.8 critical | 5.7% | 2017-04-20 |
| CVE-2016-1931 | Multiple unspecified vulnerabilities in the browser engine in Mozilla Firefox before 44.0 allow remote attackers to cause a denial of service (memory… | In your normal cycle | 10.0 critical | 5.7% | 2016-01-31 |
| CVE-2025-14534 | A vulnerability was determined in UTT 进取 512W up to 3.1.7.7-171114. This impacts the function strcpy of the file /goform/formNatStaticMap of the compo… | In your normal cycle | 9.8 critical | 5.7% | 2025-12-11 |
| CVE-2020-9576 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerabilit… | In your normal cycle | 9.8 critical | 5.7% | 2020-06-26 |
| CVE-2020-9578 | Magento versions 2.3.4 and earlier, 2.2.11 and earlier (see note), 1.14.4.4 and earlier, and 1.9.4.4 and earlier have a command injection vulnerabilit… | In your normal cycle | 9.8 critical | 5.7% | 2020-06-26 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt