CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,684 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
158,384 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-1854 KEV | Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Appl… | Patch first | 7.8 high | 20.9% | 2012-07-10 |
| CVE-2024-40890 KEV | **UNSUPPORTED WHEN ASSIGNED** A post-authentication command injection vulnerability in the CGI program of the legacy DSL CPE Zyxel VMG4325-B10A firmwa… | Patch first | 8.8 high | 20.6% | 2025-02-04 |
| CVE-2014-8439 KEV | Adobe Flash Player before 13.0.0.258 and 14.x and 15.x before 15.0.0.239 on Windows and OS X and before 11.2.202.424 on Linux, Adobe AIR before 15.0.0… | Patch first | 8.8 high | 20.4% | 2014-11-25 |
| CVE-2025-66376 KEV | Zimbra Collaboration (ZCS) 10 before 10.0.18 and 10.1 before 10.1.13 allows Classic UI stored XSS via Cascading Style Sheets (CSS) @import directives… | Patch first | 7.2 high | 20.2% | 2026-01-05 |
| CVE-2021-21148 KEV | Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML… | Patch first | 8.8 high | 20% | 2021-02-09 |
| CVE-2016-1010 KEV | Integer overflow in Adobe Flash Player before 18.0.0.333 and 19.x through 21.x before 21.0.0.182 on Windows and OS X and before 11.2.202.577 on Linux,… | Patch first | 8.8 high | 19.3% | 2016-03-12 |
| CVE-2025-29824 KEV | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. | Patch first | 7.8 high | 19.3% | 2025-04-08 |
| CVE-2016-7892 KEV | Adobe Flash Player versions 23.0.0.207 and earlier, 11.2.202.644 and earlier have an exploitable use after free vulnerability in the TextField class.… | Patch first | 8.8 high | 19.1% | 2016-12-15 |
| CVE-2023-7101 KEV | Spreadsheet::ParseExcel version 0.65 is a Perl module used for parsing Excel files. Spreadsheet::ParseExcel is vulnerable to an arbitrary code executi… | Patch first | 7.8 high | 19% | 2023-12-24 |
| CVE-2023-37450 KEV | The issue was addressed with improved checks. This issue is fixed in iOS 16.6 and iPadOS 16.6, Safari 16.5.2, tvOS 16.6, macOS Ventura 13.5, watchOS 9… | Patch first | 8.8 high | 19% | 2023-07-27 |
| CVE-2026-123158 KEV | sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password authentication bypass (related to misint… | Patch first | 8.1 high | 18.9% | 2026-11-05 |
| CVE-2018-8440 KEV | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevat… | Patch first | 7.8 high | 18.5% | 2018-09-13 |
| CVE-2024-7965 KEV | Inappropriate implementation in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to potentially exploit heap corruption via a craf… | Patch first | 8.8 high | 18.5% | 2024-08-21 |
| CVE-2022-22718 KEV | Windows Print Spooler Elevation of Privilege Vulnerability | Patch first | 7.8 high | 18.5% | 2022-02-09 |
| CVE-2022-38181 KEV | The Arm Mali GPU kernel driver allows unprivileged users to access freed memory because GPU memory operations are mishandled. This affects Bifrost r0p… | Patch first | 8.8 high | 18.5% | 2022-10-25 |
| CVE-2026-22719 KEV | VMware Aria Operations contains a command injection vulnerability. A malicious unauthenticated actor may exploit this issue to execute arbitrary comma… | Patch first | 8.1 high | 18.3% | 2026-02-25 |
| CVE-2022-22047 KEV | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability | Patch first | 7.8 high | 18.3% | 2022-07-12 |
| CVE-2024-8069 KEV | Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authenticated user o… | Patch first | 8.0 high | 18.2% | 2024-11-12 |
| CVE-2021-44207 KEV | Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. | Patch first | 8.1 high | 17.4% | 2021-12-21 |
| CVE-2024-38813 KEV | The vCenter Server contains a privilege escalation vulnerability. A malicious actor with network access to vCenter Server may trigger this vulnerabili… | Patch first | 7.5 high | 17.4% | 2024-09-17 |
| CVE-2022-26904 KEV | Windows User Profile Service Elevation of Privilege Vulnerability | Patch first | 7.0 high | 16.9% | 2022-04-15 |
| CVE-2023-36036 KEV | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Patch first | 7.8 high | 16.7% | 2023-11-14 |
| CVE-2021-20022 KEV | SonicWall Email Security version 10.0.9.x contains a vulnerability that allows a post-authenticated attacker to upload an arbitrary file to the remote… | Patch first | 7.2 high | 16.6% | 2021-04-09 |
| CVE-2023-32409 KEV | The issue was addressed with improved bounds checks. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.8 and iPadOS 15.7.8,… | Patch first | 8.6 high | 16.5% | 2023-06-23 |
| CVE-2020-0986 KEV | An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel Elevation of Pr… | Patch first | 7.8 high | 16.4% | 2020-06-09 |
| CVE-2025-41244 KEV | VMware Aria Operations and VMware Tools contain a local privilege escalation vulnerability. A malicious local actor with non-administrative privileges… | Patch first | 7.8 high | 16.4% | 2025-09-29 |
| CVE-2022-22620 KEV | A use after free issue was addressed with improved memory management. This issue is fixed in macOS Monterey 12.2.1, iOS 15.3.1 and iPadOS 15.3.1, Safa… | Patch first | 8.8 high | 16.3% | 2022-03-18 |
| CVE-2026-21513 KEV | Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network. | Patch first | 8.8 high | 15.9% | 2026-02-10 |
| CVE-2023-35311 KEV | Microsoft Outlook Security Feature Bypass Vulnerability | Patch first | 8.8 high | 15.5% | 2023-07-11 |
| CVE-2015-0310 KEV | Adobe Flash Player before 13.0.0.262 and 14.x through 16.x before 16.0.0.287 on Windows and OS X and before 11.2.202.438 on Linux does not properly re… | Patch first | 7.8 high | 15.1% | 2015-01-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt