CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,684 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
217,232 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-20133 KEV | A vulnerability in Cisco Catalyst SD-WAN Software could allow an unauthenticated, remote attacker to view sensitive information on an affected system.… | Patch first | 6.5 medium | 35.3% | 2026-02-25 |
| CVE-2026-20316 KEV | A vulnerability in the web interface of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to log… | Patch first | 5.3 medium | 35.1% | 2026-07-29 |
| CVE-2020-2509 KEV | A command injection vulnerability has been reported to affect QTS and QuTS hero. If exploited, this vulnerability allows attackers to execute arbitrar… | Patch first | 9.8 critical | 34% | 2021-04-17 |
| CVE-2015-0071 KEV | Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet Explore… | Patch first | 6.5 medium | 33.6% | 2015-02-11 |
| CVE-2016-3298 KEV | Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 al… | Patch first | 6.5 medium | 33.3% | 2016-10-14 |
| CVE-2026-19490 KEV | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: from 14.1 through 73.32 and from 13.1 through 63.21; Gateway: from 14.1… | Patch first | 9.8 critical | 33.3% | 2026-08-19 |
| CVE-2024-11182 KEV | An XSS issue was discovered in MDaemon Email Server before version 24.5.1c. An attacker can send an HTML e-mail message with JavaScript in an img… | Patch first | 6.1 medium | 33.3% | 2024-11-15 |
| CVE-2021-30633 KEV | Use after free in Indexed DB API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who had compromised the renderer process to potentia… | Patch first | 9.6 critical | 33.2% | 2021-10-08 |
| CVE-2020-8195 KEV | Improper input validation in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SD… | Patch first | 6.5 medium | 33% | 2020-07-10 |
| CVE-2020-35730 KEV | An XSS issue was discovered in Roundcube Webmail before 1.2.13, 1.3.x before 1.3.16, and 1.4.x before 1.4.10. The attacker can send a plain text e-mai… | Patch first | 6.1 medium | 32.9% | 2020-12-28 |
| CVE-2025-54948 KEV | A vulnerability in Trend Micro Apex One (on-premise) management console could allow a pre-authenticated remote attacker to upload malicious code and e… | Patch first | 9.4 critical | 32.9% | 2025-08-05 |
| CVE-2024-12686 KEV | A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative… | Patch first | 6.6 medium | 32.6% | 2024-12-18 |
| CVE-2025-20393 KEV | A vulnerability in the Spam Quarantine feature of Cisco AsyncOS Software for Cisco Secure Email Gateway and Cisco Secure Email and Web Manager could a… | Patch first | 10.0 critical | 32.4% | 2025-12-17 |
| CVE-2024-57968 KEV | Advantive VeraCore before 2024.4.2.1 allows remote authenticated users to upload files to unintended folders (e.g., ones that are accessible during we… | Patch first | 9.9 critical | 32.1% | 2025-02-03 |
| CVE-2022-4135 KEV | Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially… | Patch first | 9.6 critical | 31.9% | 2022-11-25 |
| CVE-2025-32756 KEV | A stack-based buffer overflow vulnerability [CWE-121] vulnerability in Fortinet FortiCamera 2.1.0 through 2.1.3, FortiCamera 2.0 all versions, FortiCa… | Patch first | 9.8 critical | 30.9% | 2025-05-13 |
| CVE-2022-24682 KEV | An issue was discovered in the Calendar feature in Zimbra Collaboration Suite 8.8.x before 8.8.15 patch 30 (update 1), as exploited in the wild starti… | Patch first | 6.1 medium | 30.9% | 2022-02-09 |
| CVE-2018-13383 KEV | A heap buffer overflow in Fortinet FortiOS 6.0.0 through 6.0.4, 5.6.0 through 5.6.10, 5.4.0 through 5.4.12, 5.2.14 and earlier and FortiProxy 2.0.0, 1… | Patch first | 4.3 medium | 30.7% | 2019-05-29 |
| CVE-2018-19953 KEV | If exploited, this cross-site scripting vulnerability could allow remote attackers to inject malicious code. QNAP has already fixed the issue in the f… | Patch first | 6.1 medium | 30.5% | 2020-10-28 |
| CVE-2021-27852 KEV | Deserialization of Untrusted Data vulnerability in CheckboxWeb.dll of Checkbox Survey allows an unauthenticated remote attacker to execute arbitrary c… | Patch first | 9.8 critical | 30.3% | 2021-05-27 |
| CVE-2021-3199 KEV | Directory traversal with remote code execution can occur in /upload in ONLYOFFICE Document Server before 5.6.3, when JWT is used, via a /.. sequence i… | Patch first | 9.8 critical | 30.2% | 2021-01-26 |
| CVE-2018-19949 KEV | If exploited, this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the fol… | Patch first | 9.8 critical | 30.2% | 2020-10-28 |
| CVE-2021-20028 KEV | Improper neutralization of a SQL Command leading to SQL Injection vulnerability impacting end-of-life Secure Remote Access (SRA) products, specificall… | Patch first | 9.8 critical | 30.1% | 2021-08-04 |
| CVE-2019-3568 KEV | A buffer overflow vulnerability in WhatsApp VOIP stack allowed remote code execution via specially crafted series of RTCP packets sent to a target pho… | Patch first | 9.8 critical | 30.1% | 2019-05-14 |
| CVE-2018-6882 KEV | Cross-site scripting (XSS) vulnerability in the ZmMailMsgView.getAttachmentLinkHtml function in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 an… | Patch first | 6.1 medium | 29.8% | 2018-03-27 |
| CVE-2018-20753 KEV | Kaseya VSA RMM before R9.3 9.3.0.35, R9.4 before 9.4.0.36, and R9.5 before 9.5.0.5 allows unprivileged remote attackers to execute PowerShell payloads… | Patch first | 9.8 critical | 29.6% | 2019-02-05 |
| CVE-2025-68686 KEV | An Exposure of Sensitive Information to an Unauthorized Actor vulnerability [CWE-200] vulnerability in Fortinet FortiOS 7.6.0 through 7.6.1, FortiOS 7… | Patch first | 5.9 medium | 29.5% | 2026-02-10 |
| CVE-2025-14733 KEV | An Out-of-bounds Write vulnerability in the WatchGuard Fireware OS iked process may allow a remote unauthenticated attacker to execute arbitrary code.… | Patch first | 9.8 critical | 29.4% | 2025-12-19 |
| CVE-2026-20963 KEV | Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. | Patch first | 9.8 critical | 29.2% | 2026-01-13 |
| CVE-2026-20262 KEV | A vulnerability in the web UI of Cisco Catalyst SD-WAN Manager, formerly SD-WAN vManage, could allow an authenticated, remote attacker to create a fil… | Patch first | 6.5 medium | 29.1% | 2026-06-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt