CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,700 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
217,232 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-33010 KEV | A buffer overflow vulnerability in the ID processing function in Zyxel ATP series firmware versions 4.32 through 5.36 Patch 1, USG FLEX series firmwar… | Patch first | 9.8 critical | 29% | 2023-05-24 |
| CVE-2014-3931 KEV | fastping.c in MRLG (aka Multi-Router Looking Glass) before 5.5.0 allows remote attackers to cause an arbitrary memory write and memory corruption. | Patch first | 9.8 critical | 29% | 2017-03-31 |
| CVE-2020-3153 KEV | A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy… | Patch first | 6.5 medium | 28.5% | 2020-02-19 |
| CVE-2024-11120 KEV | Certain EOL GeoVision devices have an OS Command Injection vulnerability. Unauthenticated remote attackers can exploit this vulnerability to inject an… | Patch first | 9.8 critical | 28.4% | 2024-11-15 |
| CVE-2023-33009 KEV | A buffer overflow vulnerability in the notification function in Zyxel ATP series firmware versions 4.60 through 5.36 Patch 1, USG FLEX series firmware… | Patch first | 9.8 critical | 28.1% | 2023-05-24 |
| CVE-2020-5135 KEV | A buffer overflow vulnerability in SonicOS allows a remote attacker to cause Denial of Service (DoS) and potentially execute arbitrary code by sending… | Patch first | 9.8 critical | 26.9% | 2020-10-12 |
| CVE-2024-37085 KEV | VMware ESXi contains an authentication bypass vulnerability. A malicious actor with sufficient Active Directory (AD) permissions can gain full access… | Patch first | 6.8 medium | 26.8% | 2024-06-25 |
| CVE-2023-20269 KEV | A vulnerability in the remote access VPN feature of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software… | Patch first | 5.0 medium | 26.6% | 2023-09-06 |
| CVE-2025-23006 KEV | Pre-authentication deserialization of untrusted data vulnerability has been identified in the SMA1000 Appliance Management Console (AMC) and Central M… | Patch first | 9.8 critical | 26.6% | 2025-01-23 |
| CVE-2026-94127 KEV | When a BIG-IP APM access policy and an OAuth profile are configured on a virtual server, specific malicious traffic can lead to remote code execution… | Patch first | 9.8 critical | 26.6% | 2026-09-22 |
| CVE-2016-3351 KEV | Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Micros… | Patch first | 6.5 medium | 26.5% | 2016-09-14 |
| CVE-2020-8196 KEV | Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWA… | Patch first | 4.3 medium | 26.3% | 2020-07-10 |
| CVE-2026-45247 KEV | Mirasvit Full Page Cache Warmer for Magento 2 before version 1.11.12 contains a PHP object injection vulnerability that allows unauthenticated attacke… | Patch first | 9.8 critical | 26.2% | 2026-05-26 |
| CVE-2026-20122 KEV | A vulnerability in the API of Cisco Catalyst SD-WAN Manager could allow an authenticated, remote attacker to overwrite arbitrary files on the local fi… | Patch first | 5.4 medium | 25.8% | 2026-02-25 |
| CVE-2015-2590 KEV | Unspecified vulnerability in Oracle Java SE 6u95, 7u80, and 8u45, and Java SE Embedded 7u75 and 8u33 allows remote attackers to affect confidentiality… | Patch first | 9.8 critical | 25.5% | 2015-07-16 |
| CVE-2024-27443 KEV | An issue was discovered in Zimbra Collaboration (ZCS) 9.0 and 10.0. A Cross-Site Scripting (XSS) vulnerability exists in the CalendarInvite feature of… | Patch first | 6.1 medium | 24.6% | 2024-08-12 |
| CVE-2016-9563 KEV | BC-BMT-BPM-DSK in SAP NetWeaver AS JAVA 7.5 allows remote authenticated users to conduct XML External Entity (XXE) attacks via the sap.com~tc~bpem~him… | Patch first | 6.5 medium | 24.2% | 2016-11-23 |
| CVE-2025-4632 KEV | Improper limitation of a pathname to a restricted directory vulnerability in Samsung MagicINFO 9 Server version before 21.1052 allows attackers to wri… | Patch first | 9.8 critical | 24.1% | 2025-05-13 |
| CVE-2026-60004 KEV | Gitea before 1.27.1 allows remote code execution via the diffpatch API through Git hook installation. | Patch first | 9.8 critical | 24% | 2026-08-26 |
| CVE-2024-9680 KEV | An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines. We have had reports of th… | Patch first | 9.8 critical | 23.2% | 2024-10-09 |
| CVE-2014-2120 KEV | Cross-site scripting (XSS) vulnerability in the WebVPN login page in Cisco Adaptive Security Appliance (ASA) Software allows remote attackers to injec… | Patch first | 6.1 medium | 22.6% | 2014-03-19 |
| CVE-2026-5430 KEV | The JWT authentication mechanism accepts tokens signed with algorithms other than those explicitly configured or supported. This allows an attacker to… | Patch first | 10.0 critical | 22.4% | 2026-08-06 |
| CVE-2024-37079 KEV | vCenter Server contains a heap-overflow vulnerability in the implementation of the DCERPC protocol. A malicious actor with network access to vCenter S… | Patch first | 9.8 critical | 22.4% | 2024-06-18 |
| CVE-2014-0546 KEV | Adobe Reader and Acrobat 10.x before 10.1.11 and 11.x before 11.0.08 on Windows allow attackers to bypass a sandbox protection mechanism, and conseque… | Patch first | 9.8 critical | 22.3% | 2014-08-12 |
| CVE-2016-1019 KEV | Adobe Flash Player 21.0.0.197 and earlier allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code… | Patch first | 9.8 critical | 22.3% | 2016-04-07 |
| CVE-2024-44309 KEV | A cookie management issue was addressed with improved state management. This issue is fixed in Safari 18.1.1, iOS 17.7.2 and iPadOS 17.7.2, iOS 18.1.1… | Patch first | 6.3 medium | 21.9% | 2024-11-20 |
| CVE-2016-0162 KEV | Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet Explor… | Patch first | 4.3 medium | 21.9% | 2016-04-12 |
| CVE-2025-67038 KEV | An issue was discovered in Lantronix EDS5000 2.1.0.0R3. The HTTP RPC module executes a shell command to write logs when user's authentication fails. T… | Patch first | 9.8 critical | 21.1% | 2026-03-11 |
| CVE-2024-7971 KEV | Type confusion in V8 in Google Chrome prior to 128.0.6613.84 allowed a remote attacker to exploit heap corruption via a crafted HTML page. (Chromium s… | Patch first | 9.6 critical | 21% | 2024-08-21 |
| CVE-2025-31200 KEV | A memory corruption issue was addressed with improved bounds checking. This issue is fixed in iOS 18.4.1 and iPadOS 18.4.1, macOS Sequoia 15.4.1, tvOS… | Patch first | 9.8 critical | 20.9% | 2025-04-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt