CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,553 CVEs
1,726 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
36,454 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-7584 EXP | In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an H… | Patch early | 9.8 critical | 87.3% | 2018-03-01 |
| CVE-2021-32305 EXP | WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. | Patch early | 9.8 critical | 87.3% | 2021-05-18 |
| CVE-2009-3555 EXP | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache H… | Patch early | 9.8 critical | 87.3% | 2009-11-09 |
| CVE-2018-5999 EXP | An issue was discovered in AsusWRT before 3.0.0.4.384_10007. In the handle_request function in router/httpd/httpd.c, processing of POST requests conti… | Patch early | 9.8 critical | 87.3% | 2018-01-22 |
| CVE-2017-12611 EXP | In Apache Struts 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can l… | Patch early | 9.8 critical | 87.1% | 2017-09-20 |
| CVE-2016-6603 EXP | ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header. | Patch early | 9.8 critical | 87% | 2017-01-23 |
| CVE-2025-32429 EXP | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In versions 9.4-rc-1 through 16.10.5 and 17.0… | Patch early | 9.8 critical | 87% | 2025-07-24 |
| CVE-2018-1002105 EXP | In all Kubernetes versions prior to v1.10.11, v1.11.5, and v1.12.3, incorrect handling of error responses to proxied upgrade requests in the kube-apis… | Patch early | 9.8 critical | 87% | 2018-12-05 |
| CVE-2021-24762 EXP | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the… | Patch early | 9.8 critical | 86.8% | 2022-02-01 |
| CVE-2018-0101 EXP | A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthentic… | Patch early | 10.0 critical | 86.8% | 2018-01-29 |
| CVE-2020-13151 EXP | Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a… | Patch early | 9.8 critical | 86.7% | 2020-08-05 |
| CVE-2015-8103 EXP | The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Ja… | Patch early | 9.8 critical | 86.7% | 2015-11-25 |
| CVE-2018-1160 EXP | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. This is due to lack of bounds checking on attacker controlled data.… | Patch early | 9.8 critical | 86.5% | 2018-12-20 |
| CVE-2018-10661 EXP | An issue was discovered in multiple models of Axis IP Cameras. There is a bypass of access control. | Patch early | 9.8 critical | 86.5% | 2018-06-26 |
| CVE-2024-25641 EXP | Cacti provides an operational monitoring and fault management framework. Prior to version 1.2.27, an arbitrary file write vulnerability, exploitable t… | Patch early | 9.1 critical | 86.3% | 2024-05-14 |
| CVE-2018-15379 EXP | A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated… | Patch early | 9.8 critical | 86.2% | 2018-10-05 |
| CVE-2025-59528 EXP | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execut… | Patch early | 10.0 critical | 86.2% | 2025-09-22 |
| CVE-2017-5816 EXP | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found. | Patch early | 9.8 critical | 86.2% | 2018-02-15 |
| CVE-2023-4634 EXP | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.0… | Patch early | 9.8 critical | 85.9% | 2023-09-06 |
| CVE-2017-9769 EXP | A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to… | Patch early | 9.8 critical | 85.5% | 2017-08-02 |
| CVE-2022-0441 EXP | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated user… | Patch early | 9.8 critical | 85.3% | 2022-03-07 |
| CVE-2018-6000 EXP | An issue was discovered in AsusWRT before 3.0.0.4.384_10007. The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functional… | Patch early | 9.8 critical | 85.2% | 2018-01-22 |
| CVE-2019-20361 EXP | There was a flaw in the WordPress plugin, Email Subscribers & Newsletters before 4.3.1, that allowed SQL statements to be passed to the database in th… | Patch early | 9.8 critical | 85.1% | 2020-01-08 |
| CVE-2017-14491 EXP | Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted… | Patch early | 9.8 critical | 84.9% | 2017-10-04 |
| CVE-2019-7214 EXP | SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data. An unauthenticated attacker could run commands on the server… | Patch early | 9.8 critical | 84.8% | 2019-04-24 |
| CVE-2023-28343 EXP | OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parame… | Patch early | 9.8 critical | 84.8% | 2023-03-14 |
| CVE-2017-2741 EXP | A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerab… | Patch early | 9.8 critical | 84.6% | 2018-01-23 |
| CVE-2020-8656 EXP | An issue was discovered in EyesOfNetwork 5.3. The EyesOfNetwork API 2.4.2 is prone to SQL injection, allowing an unauthenticated attacker to perform v… | Patch early | 9.8 critical | 84.6% | 2020-02-07 |
| CVE-2013-3214 EXP | vtiger CRM 5.4.0 and earlier contain a PHP Code Injection Vulnerability in 'vtigerolservice.php'. | Patch early | 9.8 critical | 84.5% | 2020-01-28 |
| CVE-2013-7285 EXP | Xstream API versions up to 1.4.6 and version 1.4.10, if the security framework has not been initialized, may allow a remote attacker to run arbitrary… | Patch early | 9.8 critical | 84.4% | 2019-05-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt