CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,730 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
217,242 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2022-41223 KEV | The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attac… | Patch first | 6.8 medium | 10.7% | 2022-11-22 |
| CVE-2026-63030 KEV | WordPress 6.9.x before 6.9.5 and 7.0.x before 7.0.2 is affected by a REST API batch endpoint route confusion issue which, combined with the author__no… | Patch first | 9.8 critical | 10.6% | 2026-07-17 |
| CVE-2022-40765 KEV | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal… | Patch first | 6.8 medium | 10.6% | 2022-11-22 |
| CVE-2025-6543 KEV | Memory overflow vulnerability leading to unintended control flow and Denial of Service in NetScaler ADC and NetScaler Gateway when configured as Gatew… | Patch first | 9.8 critical | 10.4% | 2025-06-25 |
| CVE-2022-2586 KEV | It was discovered that a nft object or expression could reference a nft set on a different nft table, leading to a use-after-free once that table was… | Patch first | 5.3 medium | 10.2% | 2024-01-08 |
| CVE-2024-6047 KEV | Certain EOL GeoVision devices fail to properly filter user input for the specific functionality. Unauthenticated remote attackers can exploit this vul… | Patch first | 9.8 critical | 10.1% | 2024-06-17 |
| CVE-2024-38217 KEV | Windows Mark of the Web Security Feature Bypass Vulnerability | Patch first | 5.4 medium | 10% | 2024-09-10 |
| CVE-2026-64849 KEV | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Starting in 3.3.0 and prior to 3.15.0… | Patch first | 9.3 critical | 10% | 2026-08-17 |
| CVE-2022-20701 KEV | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Exe… | Patch first | 10.0 critical | 9.7% | 2022-02-10 |
| CVE-2019-0703 KEV | An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosur… | Patch first | 6.5 medium | 9.4% | 2019-04-09 |
| CVE-2022-20703 KEV | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Exe… | Patch first | 10.0 critical | 9.2% | 2022-02-10 |
| CVE-2025-10585 KEV | Type confusion in V8 in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page… | Patch first | 9.8 critical | 9% | 2025-09-24 |
| CVE-2026-116606 KEV | An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a con… | Patch first | 9.8 critical | 8.9% | 2026-11-02 |
| CVE-2018-14558 KEV | An issue was discovered on Tenda AC7 devices with firmware through V15.03.06.44_CN(AC7), AC9 devices with firmware through V15.03.05.19(6318)_CN(AC9),… | Patch first | 9.8 critical | 8.5% | 2018-10-30 |
| CVE-2018-19323 KEV | The GDrv low-level driver in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GUR… | Patch first | 9.8 critical | 8.4% | 2018-12-21 |
| CVE-2024-4671 KEV | Use after free in Visuals in Google Chrome prior to 124.0.6367.201 allowed a remote attacker who had compromised the renderer process to potentially p… | Patch first | 9.6 critical | 8.3% | 2024-05-14 |
| CVE-2021-27103 KEV | Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later. | Patch first | 9.8 critical | 8.2% | 2021-02-16 |
| CVE-2019-0676 KEV | An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this… | Patch first | 6.5 medium | 8.1% | 2019-03-05 |
| CVE-2019-11634 KEV | Citrix Workspace App before 1904 for Windows has Incorrect Access Control. | Patch first | 9.8 critical | 8.1% | 2019-05-22 |
| CVE-2026-83548 KEV | A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. A remote unau… | Patch first | 10.0 critical | 8% | 2026-09-01 |
| CVE-2012-1710 KEV | Unspecified vulnerability in the Oracle WebCenter Forms Recognition component in Oracle Fusion Middleware 10.1.3.5 allows remote attackers to affect c… | Patch first | 9.8 critical | 7.8% | 2012-05-03 |
| CVE-2024-5274 KEV | Type Confusion in V8 in Google Chrome prior to 125.0.6422.112 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML… | Patch first | 9.6 critical | 7.7% | 2024-05-28 |
| CVE-2021-1870 KEV | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update… | Patch first | 9.8 critical | 7.7% | 2021-04-02 |
| CVE-2020-1040 KEV | A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticated user o… | Patch first | 9.0 critical | 7.6% | 2020-07-14 |
| CVE-2019-0344 KEV | Due to unsafe deserialization used in SAP Commerce Cloud (virtualjdbc extension), versions 6.4, 6.5, 6.6, 6.7, 1808, 1811, 1905, it is possible to exe… | Patch first | 9.8 critical | 7.5% | 2019-08-14 |
| CVE-2026-20805 KEV | Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. | Patch first | 5.5 medium | 7.5% | 2026-01-13 |
| CVE-2021-1879 KEV | This issue was addressed by improved management of object lifetimes. This issue is fixed in iOS 12.5.2, iOS 14.4.2 and iPadOS 14.4.2, watchOS 7.3.3. P… | Patch first | 6.1 medium | 7.1% | 2021-04-02 |
| CVE-2021-1871 KEV | A logic issue was addressed with improved restrictions. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Update… | Patch first | 9.8 critical | 7% | 2021-04-02 |
| CVE-2022-27518 KEV | Unauthenticated remote arbitrary code execution | Patch first | 9.8 critical | 6.9% | 2022-12-13 |
| CVE-2026-15409 KEV | A Server-side request forgery (SSRF) vulnerability has been identified in the SMA1000 Appliance Work Place interface. A remote unauthenticated attacke… | Patch first | 10.0 critical | 6.8% | 2026-07-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt