CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,558 CVEs
1,726 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
36,453 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-12314 EXP | Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maco… | Patch early | 9.8 critical | 84.2% | 2019-05-24 |
| CVE-2015-2857 EXP | Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token pa… | Patch early | 9.8 critical | 84.2% | 2017-08-22 |
| CVE-2018-17552 EXP | SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie. | Patch early | 9.8 critical | 84.1% | 2018-10-03 |
| CVE-2018-17431 EXP | Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL. | Patch early | 9.8 critical | 83.9% | 2019-01-30 |
| CVE-2020-10879 EXP | rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed direct… | Patch early | 9.8 critical | 83.9% | 2020-03-23 |
| CVE-2019-1620 EXP | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to u… | Patch early | 9.8 critical | 83.8% | 2019-06-27 |
| CVE-2025-47916 EXP | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. The issue lies within the themeedi… | Patch early | 10.0 critical | 83.7% | 2025-05-16 |
| CVE-2017-14493 EXP | Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafte… | Patch early | 9.8 critical | 83.6% | 2017-10-03 |
| CVE-2014-1511 EXP | Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allow remote attackers to bypass the pop… | Patch early | 9.8 critical | 83.6% | 2014-03-19 |
| CVE-2019-1935 EXP | A vulnerability in Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allo… | Patch early | 9.8 critical | 83.4% | 2019-08-21 |
| CVE-2011-2921 EXP | ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can result in com… | Patch early | 9.8 critical | 83.1% | 2019-11-19 |
| CVE-2018-17254 EXP | The JCK Editor component 6.4.4 for Joomla! allows SQL Injection via the jtreelink/dialogs/links.php parent parameter. | Patch early | 9.8 critical | 83% | 2018-09-20 |
| CVE-2018-16763 EXP | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code… | Patch early | 9.8 critical | 82.9% | 2018-09-09 |
| CVE-2019-1619 EXP | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to b… | Patch early | 9.8 critical | 82.8% | 2019-06-27 |
| CVE-2017-5817 EXP | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found. | Patch early | 9.8 critical | 82.6% | 2018-02-15 |
| CVE-2020-7980 EXP | Intellian Aptus Web 1.24 allows remote attackers to execute arbitrary OS commands via the Q field within JSON data to the cgi-bin/libagent.cgi URI. NO… | Patch early | 9.8 critical | 82.5% | 2020-01-25 |
| CVE-2022-28368 EXP | Dompdf 1.2.1 allows remote code execution via a .php file in the src:url field of an @font-face Cascading Style Sheets (CSS) statement (within an HTML… | Patch early | 9.8 critical | 82.4% | 2022-04-03 |
| CVE-2014-1510 EXP | The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows rem… | Patch early | 9.8 critical | 82.3% | 2014-03-19 |
| CVE-2024-44000 EXP | Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue a… | Patch early | 9.8 critical | 82.3% | 2024-10-20 |
| CVE-2018-9995 EXP | TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which ru… | Patch early | 9.8 critical | 82.3% | 2018-04-10 |
| CVE-2015-6922 EXP | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly requ… | Patch early | 9.8 critical | 82.1% | 2020-02-17 |
| CVE-2018-10660 EXP | An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection. | Patch early | 9.8 critical | 82.1% | 2018-06-26 |
| CVE-2024-10924 EXP | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.… | Patch early | 9.8 critical | 82% | 2024-11-15 |
| CVE-2016-3087 EXP | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execu… | Patch early | 9.8 critical | 81.9% | 2016-06-07 |
| CVE-2023-5360 EXP | The Royal Elementor Addons and Templates WordPress plugin before 1.3.79 does not properly validate uploaded files, which could allow unauthenticated u… | Patch early | 9.8 critical | 81.7% | 2023-10-31 |
| CVE-2014-8516 EXP | Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an… | Patch early | 9.8 critical | 81.7% | 2020-01-03 |
| CVE-2018-5955 EXP | An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unauthenticated attacker to add a… | Patch early | 9.8 critical | 81.4% | 2018-01-21 |
| CVE-2016-5734 EXP | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replac… | Patch early | 9.8 critical | 81.4% | 2016-07-03 |
| CVE-2024-2054 EXP | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code… | Patch early | 9.8 critical | 81.3% | 2024-03-21 |
| CVE-2014-7862 EXP | The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrato… | Patch early | 9.8 critical | 81% | 2018-01-04 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt