CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,799 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-12
337,242 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-38213 KEV | Windows Mark of the Web Security Feature Bypass Vulnerability | Patch first | 6.5 medium | 13.6% | 2024-08-13 |
| CVE-2015-4902 KEV | Unspecified vulnerability in Oracle Java SE 6u101, 7u85, and 8u60 allows remote attackers to affect integrity via unknown vectors related to Deploymen… | Patch first | 5.3 medium | 13.6% | 2015-10-22 |
| CVE-2021-27876 KEV | An issue was discovered in Veritas Backup Exec before 21.2. The communication between a client and an Agent requires successful authentication, which… | Patch first | 8.1 high | 13.5% | 2021-03-01 |
| CVE-2025-55177 KEV | Incomplete authorization of linked device synchronization messages in WhatsApp for iOS prior to v2.25.21.73, WhatsApp Business for iOS v2.25.21.78, an… | Patch first | 5.4 medium | 13.5% | 2025-08-29 |
| CVE-2026-34926 KEV | A directory traversal vulnerability in the Apex One (on-premise) server could allow a pre-authenticated local attacker to modify a key table on the se… | Patch first | 6.7 medium | 13.4% | 2026-05-21 |
| CVE-2023-41991 KEV | A certificate validation issue was addressed. This issue is fixed in macOS Ventura 13.6, iOS 16.7 and iPadOS 16.7. A malicious app may be able to bypa… | Patch first | 5.5 medium | 13.4% | 2023-09-21 |
| CVE-2021-30858 KEV | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 14.8 and iPadOS 14.8, macOS Big Sur 11.6. Processing… | Patch first | 8.8 high | 13.4% | 2021-08-24 |
| CVE-2022-22948 KEV | The vCenter Server contains an information disclosure vulnerability due to improper permission of files. A malicious actor with non-administrative acc… | Patch first | 6.5 medium | 13.3% | 2022-03-29 |
| CVE-2022-22675 KEV | An out-of-bounds write issue was addressed with improved bounds checking. This issue is fixed in tvOS 15.5, watchOS 8.6, macOS Big Sur 11.6.6, macOS M… | Patch first | 7.8 high | 12.5% | 2022-05-26 |
| CVE-2023-32373 KEV | A use-after-free issue was addressed with improved memory management. This issue is fixed in watchOS 9.5, tvOS 16.5, macOS Ventura 13.4, iOS 15.7.6 an… | Patch first | 8.8 high | 12.2% | 2023-06-23 |
| CVE-2025-48927 KEV | The TeleMessage service through 2025-05-05 configures Spring Boot Actuator with an exposed heap dump endpoint at a /heapdump URI, as exploited in the… | Patch first | 5.3 medium | 12.2% | 2025-05-28 |
| CVE-2023-36424 KEV | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Patch first | 7.8 high | 12.1% | 2023-11-14 |
| CVE-2021-28663 KEV | The Arm Mali GPU kernel driver allows privilege escalation or information disclosure because GPU memory operations are mishandled, leading to a use-af… | Patch first | 8.8 high | 12.1% | 2021-05-10 |
| CVE-2023-21715 KEV | Microsoft Publisher Security Feature Bypass Vulnerability | Patch first | 7.3 high | 12% | 2023-02-14 |
| CVE-2022-20775 KEV | A vulnerability in the CLI of Cisco SD-WAN Software could allow an authenticated, local attacker to gain elevated privileges. This vulnerability is… | Patch first | 7.8 high | 12% | 2022-09-30 |
| CVE-2026-96652 KEV | Plex Media Server before 1.43.3.10861 allows SSRF via '/player/timeline'. An attacker using any X-Plex-Token value can include a full URL in the 'prot… | Patch first | 4.3 medium | 11.9% | 2026-09-23 |
| CVE-2026-15410 KEV | Post-authentication improper control of generation of code ('Code Injection') vulnerability has been identified in the SMA1000 Appliance Management Co… | Patch first | 7.2 high | 11.8% | 2026-07-14 |
| CVE-2020-3118 KEV | A vulnerability in the Cisco Discovery Protocol implementation for Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to execute… | Patch first | 8.8 high | 11.7% | 2020-02-05 |
| CVE-2023-41992 KEV | The issue was addressed with improved checks. This issue is fixed in macOS Monterey 12.7, iOS 16.7 and iPadOS 16.7, macOS Ventura 13.6. A local attack… | Patch first | 7.8 high | 11.6% | 2023-09-21 |
| CVE-2022-20821 KEV | A vulnerability in the health check RPM of Cisco IOS XR Software could allow an unauthenticated, remote attacker to access the Redis instance that is… | Patch first | 6.5 medium | 11.5% | 2022-05-26 |
| CVE-2021-38648 KEV | Open Management Infrastructure Elevation of Privilege Vulnerability | Patch first | 7.8 high | 11.4% | 2021-09-15 |
| CVE-2026-88779 KEV | Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and befor… | Patch first | 7.5 high | 11.4% | 2026-10-04 |
| CVE-2021-43890 KEV | We have investigated reports of a spoofing vulnerability in AppX installer that affects Microsoft Windows. Microsoft is aware of attacks that attempt… | Patch first | 7.1 high | 11.3% | 2021-12-15 |
| CVE-2017-11292 KEV | Adobe Flash Player version 27.0.0.159 and earlier has a flawed bytecode verification procedure, which allows for an untrusted value to be used in the… | Patch first | 8.8 high | 11.2% | 2017-10-22 |
| CVE-2017-6740 KEV | The Simple Network Management Protocol (SNMP) subsystem of Cisco IOS and IOS XE Software contains multiple vulnerabilities that could allow an authent… | Patch first | 8.8 high | 11.1% | 2017-07-17 |
| CVE-2013-0648 KEV | Unspecified vulnerability in the ExternalInterface ActionScript functionality in Adobe Flash Player before 10.3.183.67 and 11.x before 11.6.602.171 on… | Patch first | 8.8 high | 11.1% | 2013-02-27 |
| CVE-2017-0005 KEV | The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 201… | Patch first | 7.8 high | 11% | 2017-03-17 |
| CVE-2024-4761 KEV | Out of bounds write in V8 in Google Chrome prior to 124.0.6367.207 allowed a remote attacker to perform an out of bounds memory write via a crafted HT… | Patch first | 8.8 high | 11% | 2024-05-14 |
| CVE-2021-30762 KEV | A use after free issue was addressed with improved memory management. This issue is fixed in iOS 12.5.4. Processing maliciously crafted web content ma… | Patch first | 8.8 high | 11% | 2021-09-08 |
| CVE-2023-36033 KEV | Windows DWM Core Library Elevation of Privilege Vulnerability | Patch first | 7.8 high | 10.9% | 2023-11-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt