CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
403,813 CVEs
1,739 on KEV
17,300 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-10
36,970 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-14503 | Advantech iView, versions 5.6 and prior, has an improper input validation vulnerability. Successful exploitation of this vulnerability could allow an… | In your normal cycle | 9.8 critical | 3.5% | 2020-07-15 |
| CVE-2021-44685 | Git-it through 4.4.0 allows OS command injection at the Branches Aren't Just For Birds challenge step. During the verification process, it attempts to… | In your normal cycle | 9.8 critical | 3.5% | 2021-12-07 |
| CVE-2022-33189 | An OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A specially-… | In your normal cycle | 9.8 critical | 3.5% | 2022-10-25 |
| CVE-2017-16872 | An issue was discovered in Teluu pjproject (pjlib and pjlib-util) in PJSIP before 2.7.1. Parsing the numeric header fields in a SIP message (like cseq… | In your normal cycle | 9.8 critical | 3.5% | 2017-11-17 |
| CVE-2014-5435 | An arbitrary memory write vulnerability exists in the dual_onsrv.exe module in Honeywell Experion PKS R40x before R400.6, R41x before R410.6, and R43x… | In your normal cycle | 9.8 critical | 3.5% | 2019-04-08 |
| CVE-2016-7924 | The ATM parser in tcpdump before 4.9.0 has a buffer overflow in print-atm.c:oam_print(). | In your normal cycle | 9.8 critical | 3.5% | 2017-01-28 |
| CVE-2017-12985 | The IPv6 parser in tcpdump before 4.9.2 has a buffer over-read in print-ip6.c:ip6_print(). | In your normal cycle | 9.8 critical | 3.5% | 2017-09-14 |
| CVE-2017-13010 | The BEEP parser in tcpdump before 4.9.2 has a buffer over-read in print-beep.c:l_strnstart(). | In your normal cycle | 9.8 critical | 3.5% | 2017-09-14 |
| CVE-2022-24312 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory vulnerability exists that could cause modification of an existing file by adding… | In your normal cycle | 9.8 critical | 3.5% | 2022-02-09 |
| CVE-2014-3114 | The EZPZ One Click Backup (ezpz-one-click-backup) plugin 12.03.10 and earlier for WordPress allows remote attackers to execute arbitrary commands via… | In your normal cycle | 9.8 critical | 3.5% | 2018-04-10 |
| CVE-2017-12860 | The Epson "EasyMP" software is designed to remotely stream a users computer to supporting projectors.These devices are authenticated using a unique 4-… | In your normal cycle | 9.8 critical | 3.5% | 2017-10-10 |
| CVE-2018-20325 | There is a vulnerability in load() method in definitions/parser.py in the Danijar Hafner definitions package for Python. It can execute arbitrary pyth… | In your normal cycle | 9.8 critical | 3.5% | 2018-12-21 |
| CVE-2017-2513 | An issue was discovered in certain Apple products. iOS before 10.3.2 is affected. macOS before 10.12.5 is affected. tvOS before 10.2.1 is affected. wa… | In your normal cycle | 9.8 critical | 3.5% | 2017-05-22 |
| CVE-2022-27351 | Zoo Management System v1.0 was discovered to contain an arbitrary file upload vulnerability via /public_html/apply_vacancy. This vulnerability allows… | In your normal cycle | 9.8 critical | 3.5% | 2022-04-08 |
| CVE-2019-1003031 | A sandbox bypass vulnerability exists in Jenkins Matrix Project Plugin 1.13 and earlier in pom.xml, src/main/java/hudson/matrix/FilterScript.java that… | In your normal cycle | 9.9 critical | 3.5% | 2019-03-08 |
| CVE-2021-27113 | An issue was discovered in D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler fun… | In your normal cycle | 9.8 critical | 3.5% | 2021-04-14 |
| CVE-2017-1000060 | EyesOfNetwork (EON) 5.1 Unauthenticated SQL Injection in eonweb leading to remote root | In your normal cycle | 9.8 critical | 3.5% | 2017-07-17 |
| CVE-2020-3762 | Adobe Acrobat and Reader versions 2019.021.20061 and earlier, 2017.011.30156 and earlier, 2017.011.30156 and earlier, and 2015.006.30508 and earlier h… | In your normal cycle | 9.8 critical | 3.5% | 2020-02-13 |
| CVE-2016-5022 | F5 BIG-IP LTM, Analytics, APM, ASM, and Link Controller 11.2.x before 11.2.1 HF16, 11.3.x, 11.4.x, 11.5.x before 11.5.4 HF2, 11.6.x before 11.6.1 HF1,… | In your normal cycle | 9.8 critical | 3.5% | 2016-09-07 |
| CVE-2020-10654 | Ping Identity PingID SSH before 4.0.14 contains a heap buffer overflow in PingID-enrolled servers. This condition can be potentially exploited into a… | In your normal cycle | 9.8 critical | 3.5% | 2020-05-13 |
| CVE-2025-59304 | A directory traversal issue in Swetrix Web Analytics API 3.1.1 before 7d8b972 allows a remote attacker to achieve Remote Code Execution via a crafted… | In your normal cycle | 9.8 critical | 3.5% | 2025-09-17 |
| CVE-2026-9436 | A flaw has been found in Totolink A8000RU 7.1cu.643_b20200521. The impacted element is the function setL2tpServerCfg of the file /cgi-bin/cstecgi.cgi… | In your normal cycle | 9.8 critical | 3.5% | 2026-05-25 |
| CVE-2021-22504 | Arbitrary code execution vulnerability on Micro Focus Operations Bridge Manager product, affecting versions 10.1x, 10.6x, 2018.05, 2018.11, 2019.05, 2… | In your normal cycle | 9.8 critical | 3.5% | 2021-02-12 |
| CVE-2021-38391 | A Blind SQL injection vulnerability exists in the /DataHandler/AM/AM_Handler.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. Th… | In your normal cycle | 9.8 critical | 3.5% | 2021-08-30 |
| CVE-2019-12405 | Improper authentication is possible in Apache Traffic Control versions 3.0.0 and 3.0.1 if LDAP is enabled for login in the Traffic Ops API component.… | In your normal cycle | 9.8 critical | 3.5% | 2019-09-09 |
| CVE-2020-15801 | In Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing code to be loaded from arbitrary locations. The <execut… | In your normal cycle | 9.8 critical | 3.5% | 2020-07-17 |
| CVE-2021-41616 | Apache DB DdlUtils 1.0 included a BinaryObjectsHelper that was intended for use when migrating database data with a SQL data type of BINARY, VARBINARY… | In your normal cycle | 9.8 critical | 3.5% | 2021-09-30 |
| CVE-2026-2686 | A security vulnerability has been detected in SECCN Dingcheng G10 3.1.0.181203. This impacts the function qq of the file /cgi-bin/session_login.cgi. T… | In your normal cycle | 9.8 critical | 3.5% | 2026-02-19 |
| CVE-2019-9505 | The PrinterLogic Print Management software, versions up to and including 18.3.1.96, does not sanitize special characters allowing for remote unauthori… | In your normal cycle | 9.8 critical | 3.5% | 2019-05-08 |
| CVE-2019-10778 | devcert-sanscache before 0.4.7 allows remote attackers to execute arbitrary code or cause a Command Injection via the exec function. The variable `com… | In your normal cycle | 9.8 critical | 3.5% | 2020-01-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt