CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,579 CVEs
1,726 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-27
148,911 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-65660 KEV | Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | Patch first | 8.8 high | 2.1% | 2026-08-11 |
| CVE-2020-2506 KEV | The vulnerability have been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers… | Patch first | 7.3 high | 2% | 2021-02-03 |
| CVE-2026-28318 KEV | SolarWinds Serv-U is susceptible to specially crafted POST requests that crash the Serv-U service without authentication using Content-Encoding: defla… | Patch first | 7.5 high | 1.9% | 2026-06-04 |
| CVE-2023-41974 KEV | A use-after-free issue was addressed with improved memory management. This issue is fixed in iOS 17 and iPadOS 17, iOS 15.8.7 and iPadOS 15.8.7. An ap… | Patch first | 7.8 high | 1.9% | 2024-01-10 |
| CVE-2025-30400 KEV | Use after free in Windows DWM allows an authorized attacker to elevate privileges locally. | Patch first | 7.8 high | 1.9% | 2025-05-13 |
| CVE-2025-8875 KEV | Deserialization of Untrusted Data vulnerability in N-able N-central allows Local Execution of Code.This issue affects N-central: before 2025.3.1. | Patch first | 7.8 high | 1.9% | 2025-08-14 |
| CVE-2019-0797 KEV | An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation… | Patch first | 7.8 high | 1.9% | 2019-04-09 |
| CVE-2025-27920 KEV | Output Messenger before 2.0.63 was vulnerable to a directory traversal attack through improper file path handling. By using ../ sequences in parameter… | Patch first | 7.2 high | 1.9% | 2025-05-05 |
| CVE-2024-7694 KEV | ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on t… | Patch first | 7.2 high | 1.8% | 2024-08-12 |
| CVE-2018-19322 KEV | The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.2… | Patch first | 7.8 high | 1.8% | 2018-12-21 |
| CVE-2019-1129 KEV | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of… | Patch first | 7.8 high | 1.8% | 2019-07-15 |
| CVE-2025-22226 KEV | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with admi… | Patch first | 7.1 high | 1.8% | 2025-03-04 |
| CVE-2025-15556 KEV | Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metad… | Patch first | 7.5 high | 1.7% | 2026-02-03 |
| CVE-2024-21287 KEV | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The support… | Patch first | 7.5 high | 1.7% | 2024-11-18 |
| CVE-2025-48595 KEV | In multiple locations, there is a possible way to achieve code execution due to an integer overflow. This could lead to local escalation of privilege… | Patch first | 8.4 high | 1.7% | 2026-06-01 |
| CVE-2019-1130 KEV | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of… | Patch first | 7.8 high | 1.7% | 2019-07-15 |
| CVE-2022-41033 KEV | Windows COM+ Event System Service Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.7% | 2022-10-11 |
| CVE-2026-33634 KEV | Trivy is a security scanner. On March 19, 2026, a threat actor used compromised credentials to publish a malicious Trivy v0.69.4 release, force-push 7… | Patch first | 8.8 high | 1.7% | 2026-03-23 |
| CVE-2023-28229 KEV | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | Patch first | 7.0 high | 1.7% | 2023-04-11 |
| CVE-2024-38107 KEV | Windows Power Dependency Coordinator Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.6% | 2024-08-13 |
| CVE-2025-31277 KEV | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, vi… | Patch first | 8.8 high | 1.6% | 2025-07-30 |
| CVE-2025-24989 KEV | An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the… | Patch first | 8.2 high | 1.6% | 2025-02-19 |
| CVE-2020-11261 KEV | Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon… | Patch first | 7.8 high | 1.6% | 2021-06-09 |
| CVE-2021-41357 KEV | Win32k Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.6% | 2021-10-13 |
| CVE-2021-40450 KEV | Win32k Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.6% | 2021-10-13 |
| CVE-2025-21418 KEV | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.6% | 2025-02-11 |
| CVE-2025-21334 KEV | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.6% | 2025-01-14 |
| CVE-2026-67277 KEV | RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use… | Patch first | 8.2 high | 1.6% | 2026-09-05 |
| CVE-2019-8720 KEV | A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution.… | Patch first | 8.8 high | 1.6% | 2023-03-06 |
| CVE-2026-21514 KEV | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | Patch first | 7.8 high | 1.5% | 2026-02-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt