CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,054 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-40084 | opensysusers through 0.6 does not safely use eval on files in sysusers.d that may contain shell metacharacters. For example, it allows command executi… | In your normal cycle | 9.8 critical | 2.9% | 2021-08-25 |
| CVE-2014-9852 | distribute-cache.c in ImageMagick re-uses objects after they have been destroyed, which allows remote attackers to have unspecified impact via unspeci… | In your normal cycle | 9.8 critical | 2.9% | 2017-03-17 |
| CVE-2020-29575 | The official elixir Docker images before 1.8.0-alpine (Alpine specific) contain a blank password for a root user. Systems using the elixir Linux Docke… | In your normal cycle | 9.8 critical | 2.9% | 2020-12-08 |
| CVE-2018-5145 | Memory safety bugs were reported in Firefox ESR 52.6. These bugs showed evidence of memory corruption and we presume that with enough effort that some… | In your normal cycle | 9.8 critical | 2.9% | 2018-06-11 |
| CVE-2019-14222 | An issue was discovered in Alfresco Community Edition versions 6.0 and lower. An unauthenticated, remote attacker could authenticate to Alfresco's Sol… | In your normal cycle | 9.8 critical | 2.9% | 2019-09-05 |
| CVE-2018-15882 | An issue was discovered in Joomla! before 3.8.12. Inadequate checks in the InputFilter class could allow specifically prepared phar files to pass the… | In your normal cycle | 9.8 critical | 2.9% | 2018-08-29 |
| CVE-2020-5537 | Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors. | In your normal cycle | 9.8 critical | 2.9% | 2020-05-25 |
| CVE-2025-22952 | elestio memos v0.23.0 is vulnerable to Server-Side Request Forgery (SSRF) due to insufficient validation of user-supplied URLs, which can be exploited… | In your normal cycle | 9.8 critical | 2.9% | 2025-02-27 |
| CVE-2022-38667 | HTTP applications (servers) based on Crow through 1.0+4 may allow a Use-After-Free and code execution when HTTP pipelining is used. The HTTP parser su… | In your normal cycle | 9.8 critical | 2.9% | 2022-08-22 |
| CVE-2020-14472 | On Draytek Vigor3900, Vigor2960, and Vigor 300B devices before 1.5.1.1, there are some command-injection vulnerabilities in the mainfunction.cgi file. | In your normal cycle | 9.8 critical | 2.9% | 2020-06-24 |
| CVE-2017-1000073 | Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution. | In your normal cycle | 9.8 critical | 2.9% | 2017-07-17 |
| CVE-2020-13619 | php/exec/escapeshellarg in Locutus PHP through 2.0.11 allows an attacker to achieve code execution. | In your normal cycle | 9.8 critical | 2.9% | 2020-07-01 |
| CVE-2021-25287 | An issue was discovered in Pillow before 8.2.0. There is an out-of-bounds read in J2kDecode, in j2ku_graya_la. | In your normal cycle | 9.1 critical | 2.9% | 2021-06-02 |
| CVE-2019-15497 | Black Box iCOMPEL 9.2.3 through 11.1.4, as used in ONELAN Net-Top-Box 9.2.3 through 11.1.4 and other products, has default credentials that allow remo… | In your normal cycle | 9.8 critical | 2.9% | 2019-08-26 |
| CVE-2020-25575 | An issue was discovered in the failure crate through 0.1.5 for Rust. It may introduce "compatibility hazards" in some applications, and has a type con… | In your normal cycle | 9.8 critical | 2.9% | 2020-09-14 |
| CVE-2019-13405 | A broken access control vulnerability found in Advan VD-1 firmware version 230 leads to insecure ADB service. An attacker can send a POST request to c… | In your normal cycle | 9.8 critical | 2.9% | 2019-08-29 |
| CVE-2025-22785 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ComMotion Course Booking System course-booking-s… | In your normal cycle | 9.3 critical | 2.9% | 2025-01-15 |
| CVE-2020-24195 | An Arbitrary File Upload in the Upload Image component in Sourcecodester Online Bike Rental v1.0 allows authenticated administrator to conduct remote… | In your normal cycle | 9.1 critical | 2.9% | 2020-09-09 |
| CVE-2020-8796 | Biscom Secure File Transfer (SFT) before 5.1.1071 and 6.0.1xxx before 6.0.1005 allows Remote Code Execution on the server. | In your normal cycle | 9.8 critical | 2.9% | 2020-02-07 |
| CVE-2019-9850 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained w… | In your normal cycle | 9.8 critical | 2.9% | 2019-08-15 |
| CVE-2024-23467 | The SolarWinds Access Rights Manager was susceptible to a Directory Traversal and Information Disclosure Vulnerability. This vulnerability allows an u… | In your normal cycle | 9.6 critical | 2.9% | 2024-07-17 |
| CVE-2021-45090 | Stormshield Endpoint Security before 2.1.2 allows remote code execution. | In your normal cycle | 9.8 critical | 2.9% | 2021-12-21 |
| CVE-2017-6713 | A vulnerability in the Play Framework of Cisco Elastic Services Controller (ESC) could allow an unauthenticated, remote attacker to gain full access t… | In your normal cycle | 9.8 critical | 2.9% | 2017-07-06 |
| CVE-2016-9223 | A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO; formerly CliQr) could allow an unauthenticated, remote atta… | In your normal cycle | 9.8 critical | 2.9% | 2016-12-26 |
| CVE-2020-0902 | An elevation of privilege vulnerability exists in Service Fabric File Store Service under certain conditions, aka 'Service Fabric Elevation of Privile… | In your normal cycle | 9.8 critical | 2.9% | 2020-03-12 |
| CVE-2025-59359 | The cleanTcs mutation in Chaos Controller Manager is vulnerable to OS command injection. In conjunction with CVE-2025-59358, this allows unauthentica… | In your normal cycle | 9.8 critical | 2.9% | 2025-09-15 |
| CVE-2019-20025 | Certain builds of NEC SV9100 software could allow an unauthenticated, remote attacker to log into a device running an affected release with a hardcode… | In your normal cycle | 9.8 critical | 2.9% | 2020-07-29 |
| CVE-2014-3630 | XML external entity (XXE) vulnerability in the Java XML processing functionality in Play before 2.2.6 and 2.3.x before 2.3.5 might allow remote attack… | In your normal cycle | 9.8 critical | 2.9% | 2017-12-29 |
| CVE-2016-2403 | Symfony before 2.8.6 and 3.x before 3.0.6 allows remote attackers to bypass authentication by logging in with an empty password and valid username, wh… | In your normal cycle | 9.8 critical | 2.9% | 2017-02-07 |
| CVE-2017-13815 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the third-party "file" product. Versions befor… | In your normal cycle | 9.8 critical | 2.9% | 2017-11-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt