CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,381 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,054 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-13846 | An issue was discovered in certain Apple products. macOS before 10.13.1 is affected. The issue involves the third-party "PCRE" product. Versions befor… | In your normal cycle | 9.8 critical | 2.9% | 2017-11-13 |
| CVE-2019-15052 | The HTTP client in Gradle before 5.6 sends authentication credentials originally destined for the configured host. If that host returns a 30x redirect… | In your normal cycle | 9.8 critical | 2.9% | 2019-08-14 |
| CVE-2023-35618 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | In your normal cycle | 9.6 critical | 2.9% | 2023-12-07 |
| CVE-2021-26765 | SQL injection vulnerability in PHPGurukul Student Record System 4.0 allows remote attackers to execute arbitrary SQL statements, via the sid parameter… | In your normal cycle | 9.8 critical | 2.9% | 2021-07-22 |
| CVE-2019-9974 | diag_tool.cgi on DASAN H660RM GPON routers with firmware 1.03-0022 lacks any authorization check, which allows remote attackers to run a ping command… | In your normal cycle | 9.1 critical | 2.9% | 2019-04-11 |
| CVE-2019-14237 | On NXP Kinetis KV1x, Kinetis KV3x, and Kinetis K8x devices, Flash Access Controls (FAC) (a software IP protection method for execute-only access) can… | In your normal cycle | 9.8 critical | 2.9% | 2019-09-12 |
| CVE-2017-16614 | SSRF (Server Side Request Forgery) in tpshop 2.0.5 and 2.0.6 allows remote attackers to obtain sensitive information, attack intranet hosts, or possib… | In your normal cycle | 9.8 critical | 2.9% | 2018-03-30 |
| CVE-2018-15890 | An issue was discovered in EthereumJ 1.8.2. There is Unsafe Deserialization in ois.readObject in mine/Ethash.java and decoder.readObject in crypto/ECK… | In your normal cycle | 9.8 critical | 2.9% | 2019-06-20 |
| CVE-2020-29563 | An issue was discovered on Western Digital My Cloud OS 5 devices before 5.07.118. A NAS Admin authentication bypass vulnerability could allow an unaut… | In your normal cycle | 9.8 critical | 2.9% | 2020-12-12 |
| CVE-2021-37404 | There is a potential heap buffer overflow in Apache Hadoop libhdfs native code. Opening a file path provided by user without validation may result in… | In your normal cycle | 9.8 critical | 2.9% | 2022-06-13 |
| CVE-2017-12065 | spikekill.php in Cacti before 1.1.16 might allow remote attackers to execute arbitrary code via the avgnan, outlier-start, or outlier-end parameter. | In your normal cycle | 9.8 critical | 2.9% | 2017-08-01 |
| CVE-2025-27140 | WeGIA is a Web manager for charitable institutions. An OS Command Injection vulnerability was discovered in versions prior to 3.2.15 of the WeGIA appl… | In your normal cycle | 9.8 critical | 2.9% | 2025-02-24 |
| CVE-2022-40797 | Roxy Fileman 1.4.6 allows Remote Code Execution via a .phar upload, because the default FORBIDDEN_UPLOADS value in conf.json only blocks .php, .php4,… | In your normal cycle | 9.8 critical | 2.9% | 2022-11-09 |
| CVE-2017-1000020 | SYN Flood or FIN Flood attack in ECos 1 and other versions embedded devices results in web Authentication Bypass. "eCos Embedded Web Servers used by M… | In your normal cycle | 9.8 critical | 2.9% | 2017-07-17 |
| CVE-2018-14822 | Entes EMG12 versions 2.57 and prior an information exposure through query strings vulnerability in the web interface has been identified, which may al… | In your normal cycle | 9.8 critical | 2.9% | 2018-10-02 |
| CVE-2020-35186 | The official adminer docker images before 4.7.0-fastcgi contain a blank password for a root user. System using the adminer docker container deployed b… | In your normal cycle | 9.8 critical | 2.9% | 2020-12-17 |
| CVE-2020-35192 | The official vault docker images before 0.11.6 contain a blank password for a root user. System using the vault docker container deployed by affected… | In your normal cycle | 9.8 critical | 2.9% | 2020-12-17 |
| CVE-2014-0156 | Awesome spawn contains OS command injection vulnerability, which allows execution of additional commands passed to Awesome spawn as arguments. If untr… | In your normal cycle | 9.8 critical | 2.9% | 2022-06-30 |
| CVE-2023-44414 | D-Link D-View coreservice_action_script Exposed Dangerous Function Remote Code Execution Vulnerability. This vulnerability allows remote attackers to… | In your normal cycle | 9.8 critical | 2.9% | 2024-05-03 |
| CVE-2021-34166 | A SQL INJECTION vulnerability in Sourcecodester Simple Food Website 1.0 allows a remote attacker to Bypass Authentication and become Admin. | In your normal cycle | 9.8 critical | 2.9% | 2021-07-30 |
| CVE-2024-49369 | Icinga is a monitoring system which checks the availability of network resources, notifies users of outages, and generates performance data for report… | In your normal cycle | 9.8 critical | 2.9% | 2024-11-12 |
| CVE-2021-21873 | A specially-crafted HTTP request can lead to arbitrary command execution in RSA keypasswd parameter. An attacker can make an authenticated HTTP reques… | In your normal cycle | 9.1 critical | 2.9% | 2021-12-22 |
| CVE-2021-21874 | A specially-crafted HTTP request can lead to arbitrary command execution in DSA keypasswd parameter. An attacker can make an authenticated HTTP reques… | In your normal cycle | 9.1 critical | 2.9% | 2021-12-22 |
| CVE-2021-21875 | A specially-crafted HTTP request can lead to arbitrary command execution in EC keypasswd parameter. An attacker can make an authenticated HTTP request… | In your normal cycle | 9.1 critical | 2.9% | 2021-12-22 |
| CVE-2017-5575 | SQL injection vulnerability in inc/lib/Options.class.php in GeniXCMS before 1.0.0 allows remote attackers to execute arbitrary SQL commands via the mo… | In your normal cycle | 9.8 critical | 2.9% | 2017-01-23 |
| CVE-2018-11531 | Exiv2 0.26 has a heap-based buffer overflow in getData in preview.cpp. | In your normal cycle | 9.8 critical | 2.9% | 2018-05-29 |
| CVE-2020-21991 | AVE DOMINAplus <=1.10.x suffers from an authentication bypass vulnerability due to missing control check when directly calling the autologin GET param… | In your normal cycle | 9.8 critical | 2.9% | 2021-04-28 |
| CVE-2017-7410 | Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to exec… | In your normal cycle | 9.8 critical | 2.9% | 2017-04-03 |
| CVE-2023-32254 | A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_TREE_DIS… | In your normal cycle | 9.8 critical | 2.9% | 2023-07-10 |
| CVE-2020-13499 | An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially c… | In your normal cycle | 9.8 critical | 2.9% | 2020-09-24 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt