CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,394 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,055 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-13500 | SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially craf… | In your normal cycle | 9.8 critical | 2.9% | 2020-09-24 |
| CVE-2020-13501 | An SQL injection vulnerability exists in the CHaD.asmx web service functionality of eDNA Enterprise Data Historian 3.0.1.2/7.5.4989.33053. Specially c… | In your normal cycle | 9.8 critical | 2.9% | 2020-09-24 |
| CVE-2017-11362 | In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, ext/intl/msgformat/msgformat_parse.c does not restrict the locale length, which allows remote attacke… | In your normal cycle | 9.8 critical | 2.9% | 2017-07-17 |
| CVE-2019-10269 | BWA (aka Burrow-Wheeler Aligner) before 2019-01-23 has a stack-based buffer overflow in the bns_restore function in bntseq.c via a long sequence name… | In your normal cycle | 9.8 critical | 2.9% | 2019-03-29 |
| CVE-2026-28411 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, an unsafe use of the `extract()` function on the `$_REQUEST` superglobal a… | In your normal cycle | 9.8 critical | 2.9% | 2026-02-27 |
| CVE-2022-23100 | OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment). | In your normal cycle | 9.8 critical | 2.9% | 2022-07-27 |
| CVE-2022-25132 | A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attac… | In your normal cycle | 9.8 critical | 2.9% | 2022-02-19 |
| CVE-2022-25133 | A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows at… | In your normal cycle | 9.8 critical | 2.9% | 2022-02-19 |
| CVE-2024-41570 | An Unauthenticated Server-Side Request Forgery (SSRF) in demon callback handling in Havoc 2 0.7 allows attackers to send arbitrary network traffic ori… | In your normal cycle | 9.8 critical | 2.9% | 2024-08-12 |
| CVE-2023-31856 | A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers t… | In your normal cycle | 9.8 critical | 2.9% | 2023-05-16 |
| CVE-2019-14897 | A stack-based buffer overflow was found in the Linux kernel, version kernel-2.6.32, in Marvell WiFi chip driver. An attacker is able to cause a denial… | In your normal cycle | 9.8 critical | 2.9% | 2019-11-29 |
| CVE-2016-8565 | Siemens Automation License Manager (ALM) before 5.3 SP3 allows remote attackers to write to files, rename files, create directories, or delete directo… | In your normal cycle | 9.1 critical | 2.9% | 2016-10-13 |
| CVE-2017-12821 | Memory corruption in Gemalto's HASP SRM, Sentinel HASP and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 might cause remote code execut… | In your normal cycle | 9.8 critical | 2.9% | 2017-10-04 |
| CVE-2021-30503 | The unofficial GLSL Linting extension before 1.4.0 for Visual Studio Code allows remote code execution via a crafted glslangValidatorPath in the works… | In your normal cycle | 9.8 critical | 2.9% | 2021-04-13 |
| CVE-2017-7861 | Google gRPC before 2017-02-22 has an out-of-bounds write related to the gpr_free function in core/lib/support/alloc.c. | In your normal cycle | 9.8 critical | 2.9% | 2017-04-14 |
| CVE-2014-9753 | confirm.php in ATutor 2.2 and earlier allows remote attackers to bypass authentication and gain access as an existing user via the auto_login paramete… | In your normal cycle | 9.8 critical | 2.9% | 2020-02-11 |
| CVE-2015-1174 | Session fixation vulnerability in Unit4 Polska TETA Web (formerly TETA Galactica) 22.62.3.4 and earlier allows remote attackers to hijack web sessions… | In your normal cycle | 9.8 critical | 2.9% | 2017-08-02 |
| CVE-2022-26992 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in t… | In your normal cycle | 9.8 critical | 2.9% | 2022-03-15 |
| CVE-2026-59801 | 9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API… | In your normal cycle | 9.8 critical | 2.9% | 2026-07-13 |
| CVE-2017-1002013 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection via imgid parameter in image-gallery-with-slideshow/admin_s… | In your normal cycle | 9.8 critical | 2.9% | 2017-09-14 |
| CVE-2017-1002014 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via galle… | In your normal cycle | 9.8 critical | 2.9% | 2017-09-14 |
| CVE-2017-1002015 | Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/admin_setting.php via selec… | In your normal cycle | 9.8 critical | 2.9% | 2017-09-14 |
| CVE-2015-9246 | An issue was discovered in Skybox Platform before 7.5.201. Remote Unauthenticated Code Execution exists via a WAR archive containing a JSP file. The W… | In your normal cycle | 9.8 critical | 2.9% | 2018-01-12 |
| CVE-2018-19515 | In Webgalamb through 7.0, system/ajax.php functionality is supposed to be available only to the administrator. However, by using one of the bgsend, at… | In your normal cycle | 9.8 critical | 2.9% | 2019-03-21 |
| CVE-2020-12676 | FusionAuth fusionauth-samlv2 0.2.3 allows remote attackers to forge messages and bypass authentication via a SAML assertion that lacks a Signature ele… | In your normal cycle | 9.1 critical | 2.9% | 2020-10-02 |
| CVE-2019-2699 | Vulnerability in the Java SE component of Oracle Java SE (subcomponent: Windows DLL). The supported version that is affected is Java SE: 8u202. Diffic… | In your normal cycle | 9.0 critical | 2.9% | 2019-04-23 |
| CVE-2021-31756 | An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN. A stack buffer overflow vulnerability in /gofrom/setwanType allow… | In your normal cycle | 9.8 critical | 2.9% | 2021-05-07 |
| CVE-2020-9527 | Firmware developed by Shenzhen Hichip Vision Technology (V6 through V20, after 2018-08-09 through 2020), as used by many different vendors in millions… | In your normal cycle | 9.8 critical | 2.9% | 2020-08-10 |
| CVE-2024-8911 | The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is… | In your normal cycle | 9.8 critical | 2.9% | 2024-10-08 |
| CVE-2022-27003 | Totolink routers s X5000R V9.1.0u.6118_B20201102 and A7000R V9.1.0u.6115_B20201022 were discovered to contain a command injection vulnerability in the… | In your normal cycle | 9.8 critical | 2.9% | 2022-03-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt