CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,406 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,055 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-44401 | D-Link DI-8100G 17.12.20A1 is vulnerable to Command Injection via sub47A60C function in the upgrade_filter.asp file | In your normal cycle | 9.8 critical | 2.9% | 2024-09-06 |
| CVE-2015-7695 | The PDO adapters in Zend Framework before 1.12.16 do not filer null bytes in SQL statements, which allows remote attackers to execute arbitrary SQL co… | In your normal cycle | 9.8 critical | 2.9% | 2016-06-07 |
| CVE-2016-3454 | Unspecified vulnerability in the Java VM component in Oracle Database Server 11.2.0.4, 12.1.0.1, and 12.1.0.2 allows remote attackers to affect confid… | In your normal cycle | 9.0 critical | 2.9% | 2016-04-21 |
| CVE-2021-31162 | In the standard library in Rust before 1.52.0, a double free can occur in the Vec::from_iter function if freeing the element panics. | In your normal cycle | 9.8 critical | 2.9% | 2021-04-14 |
| CVE-2020-17529 | Out-of-bounds Write vulnerability in TCP Stack of Apache NuttX (incubating) versions up to and including 9.1.0 and 10.0.0 allows attacker to corrupt m… | In your normal cycle | 9.8 critical | 2.9% | 2020-12-09 |
| CVE-2020-18704 | Unrestricted Upload of File with Dangerous Type in Django-Widgy v0.8.4 allows remote attackers to execute arbitrary code via the 'image' widget in the… | In your normal cycle | 9.8 critical | 2.9% | 2021-08-16 |
| CVE-2020-22249 | Remote Code Execution vulnerability in phplist 3.5.1. The application does not check any file extensions stored in the plugin zip file, Uploading a ma… | In your normal cycle | 9.8 critical | 2.9% | 2021-07-06 |
| CVE-2026-77683 | A security flaw has been discovered in Comfast CF-N1-S 2.6.0.1. Affected by this issue is the function system of the file /cgi-bin/mbox-config?method=… | In your normal cycle | 9.9 critical | 2.9% | 2026-08-21 |
| CVE-2016-10727 | camel/providers/imapx/camel-imapx-server.c in the IMAPx component in GNOME evolution-data-server before 3.21.2 proceeds with cleartext data containing… | In your normal cycle | 9.8 critical | 2.9% | 2018-07-20 |
| CVE-2016-2785 | Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass in… | In your normal cycle | 9.8 critical | 2.9% | 2016-06-10 |
| CVE-2023-3277 | The MStore API plugin for WordPress is vulnerable to Unauthorized Account Access and Privilege Escalation in versions up to, and including, 4.10.7 due… | In your normal cycle | 9.8 critical | 2.9% | 2023-11-03 |
| CVE-2026-48611 | Improper authentication checks in the OAuth implementation allow account hijacking even when OAuth is not configured or enabled leading to unauthorize… | In your normal cycle | 9.8 critical | 2.9% | 2026-06-12 |
| CVE-2025-56266 | A Host Header Injection vulnerability in Avigilon ACM v7.10.0.20 allows attackers to execute arbitrary code via supplying a crafted URL. | In your normal cycle | 9.8 critical | 2.9% | 2025-09-08 |
| CVE-2019-19949 | In ImageMagick 7.0.8-43 Q16, there is a heap-based buffer over-read in the function WritePNGImage of coders/png.c, related to Magick_png_write_raw_pro… | In your normal cycle | 9.1 critical | 2.9% | 2019-12-24 |
| CVE-2021-41244 | Grafana is an open-source platform for monitoring and observability. In affected versions when the fine-grained access control beta feature is enabled… | In your normal cycle | 9.1 critical | 2.9% | 2021-11-15 |
| CVE-2017-9214 | In Open vSwitch (OvS) 2.7.0, while parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message, there is a buffer over-read that is caused by an unsig… | In your normal cycle | 9.8 critical | 2.9% | 2017-05-23 |
| CVE-2020-3284 | A vulnerability in the enhanced Preboot eXecution Environment (PXE) boot loader for Cisco IOS XR 64-bit Software could allow an unauthenticated, remot… | In your normal cycle | 9.8 critical | 2.9% | 2020-11-06 |
| CVE-2020-24629 | A remote urlaccesscontroller authentication bypass vulnerability was discovered in HPE Intelligent Management Center (iMC) version(s): Prior to iMC PL… | In your normal cycle | 9.8 critical | 2.9% | 2020-10-19 |
| CVE-2020-28250 | Cellinx NVT Web Server 5.0.0.014b.test 2019-09-05 allows a remote user to run commands as root via SetFileContent.cgi because authentication is on the… | In your normal cycle | 9.8 critical | 2.9% | 2020-11-06 |
| CVE-2024-3271 | A command injection vulnerability exists in the run-llama/llama_index repository, specifically within the safe_eval function. Attackers can bypass the… | In your normal cycle | 9.8 critical | 2.9% | 2024-04-16 |
| CVE-2023-22671 | Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when cal… | In your normal cycle | 9.8 critical | 2.9% | 2023-01-06 |
| CVE-2020-12500 | Improper Authorization vulnerability of Pepperl+Fuchs P+F Comtrol RocketLinx ES7510-XT, ES8509-XT, ES8510-XT, ES9528-XTv2, ES7506, ES7510, ES7528, ES8… | In your normal cycle | 9.8 critical | 2.9% | 2020-10-15 |
| CVE-2017-1000212 | Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests ag… | In your normal cycle | 9.8 critical | 2.9% | 2017-11-17 |
| CVE-2016-11020 | Kunena before 5.0.4 does not restrict avatar file extensions to gif, jpeg, jpg, and png. This can lead to XSS and remote code execution. | In your normal cycle | 9.8 critical | 2.9% | 2020-02-25 |
| CVE-2026-27971 | Qwik is a performance focused javascript framework. qwik <=1.19.0 is vulnerable to RCE due to an unsafe deserialization vulnerability in the server$ R… | In your normal cycle | 9.8 critical | 2.9% | 2026-03-03 |
| CVE-2022-23128 | Incomplete List of Disallowed Inputs vulnerability in Mitsubishi Electric MC Works64 versions 4.00A (10.95.201.23) to 4.04E (10.95.210.01), ICONICS GE… | In your normal cycle | 9.8 critical | 2.9% | 2022-01-21 |
| CVE-2015-8519 | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code v… | In your normal cycle | 9.8 critical | 2.9% | 2016-04-05 |
| CVE-2015-8520 | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code v… | In your normal cycle | 9.8 critical | 2.9% | 2016-04-05 |
| CVE-2016-10082 | include/functions_installer.inc.php in Serendipity through 2.0.5 is vulnerable to File Inclusion and a possible Code Execution attack during a first-t… | In your normal cycle | 9.8 critical | 2.9% | 2016-12-30 |
| CVE-2020-35185 | The official ghost docker images before 2.16.1-alpine (Alpine specific) contain a blank password for a root user. System using the ghost docker contai… | In your normal cycle | 9.8 critical | 2.9% | 2020-12-17 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt