CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,449 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,056 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-86152 | A flaw has been found in Tenda CP3 27.5.57.101. The impacted element is the function CAutoAddWifi::ThreadProc of the file Functions/AutoAddWifi.cpp of… | In your normal cycle | 10.0 critical | 2.9% | 2026-09-06 |
| CVE-2017-1002157 | modulemd 1.3.1 and earlier uses an unsafe function for processing externally provided data, leading to remote code execution. | In your normal cycle | 9.8 critical | 2.9% | 2019-01-10 |
| CVE-2016-6150 | The multi-tenant database container feature in SAP HANA does not properly encrypt communications, which allows remote attackers to bypass intended acc… | In your normal cycle | 9.8 critical | 2.9% | 2016-08-05 |
| CVE-2019-13352 | WolfVision Cynap before 1.30j uses a static, hard-coded cryptographic secret for generating support PINs for the 'forgot password' feature. By knowing… | In your normal cycle | 9.8 critical | 2.9% | 2019-07-05 |
| CVE-2022-34916 | Apache Flume versions 1.4.0 through 1.10.0 are vulnerable to a remote code execution (RCE) attack when a configuration uses a JMS Source with a JNDI L… | In your normal cycle | 9.8 critical | 2.9% | 2022-08-21 |
| CVE-2025-57105 | The DI-7400G+ router has a command injection vulnerability, which allows attackers to execute arbitrary commands on the device. The sub_478D28 functio… | In your normal cycle | 9.8 critical | 2.9% | 2025-08-22 |
| CVE-2018-9110 | Studio 42 elFinder before 2.1.37 has a directory traversal vulnerability in elFinder.class.php with the zipdl() function that can allow a remote attac… | In your normal cycle | 9.1 critical | 2.9% | 2018-03-28 |
| CVE-2016-9901 | HTML tags received from the Pocket server will be processed without sanitization and any JavaScript code executed will be run in the "about:pocket-sav… | In your normal cycle | 9.8 critical | 2.9% | 2018-06-11 |
| CVE-2024-2029 | A command injection vulnerability exists in the `TranscriptEndpoint` of mudler/localai, specifically within the `audioToWav` function used for convert… | In your normal cycle | 9.8 critical | 2.9% | 2024-04-10 |
| CVE-2020-10062 | An off-by-one error in the Zephyr project MQTT packet length decoder can result in memory corruption and possible remote code execution. NCC-ZEP-031 T… | In your normal cycle | 9.0 critical | 2.9% | 2020-06-05 |
| CVE-2020-10070 | In the Zephyr Project MQTT code, improper bounds checking can result in memory corruption and possibly remote code execution. NCC-ZEP-031 This issue a… | In your normal cycle | 9.0 critical | 2.9% | 2020-06-05 |
| CVE-2020-28636 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/… | In your normal cycle | 9.8 critical | 2.9% | 2021-03-04 |
| CVE-2020-35628 | A code execution vulnerability exists in the Nef polygon-parsing functionality of CGAL libcgal CGAL-5.1.1. An oob read vulnerability exists in Nef_S2/… | In your normal cycle | 9.8 critical | 2.9% | 2021-03-04 |
| CVE-2019-10687 | KBPublisher 6.0.2.1 has SQL Injection via the admin/index.php?module=report entry_id[0] parameter, the admin/index.php?module=log id parameter, or an… | In your normal cycle | 9.8 critical | 2.9% | 2019-08-21 |
| CVE-2019-10760 | safer-eval before 1.3.2 are vulnerable to Arbitrary Code Execution. A payload using constructor properties can escape the sandbox and execute arbitrar… | In your normal cycle | 9.9 critical | 2.9% | 2019-10-15 |
| CVE-2015-6472 | WAGO IO 750-849 01.01.27 and 01.02.05, WAGO IO 750-881, and WAGO IO 758-870 have weak credential management. | In your normal cycle | 9.8 critical | 2.9% | 2017-08-22 |
| CVE-2018-15361 | UltraVNC revision 1198 has a buffer underflow vulnerability in VNC client code, which can potentially result in code execution. This attack appears to… | In your normal cycle | 9.8 critical | 2.9% | 2019-03-05 |
| CVE-2021-23555 | The package vm2 before 3.9.6 are vulnerable to Sandbox Bypass via direct access to host error objects generated by node internals during generation of… | In your normal cycle | 9.8 critical | 2.9% | 2022-02-11 |
| CVE-2021-40353 | A SQL injection vulnerability exists in version 8.0 of openSIS when MySQL or MariaDB is used as the application database. An attacker can then issue t… | In your normal cycle | 9.8 critical | 2.9% | 2021-09-01 |
| CVE-2022-32788 | A buffer overflow was addressed with improved bounds checking. This issue is fixed in watchOS 8.7, tvOS 15.6, iOS 15.6 and iPadOS 15.6, macOS Monterey… | In your normal cycle | 9.8 critical | 2.9% | 2022-09-20 |
| CVE-2019-16382 | An issue was discovered in Ivanti Workspace Control 10.3.110.0. One is able to bypass Ivanti's FileGuard folder protection by renaming the WMTemp work… | In your normal cycle | 9.8 critical | 2.9% | 2020-03-19 |
| CVE-2017-2765 | EMC Isilon InsightIQ 4.1.0, 4.0.1, 4.0.0, 3.2.2, 3.2.1, 3.2.0, 3.1.1, 3.1.0, 3.0.1, 3.0.0 is affected by an authentication bypass vulnerability that c… | In your normal cycle | 9.8 critical | 2.9% | 2017-02-08 |
| CVE-2021-24077 | Windows Fax Service Remote Code Execution Vulnerability | In your normal cycle | 9.8 critical | 2.9% | 2021-02-25 |
| CVE-2021-33574 | The mq_notify function in the GNU C Library (aka glibc) versions 2.32 and 2.33 has a use-after-free. It may use the notification thread attributes obj… | In your normal cycle | 9.8 critical | 2.9% | 2021-05-25 |
| CVE-2020-22848 | A remote code execution (RCE) vulnerability in the \Playsong.php component of cscms v4.1 allows attackers to execute arbitrary commands. | In your normal cycle | 9.8 critical | 2.9% | 2021-08-30 |
| CVE-2020-11103 | JsLink in Webswing before 2.6.12 LTS, and 2.7.x and 20.x before 20.1, allows remote code execution. | In your normal cycle | 9.8 critical | 2.9% | 2020-12-30 |
| CVE-2022-26990 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in t… | In your normal cycle | 9.8 critical | 2.9% | 2022-03-15 |
| CVE-2022-23658 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2… | In your normal cycle | 10.0 critical | 2.9% | 2022-05-16 |
| CVE-2022-23660 | A remote authentication bypass vulnerability was discovered in Aruba ClearPass Policy Manager version(s): 6.10.4 and below, 6.9.9 and below, 6.8.9-HF2… | In your normal cycle | 10.0 critical | 2.9% | 2022-05-16 |
| CVE-2022-0142 | The Visual Form Builder WordPress plugin before 3.0.8 is vulnerable to CSV injection allowing a user with low level or no privileges to inject a comma… | In your normal cycle | 9.8 critical | 2.9% | 2022-04-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt