CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,449 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,056 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-6624 | The JSON API User plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.9.3. This is due to improper cont… | In your normal cycle | 9.8 critical | 2.9% | 2024-07-11 |
| CVE-2020-14188 | The preprocessArgs function in the Atlassian gajira-create GitHub Action before version 2.0.1 allows remote attackers to execute arbitrary code in the… | In your normal cycle | 9.8 critical | 2.9% | 2020-11-09 |
| CVE-2020-29551 | An issue was discovered in URVE Build 24.03.2020. Using the _internal/pc/shutdown.php path, it is possible to shutdown the system. Among others, the f… | In your normal cycle | 9.1 critical | 2.9% | 2020-12-23 |
| CVE-2013-3323 | A Privilege Escalation Vulnerability exists in IBM Maximo Asset Management 7.5, 7.1, and 6.2, when WebSeal with Basic Authentication is used, due to a… | In your normal cycle | 9.8 critical | 2.9% | 2020-02-18 |
| CVE-2020-10515 | STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006. | In your normal cycle | 9.8 critical | 2.9% | 2020-04-02 |
| CVE-2026-12227 | The Visual Composer Website Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 45.16.0 via the `… | In your normal cycle | 9.8 critical | 2.9% | 2026-09-24 |
| CVE-2021-43215 | iSNS Server Memory Corruption Vulnerability Can Lead to Remote Code Execution | In your normal cycle | 9.8 critical | 2.9% | 2021-12-15 |
| CVE-2021-36040 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerabili… | In your normal cycle | 9.1 critical | 2.9% | 2021-09-01 |
| CVE-2020-3144 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, RV130 VPN Router, RV130W Wireless-N Multifunction V… | In your normal cycle | 9.8 critical | 2.9% | 2020-07-16 |
| CVE-2019-5497 | NetApp AFF A700s Baseboard Management Controller (BMC) firmware versions 1.22 and higher were shipped with a default account enabled that could allow… | In your normal cycle | 9.8 critical | 2.9% | 2019-07-01 |
| CVE-2020-13452 | In Gotenberg through 6.2.1, insecure permissions for tini (writable by user gotenberg) potentially allow an attacker to overwrite the file, which can… | In your normal cycle | 9.8 critical | 2.9% | 2021-01-07 |
| CVE-2019-2205 | In ProxyResolverV8::SetPacScript of proxy_resolver_v8.cc, there is a possible memory corruption due to a use after free. This could lead to remote cod… | In your normal cycle | 9.8 critical | 2.9% | 2019-11-13 |
| CVE-2018-10387 | Heap-based overflow vulnerability in TFTP Server SP 1.66 and earlier allows remote attackers to perform a denial of service or possibly execute arbitr… | In your normal cycle | 9.8 critical | 2.9% | 2019-12-23 |
| CVE-2019-13558 | In WebAccess versions 8.4.1 and prior, an exploit executed over the network may cause improper control of generation of code, which may allow remote c… | In your normal cycle | 9.8 critical | 2.9% | 2019-09-18 |
| CVE-2020-14968 | An issue was discovered in the jsrsasign package before 8.0.17 for Node.js. Its RSASSA-PSS (RSA-PSS) implementation does not detect signature manipula… | In your normal cycle | 9.8 critical | 2.9% | 2020-06-22 |
| CVE-2016-1279 | J-Web in Juniper Junos OS before 12.1X46-D45, 12.1X46-D50, 12.1X47 before 12.1X47-D35, 12.3 before 12.3R12, 12.3X48 before 12.3X48-D25, 13.3 before 13… | In your normal cycle | 9.8 critical | 2.9% | 2016-09-09 |
| CVE-2023-34849 | An unauthorized command injection vulnerability exists in the ActionLogin function of the webman.lua file in Ikuai router OS through 3.7.1. | In your normal cycle | 9.8 critical | 2.9% | 2023-06-29 |
| CVE-2023-43364 | main.py in Searchor before 2.4.2 uses eval on CLI input, which may cause unexpected code execution. | In your normal cycle | 9.8 critical | 2.9% | 2023-12-12 |
| CVE-2022-27140 | An arbitrary file upload vulnerability in the file upload module of express-fileupload 1.3.1 allows attackers to execute arbitrary code via a crafted… | In your normal cycle | 9.8 critical | 2.9% | 2022-04-12 |
| CVE-2012-4919 | Gallery Plugin1.4 for WordPress has a Remote File Include Vulnerability | In your normal cycle | 9.8 critical | 2.9% | 2020-01-22 |
| CVE-2016-7112 | A vulnerability has been identified in Firmware variant PROFINET IO for EN100 Ethernet module : All versions < V1.04.01; Firmware variant Modbus TCP f… | In your normal cycle | 9.8 critical | 2.9% | 2016-09-06 |
| CVE-2018-12575 | On TP-Link TL-WR841N v13 00000001 0.9.1 4.16 v0001.0 Build 171019 Rel.55346n devices, all actions in the web interface are affected by bypass of authe… | In your normal cycle | 9.8 critical | 2.9% | 2018-07-02 |
| CVE-2021-1818 | A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-001 Catalina, Security Upd… | In your normal cycle | 9.8 critical | 2.9% | 2021-04-02 |
| CVE-2021-29781 | IBM Partner Engagement Manager 2.0 could allow a remote attacker to execute arbitrary code on the system, caused by an unsafe deserialization flaw. By… | In your normal cycle | 9.8 critical | 2.9% | 2021-07-30 |
| CVE-2022-26495 | In nbd-server in nbd before 3.24, there is an integer overflow with a resultant heap-based buffer overflow. A value of 0xffffffff in the name length f… | In your normal cycle | 9.8 critical | 2.9% | 2022-03-06 |
| CVE-2022-25312 | An XML external entity (XXE) injection vulnerability was discovered in the Any23 RDFa XSLTStylesheet extractor and is known to affect Any23 versions <… | In your normal cycle | 9.1 critical | 2.9% | 2022-03-05 |
| CVE-2018-12051 | Arbitrary File Upload and Remote Code Execution exist in PHP Scripts Mall Schools Alert Management Script via $_FILE in /webmasterst/general.php, as d… | In your normal cycle | 9.8 critical | 2.9% | 2018-06-08 |
| CVE-2019-17613 | qibosoft 7 allows remote code execution because do/jf.php makes eval calls. The attacker can use the Point Introduction Management feature to supply P… | In your normal cycle | 9.8 critical | 2.9% | 2019-10-15 |
| CVE-2019-8950 | The backdoor account dnsekakf2$$ in /bin/login on DASAN H665 devices with firmware 1.46p1-0028 allows an attacker to login to the admin account via TE… | In your normal cycle | 9.8 critical | 2.9% | 2019-02-20 |
| CVE-2026-19599 | ZohoCorp ManageEngine OpManager MSP versions 12.8.709 and below were vulnerable to a Remote Code Execution vulnerability in the Notification Profile m… | In your normal cycle | 9.9 critical | 2.9% | 2026-09-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt