CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,473 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,058 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-16460 | A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID. | In your normal cycle | 9.8 critical | 2.9% | 2018-09-07 |
| CVE-2019-13336 | The dbell Wi-Fi Smart Video Doorbell DB01-S Gen 1 allows remote attackers to launch commands with no authentication verification via TCP port 81, beca… | In your normal cycle | 9.8 critical | 2.9% | 2019-10-08 |
| CVE-2019-7401 | NGINX Unit before 1.7.1 might allow an attacker to cause a heap-based buffer overflow in the router process with a specially crafted request. This may… | In your normal cycle | 9.8 critical | 2.9% | 2019-02-08 |
| CVE-2018-4029 | An exploitable code execution vulnerability exists in the HTTP request-parsing function of the NT9665X Chipset firmware running on the Anker Roav A1 D… | In your normal cycle | 9.8 critical | 2.9% | 2019-05-13 |
| CVE-2023-40493 | LG Simple Editor copySessionFolder Directory Traversal Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbi… | In your normal cycle | 9.8 critical | 2.9% | 2024-05-03 |
| CVE-2022-30105 | In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits mult… | In your normal cycle | 9.8 critical | 2.9% | 2022-05-18 |
| CVE-2022-30308 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-on" POST request doesn’t check for por… | In your normal cycle | 9.8 critical | 2.9% | 2022-06-13 |
| CVE-2022-30309 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-web-viewer-request-off" POST request doesn’t check for po… | In your normal cycle | 9.8 critical | 2.9% | 2022-06-13 |
| CVE-2022-2128 | Unrestricted Upload of File with Dangerous Type in GitHub repository polonel/trudesk prior to 1.2.4. | In your normal cycle | 9.8 critical | 2.9% | 2022-06-20 |
| CVE-2017-5640 | It was noticed that a malicious process impersonating an Impala daemon in Apache Impala (incubating) 2.7.0 to 2.8.0 could cause Impala daemons to skip… | In your normal cycle | 9.8 critical | 2.9% | 2017-07-10 |
| CVE-2022-26995 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_ma… | In your normal cycle | 9.8 critical | 2.9% | 2022-03-15 |
| CVE-2022-26996 | Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe… | In your normal cycle | 9.8 critical | 2.9% | 2022-03-15 |
| CVE-2017-5209 | The base64decode function in base64.c in libimobiledevice libplist through 1.12 allows attackers to obtain sensitive information from process memory o… | In your normal cycle | 9.1 critical | 2.9% | 2017-01-11 |
| CVE-2020-10988 | A hard-coded telnet credential in the tenda_login binary of Tenda AC15 AC1900 version 15.03.05.19 allows unauthenticated remote attackers to start a t… | In your normal cycle | 9.8 critical | 2.9% | 2020-07-13 |
| CVE-2016-9924 | Zimbra Collaboration Suite (ZCS) before 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks. | In your normal cycle | 9.8 critical | 2.9% | 2017-03-29 |
| CVE-2013-10051 | A remote PHP code execution vulnerability exists in InstantCMS version 1.6 and earlier due to unsafe use of eval() within the search view handler. Spe… | In your normal cycle | 9.8 critical | 2.9% | 2025-08-01 |
| CVE-2022-28906 | TOTOLink N600R V5.3c.7159_B20190425 was discovered to contain a command injection vulnerability via the langtype parameter in /setting/setLanguageCfg. | In your normal cycle | 9.8 critical | 2.8% | 2022-05-10 |
| CVE-2022-24882 | FreeRDP is a free implementation of the Remote Desktop Protocol (RDP). In versions prior to 2.7.0, NT LAN Manager (NTLM) authentication does not prope… | In your normal cycle | 9.1 critical | 2.8% | 2022-04-26 |
| CVE-2018-1000626 | Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the lack of requirement to change the default API key.… | In your normal cycle | 9.8 critical | 2.8% | 2018-12-28 |
| CVE-2018-1000628 | Battelle V2I Hub 2.5.1 could allow a remote attacker to bypass security restrictions, caused by the direct checking of the API key against a user-supp… | In your normal cycle | 9.8 critical | 2.8% | 2018-12-28 |
| CVE-2021-24385 | The Filebird Plugin 4.7.3 introduced a SQL injection vulnerability as it is making SQL queries without escaping user input data from a HTTP post reque… | In your normal cycle | 9.8 critical | 2.8% | 2021-07-12 |
| CVE-2016-4503 | Moxa Device Server Web Console 5232-N allows remote attackers to bypass authentication, and consequently modify settings and data, via vectors related… | In your normal cycle | 9.8 critical | 2.8% | 2016-07-12 |
| CVE-2017-14027 | A Use of Hard-coded Credentials issue was discovered in Korenix JetNet JetNet5018G version 1.4, JetNet5310G version 1.4a, JetNet5428G-2G-2FX version 1… | In your normal cycle | 9.8 critical | 2.8% | 2017-11-01 |
| CVE-2020-28864 | Buffer overflow in WinSCP 5.17.8 allows a malicious FTP server to cause a denial of service or possibly have other unspecified impact via a long file… | In your normal cycle | 9.8 critical | 2.8% | 2020-11-23 |
| CVE-2017-10845 | Wi-Fi STATION L-02F Software version V10g and earlier allows remote attackers to access the device with administrative privileges and perform unintend… | In your normal cycle | 9.8 critical | 2.8% | 2017-09-15 |
| CVE-2019-13550 | In WebAccess, versions 8.4.1 and prior, an improper authorization vulnerability may allow an attacker to disclose sensitive information, cause imprope… | In your normal cycle | 9.8 critical | 2.8% | 2019-09-18 |
| CVE-2021-21889 | A stack-based buffer overflow vulnerability exists in the Web Manager Ping functionality of Lantronix PremierWave 2050 8.9.0.0R4 (in QEMU). A speciall… | In your normal cycle | 9.9 critical | 2.8% | 2021-12-22 |
| CVE-2019-1584 | A security vulnerability exists in Zingbox Inspector version 1.293 and earlier, that allows for remote code execution if the Inspector were sent a mal… | In your normal cycle | 9.8 critical | 2.8% | 2019-10-09 |
| CVE-2018-6342 | react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The inp… | In your normal cycle | 9.8 critical | 2.8% | 2018-12-31 |
| CVE-2018-7497 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcce… | In your normal cycle | 9.8 critical | 2.8% | 2018-05-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt