CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,473 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,058 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-7505 | In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAcce… | In your normal cycle | 9.8 critical | 2.8% | 2018-05-15 |
| CVE-2022-32271 | In Real Player 20.0.8.310, there is a DCP:// URI Remote Arbitrary Code Execution Vulnerability. This is an internal URL Protocol used by Real Player t… | In your normal cycle | 9.6 critical | 2.8% | 2022-06-03 |
| CVE-2022-27083 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadAccessCodePic. | In your normal cycle | 9.8 critical | 2.8% | 2022-03-24 |
| CVE-2021-32824 | Apache Dubbo is a java based, open source RPC framework. Versions prior to 2.6.10 and 2.7.10 are vulnerable to pre-auth remote code execution via arbi… | In your normal cycle | 9.8 critical | 2.8% | 2023-01-03 |
| CVE-2020-28998 | An issue was discovered on Geeni GNC-CW013 doorbell 1.8.1 devices. A vulnerability exists in the Telnet service that allows a remote attacker to take… | In your normal cycle | 9.8 critical | 2.8% | 2021-01-26 |
| CVE-2020-36282 | JMS Client for RabbitMQ 1.x before 1.15.2 and 2.x before 2.2.0 is vulnerable to unsafe deserialization that can result in code execution via crafted S… | In your normal cycle | 9.8 critical | 2.8% | 2021-03-12 |
| CVE-2015-8361 | Multiple unspecified services in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 do not require authentication, which allows remote attackers t… | In your normal cycle | 9.1 critical | 2.8% | 2016-02-08 |
| CVE-2016-7504 | A use-after-free vulnerability was observed in Rp_toString function of Artifex Software, Inc. MuJS before 5c337af4b3df80cf967e4f9f6a21522de84b392a. A… | In your normal cycle | 9.8 critical | 2.8% | 2016-10-29 |
| CVE-2021-27648 | Externally controlled reference to a resource in another sphere in quarantine functionality in Synology Antivirus Essential before 1.4.8-2801 allows r… | In your normal cycle | 9.0 critical | 2.8% | 2021-04-28 |
| CVE-2021-26867 | Windows Hyper-V Remote Code Execution Vulnerability | In your normal cycle | 9.9 critical | 2.8% | 2021-03-11 |
| CVE-2021-0430 | In rw_mfc_handle_read_op of rw_mfc.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution… | In your normal cycle | 9.8 critical | 2.8% | 2021-04-13 |
| CVE-2020-7947 | An issue was discovered in the Login by Auth0 plugin before 4.0.0 for WordPress. It has numerous fields that can contain data that is pulled from diff… | In your normal cycle | 9.8 critical | 2.8% | 2020-04-01 |
| CVE-2016-6551 | Intellian Satellite TV antennas t-Series and v-Series, firmware version 1.07, uses non-random default credentials of: ftp/ftp or intellian:12345678. A… | In your normal cycle | 9.8 critical | 2.8% | 2018-07-13 |
| CVE-2016-6552 | Green Packet DX-350 uses non-random default credentials of: root:wimax. A remote network attacker can gain privileged access to a vulnerable device. | In your normal cycle | 9.8 critical | 2.8% | 2018-07-13 |
| CVE-2016-6553 | Nuuo NT-4040 Titan, firmware NT-4040_01.07.0000.0015_1120, uses non-random default credentials of: admin:admin and localdisplay:111111. A remote netwo… | In your normal cycle | 9.8 critical | 2.8% | 2018-07-13 |
| CVE-2016-1557 | Netgear WNAP320, WNDAP350, and WNDAP360 before 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP. | In your normal cycle | 9.8 critical | 2.8% | 2017-04-21 |
| CVE-2018-18928 | International Components for Unicode (ICU) for C/C++ 63.1 has an integer overflow in number::impl::DecimalQuantity::toScientificString() in i18n/numbe… | In your normal cycle | 9.8 critical | 2.8% | 2018-11-04 |
| CVE-2018-5469 | An Improper Restriction of Excessive Authentication Attempts issue was discovered in Belden Hirschmann RS, RSR, RSB, MACH100, MACH1000, MACH4000, MS,… | In your normal cycle | 9.8 critical | 2.8% | 2018-03-06 |
| CVE-2014-3700 | eDeploy through at least 2014-10-14 has remote code execution due to eval() of untrusted data | In your normal cycle | 9.8 critical | 2.8% | 2019-11-21 |
| CVE-2017-1000056 | Kubernetes version 1.5.0-1.5.4 is vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin resulting in the ability to make use… | In your normal cycle | 9.8 critical | 2.8% | 2017-07-17 |
| CVE-2025-10643 | Wondershare Repairit Incorrect Permission Assignment Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authent… | In your normal cycle | 9.1 critical | 2.8% | 2025-09-17 |
| CVE-2021-33790 | The RebornCore library before 4.7.3 allows remote code execution because it deserializes untrusted data in ObjectInputStream.readObject as part of reb… | In your normal cycle | 9.8 critical | 2.8% | 2021-05-31 |
| CVE-2016-10711 | Apsis Pound before 2.8a allows request smuggling via crafted headers, a different vulnerability than CVE-2005-3751. | In your normal cycle | 9.8 critical | 2.8% | 2018-01-29 |
| CVE-2017-0357 | A heap-overflow flaw exists in the -tr loader of iucode-tool starting with v1.4 and before v2.1.1, potentially leading to SIGSEGV, or heap corruption. | In your normal cycle | 9.8 critical | 2.8% | 2018-04-13 |
| CVE-2019-8266 | UltraVNC revision 1207 has multiple out-of-bounds access vulnerabilities connected with improper usage of ClientConnection::Copybuffer function in VNC… | In your normal cycle | 9.8 critical | 2.8% | 2019-03-08 |
| CVE-2024-36622 | In RaspAP raspap-webgui 3.0.9 and earlier, a command injection vulnerability exists in the clearlog.php script. The vulnerability is due to improper s… | In your normal cycle | 9.8 critical | 2.8% | 2024-11-29 |
| CVE-2026-19682 | A command injection vulnerability exists in Security Center where a remote, unauthenticated attacker could exploit this issue to execute arbitrary com… | In your normal cycle | 9.9 critical | 2.8% | 2026-08-14 |
| CVE-2018-21025 | In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configurat… | In your normal cycle | 9.8 critical | 2.8% | 2019-10-08 |
| CVE-2019-10801 | enpeem through 2.2.0 allows execution of arbitrary commands. The "options.dir" argument is provided to the "exec" function without any sanitization. | In your normal cycle | 9.8 critical | 2.8% | 2020-02-28 |
| CVE-2019-10803 | push-dir through 0.4.1 allows execution of arbritary commands. Arguments provided as part of the variable "opt.branch" is not validated before being p… | In your normal cycle | 9.8 critical | 2.8% | 2020-02-28 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt