CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,492 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,058 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-10804 | serial-number through 1.3.0 allows execution of arbritary commands. The "cmdPrefix" argument in serialNumber function is used by the "exec" function w… | In your normal cycle | 9.8 critical | 2.8% | 2020-02-28 |
| CVE-2023-36028 | Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability | In your normal cycle | 9.8 critical | 2.8% | 2023-11-14 |
| CVE-2023-28489 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). Affected… | In your normal cycle | 9.8 critical | 2.8% | 2023-04-11 |
| CVE-2017-5953 | vim before patch 8.0.0322 does not properly validate values for tree length when handling a spell file, which may result in an integer overflow at a m… | In your normal cycle | 9.8 critical | 2.8% | 2017-02-10 |
| CVE-2013-2159 | Monkey HTTP Daemon: broken user name authentication | In your normal cycle | 9.8 critical | 2.8% | 2019-12-10 |
| CVE-2017-12588 | The zmq3 input and output modules in rsyslog before 8.28.0 interpreted description fields as format strings, possibly allowing a format string attack… | In your normal cycle | 9.8 critical | 2.8% | 2017-08-06 |
| CVE-2026-24841 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In versions prior to 0.26.6, a critical command injection vulnerability exists in Dokpl… | In your normal cycle | 9.9 critical | 2.8% | 2026-01-28 |
| CVE-2017-7750 | A use-after-free vulnerability during video control operations when a "<track>" element holds a reference to an older window if that window has been r… | In your normal cycle | 9.8 critical | 2.8% | 2018-06-11 |
| CVE-2017-7751 | A use-after-free vulnerability with content viewer listeners that results in a potentially exploitable crash. This vulnerability affects Firefox < 54,… | In your normal cycle | 9.8 critical | 2.8% | 2018-06-11 |
| CVE-2021-20314 | Stack buffer overflow in libspf2 versions below 1.2.11 when processing certain SPF macros can lead to Denial of service and potentially code execution… | In your normal cycle | 9.8 critical | 2.8% | 2021-08-12 |
| CVE-2021-37912 | The HGiga OAKlouds mobile portal does not filter special characters of the Ethernet number parameter of the network interface card setting page. Remot… | In your normal cycle | 9.8 critical | 2.8% | 2021-09-15 |
| CVE-2021-37913 | The HGiga OAKlouds mobile portal does not filter special characters of the IPv6 Gateway parameter of the network interface card setting page. Remote a… | In your normal cycle | 9.8 critical | 2.8% | 2021-09-15 |
| CVE-2021-34170 | Bandai Namco FromSoftware Dark Souls III allows remote attackers to execute arbitrary code. | In your normal cycle | 9.8 critical | 2.8% | 2021-06-15 |
| CVE-2021-42169 | The Simple Payroll System with Dynamic Tax Bracket in PHP using SQLite Free Source Code (by: oretnom23 ) is vulnerable from remote SQL-Injection-Bypas… | In your normal cycle | 9.8 critical | 2.8% | 2021-10-22 |
| CVE-2024-25833 | F-logic DataCube3 v1.0 is vulnerable to unauthenticated SQL injection, which could allow an unauthenticated malicious actor to execute arbitrary SQL q… | In your normal cycle | 9.8 critical | 2.8% | 2024-02-29 |
| CVE-2020-14876 | Vulnerability in the Oracle Trade Management product of Oracle E-Business Suite (component: User Interface). Supported versions that are affected are… | In your normal cycle | 9.1 critical | 2.8% | 2020-10-21 |
| CVE-2020-14000 | MIT Lifelong Kindergarten Scratch scratch-vm before 0.2.0-prerelease.20200714185213 loads extension URLs from untrusted project.json files with certai… | In your normal cycle | 9.8 critical | 2.8% | 2020-07-16 |
| CVE-2011-10018 | myBB version 1.6.4 was distributed with an unauthorized backdoor embedded in the source code. The backdoor allowed remote attackers to execute arbitra… | In your normal cycle | 9.8 critical | 2.8% | 2025-08-13 |
| CVE-2022-45462 | Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade… | In your normal cycle | 9.8 critical | 2.8% | 2022-11-23 |
| CVE-2023-43128 | D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters. | In your normal cycle | 9.8 critical | 2.8% | 2023-09-21 |
| CVE-2017-15597 | An issue was discovered in Xen through 4.9.x. Grant copying code made an implication that any grant pin would be accompanied by a suitable page refere… | In your normal cycle | 9.1 critical | 2.8% | 2017-10-30 |
| CVE-2015-2081 | Datto ALTO and SIRIS devices allow Remote Code Execution via unauthenticated requests to PHP scripts. | In your normal cycle | 9.8 critical | 2.8% | 2018-02-20 |
| CVE-2017-12367 | A "Cisco WebEx Network Recording Player Denial of Service Vulnerability" exists in Cisco WebEx Network Recording Player for Advanced Recording Format… | In your normal cycle | 9.6 critical | 2.8% | 2017-11-30 |
| CVE-2020-22884 | Buffer overflow vulnerability in function jsvGetStringChars in Espruino before RELEASE_2V09, allows remote attackers to execute arbitrary code. | In your normal cycle | 9.8 critical | 2.8% | 2021-07-13 |
| CVE-2021-27706 | Buffer Overflow in Tenda G1 and G3 routers with firmware version V15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted… | In your normal cycle | 9.8 critical | 2.8% | 2021-04-14 |
| CVE-2021-27707 | Buffer Overflow in Tenda G1 and G3 routers with firmware v15.11.0.17(9502)_CN allows remote attackers to execute arbitrary code via a crafted action/"… | In your normal cycle | 9.8 critical | 2.8% | 2021-04-14 |
| CVE-2022-37337 | A command execution vulnerability exists in the access control functionality of Netgear Orbi Router RBR750 4.6.8.5. A specially-crafted HTTP request c… | In your normal cycle | 9.1 critical | 2.8% | 2023-03-21 |
| CVE-2021-37423 | Zoho ManageEngine ADSelfService Plus 6111 and prior is vulnerable to linked applications takeover. | In your normal cycle | 9.8 critical | 2.8% | 2021-09-10 |
| CVE-2020-20287 | Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters, triggers remote code… | In your normal cycle | 9.8 critical | 2.8% | 2021-02-01 |
| CVE-2020-24743 | An issue was found in /showReports.do Zoho ManageEngine Applications Manager up to 14550, allows attackers to gain escalated privileges via the resour… | In your normal cycle | 9.8 critical | 2.8% | 2021-11-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt