CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,509 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,058 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-19518 | CA Automic Sysload 5.6.0 through 6.1.2 contains a vulnerability, related to a lack of authentication on the File Server port, that potentially allows… | In your normal cycle | 9.8 critical | 2.8% | 2020-01-08 |
| CVE-2019-3725 | RSA Netwitness Platform versions prior to 11.2.1.1 and RSA Security Analytics versions prior to 10.6.6.1 are vulnerable to a Command Injection vulnera… | In your normal cycle | 9.8 critical | 2.8% | 2019-05-15 |
| CVE-2018-5122 | A potential integer overflow in the "DoCrypt" function of WebCrypto was identified. If a means was found of exploiting it, it could result in an out-o… | In your normal cycle | 9.8 critical | 2.8% | 2018-06-11 |
| CVE-2022-27811 | GNOME OCRFeeder before 0.8.4 allows OS command injection via shell metacharacters in a PDF or image filename. | In your normal cycle | 9.8 critical | 2.8% | 2022-03-24 |
| CVE-2022-36669 | Hospital Information System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass. | In your normal cycle | 9.8 critical | 2.8% | 2022-09-14 |
| CVE-2018-4023 | An exploitable code execution vulnerability exists in the XML_UploadFile Wi-Fi command of the NT9665X Chipset firmware, running on the Anker Roav A1 D… | In your normal cycle | 9.8 critical | 2.8% | 2019-05-13 |
| CVE-2016-8938 | IBM UrbanCode Deploy could allow a user to execute code using a specially crafted file upload that would replace code on the server. This code could b… | In your normal cycle | 10.0 critical | 2.8% | 2017-02-01 |
| CVE-2016-5050 | Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading and reque… | In your normal cycle | 9.8 critical | 2.8% | 2016-08-26 |
| CVE-2015-6550 | bpcd in Veritas NetBackup 7.x through 7.5.0.7, 7.6.0.x through 7.6.0.4, 7.6.1.x through 7.6.1.2, and 7.7.x before 7.7.2 and NetBackup Appliance throug… | In your normal cycle | 9.8 critical | 2.8% | 2016-05-07 |
| CVE-2016-0815 | The MPEG4Source::fragmentedRead function in MPEG4Extractor.cpp in libstagefright in mediaserver in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49H,… | In your normal cycle | 9.8 critical | 2.8% | 2016-03-12 |
| CVE-2016-0816 | mediaserver in Android 6.x before 2016-03-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a… | In your normal cycle | 9.8 critical | 2.8% | 2016-03-12 |
| CVE-2016-0835 | decoder/impeg2d_dec_hdr.c in mediaserver in Android 6.x before 2016-04-01 allows remote attackers to execute arbitrary code or cause a denial of servi… | In your normal cycle | 9.8 critical | 2.8% | 2016-04-18 |
| CVE-2016-0838 | Sonivox in mediaserver in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, and 6.x before 2016-04-01 does not check for a negative nu… | In your normal cycle | 9.8 critical | 2.8% | 2016-04-18 |
| CVE-2020-0380 | In allocExcessBits of bitalloc.c, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution w… | In your normal cycle | 9.8 critical | 2.8% | 2020-09-17 |
| CVE-2020-7708 | The package irrelon-path before 4.7.0; the package @irrelon/path before 4.7.0 are vulnerable to Prototype Pollution via the set, unSet, pushVal and pu… | In your normal cycle | 9.8 critical | 2.8% | 2020-08-18 |
| CVE-2020-21652 | Myucms v2.2.1 contains a remote code execution (RCE) vulnerability in the component \controller\Config.php, which can be exploited via the addqq() met… | In your normal cycle | 9.8 critical | 2.8% | 2021-10-06 |
| CVE-2020-22937 | A remote code execution (RCE) in e/install/index.php of EmpireCMS 7.5 allows attackers to execute arbitrary PHP code via writing malicious code to the… | In your normal cycle | 9.8 critical | 2.8% | 2021-08-17 |
| CVE-2019-11367 | An issue was discovered in AUO Solar Data Recorder before 1.3.0. The web portal uses HTTP Basic Authentication and provides the account and password i… | In your normal cycle | 9.8 critical | 2.8% | 2019-06-03 |
| CVE-2019-11565 | Server Side Request Forgery (SSRF) exists in the Print My Blog plugin before 1.6.7 for WordPress via the site parameter. | In your normal cycle | 9.8 critical | 2.8% | 2019-04-27 |
| CVE-2017-5626 | OxygenOS before version 4.0.2, on OnePlus 3 and 3T, has two hidden fastboot oem commands (4F500301 and 4F500302) that allow the attacker to lock/unloc… | In your normal cycle | 9.8 critical | 2.8% | 2017-03-12 |
| CVE-2024-37759 | DataGear v5.0.0 and earlier was discovered to contain a SpEL (Spring Expression Language) expression injection vulnerability via the Data Viewing inte… | In your normal cycle | 9.8 critical | 2.8% | 2024-06-24 |
| CVE-2021-27903 | An issue was discovered in Craft CMS before 3.6.7. In some circumstances, a potential Remote Code Execution vulnerability existed on sites that did no… | In your normal cycle | 9.8 critical | 2.8% | 2021-06-30 |
| CVE-2024-10644 | Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacke… | In your normal cycle | 9.1 critical | 2.8% | 2025-02-11 |
| CVE-2019-17275 | OnCommand Cloud Manager versions prior to 3.8.0 are susceptible to arbitrary code execution by remote attackers. | In your normal cycle | 9.8 critical | 2.8% | 2020-02-26 |
| CVE-2015-5989 | Belkin F9K1102 2 devices with firmware 2.10.17 rely on client-side JavaScript code for authorization, which allows remote attackers to obtain administ… | In your normal cycle | 9.8 critical | 2.8% | 2015-12-31 |
| CVE-2016-5065 | Sierra Wireless GX 440 devices with ALEOS firmware 4.3.2 allow Embedded_Ace_Set_Task.cgi command injection. | In your normal cycle | 9.8 critical | 2.8% | 2017-04-10 |
| CVE-2017-3266 | Vulnerability in the Oracle Outside In Technology component of Oracle Fusion Middleware (subcomponent: Outside In Filters). Supported versions that ar… | In your normal cycle | 9.8 critical | 2.8% | 2017-01-27 |
| CVE-2020-15506 | An authentication bypass vulnerability in MobileIron Core & Connector versions 10.3.0.3 and earlier, 10.4.0.0, 10.4.0.1, 10.4.0.2, 10.4.0.3, 10.5.1.0,… | In your normal cycle | 9.8 critical | 2.8% | 2020-07-07 |
| CVE-2021-20623 | Video Insight VMS versions prior to 7.8 allows a remote attacker to execute arbitrary code with the system user privilege by sending a specially craft… | In your normal cycle | 9.8 critical | 2.8% | 2021-02-05 |
| CVE-2017-10913 | The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, which allows backend attac… | In your normal cycle | 9.8 critical | 2.8% | 2017-07-05 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt