CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,569 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,060 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-36076 | SQL Injection vulnerability in smanga version 3.1.9 and earlier, allows remote attackers to execute arbitrary code and gain sensitive information via… | In your normal cycle | 9.8 critical | 2.8% | 2023-09-01 |
| CVE-2021-36025 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerabili… | In your normal cycle | 9.1 critical | 2.8% | 2021-09-01 |
| CVE-2021-36035 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerabili… | In your normal cycle | 9.1 critical | 2.8% | 2021-09-01 |
| CVE-2021-28834 | Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. | In your normal cycle | 9.8 critical | 2.8% | 2021-03-19 |
| CVE-2019-20367 | nlist.c in libbsd before 0.10.0 has an out-of-bounds read during a comparison for a symbol name from the string table (strtab). | In your normal cycle | 9.1 critical | 2.8% | 2020-01-08 |
| CVE-2019-5464 | A flawed DNS rebinding protection issue was discovered in GitLab CE/EE 10.2 and later in the `url_blocker.rb` which could result in SSRF where the lib… | In your normal cycle | 9.8 critical | 2.8% | 2020-01-28 |
| CVE-2022-34722 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability | In your normal cycle | 9.8 critical | 2.8% | 2022-09-13 |
| CVE-2023-50651 | TOTOLINK X6000R v9.4.0cu.852_B20230719 was discovered to contain a remote command execution (RCE) vulnerability via the component /cgi-bin/cstecgi.cgi… | In your normal cycle | 9.8 critical | 2.8% | 2023-12-30 |
| CVE-2021-34165 | A SQL Injection vulnerability in Sourcecodester Basic Shopping Cart 1.0 allows a remote attacker to Bypass Authentication and become Admin. | In your normal cycle | 9.8 critical | 2.8% | 2021-07-30 |
| CVE-2018-3183 | Vulnerability in the Java SE, Java SE Embedded, JRockit component of Oracle Java SE (subcomponent: Scripting). Supported versions that are affected ar… | In your normal cycle | 9.0 critical | 2.8% | 2018-10-17 |
| CVE-2019-8237 | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | In your normal cycle | 9.8 critical | 2.8% | 2019-10-23 |
| CVE-2020-12775 | Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated rem… | In your normal cycle | 9.8 critical | 2.8% | 2022-03-01 |
| CVE-2017-15804 | The glob function in glob.c in the GNU C Library (aka glibc or libc6) before 2.27 contains a buffer overflow during unescaping of user names with the… | In your normal cycle | 9.8 critical | 2.8% | 2017-10-22 |
| CVE-2017-14742 | Buffer overflow in LabF nfsAxe FTP client 3.7 allows an attacker to execute code remotely. | In your normal cycle | 9.8 critical | 2.8% | 2019-10-25 |
| CVE-2020-7706 | The package connie-lang before 0.1.1 are vulnerable to Prototype Pollution in the configuration language library used by connie. | In your normal cycle | 9.8 critical | 2.8% | 2020-08-18 |
| CVE-2019-17601 | In MiniShare 1.4.1, there is a stack-based buffer overflow via an HTTP CONNECT request, which allows an attacker to achieve arbitrary code execution,… | In your normal cycle | 9.8 critical | 2.8% | 2019-10-15 |
| CVE-2020-10658 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's Writ… | In your normal cycle | 9.8 critical | 2.8% | 2021-01-06 |
| CVE-2019-1010296 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Code execution in context of TEE core (kernel). The component i… | In your normal cycle | 9.8 critical | 2.8% | 2019-07-15 |
| CVE-2018-10740 | Axublog 1.1.0 allows remote Code Execution as demonstrated by injection of PHP code (contained in the webkeywords parameter) into the cmsconfig.php fi… | In your normal cycle | 9.8 critical | 2.8% | 2018-05-04 |
| CVE-2025-50578 | LinuxServer.io heimdall 2.6.3-ls307 contains a vulnerability in how it handles user-supplied HTTP headers, specifically `X-Forwarded-Host` and `Refere… | In your normal cycle | 9.8 critical | 2.8% | 2025-07-30 |
| CVE-2022-26629 | An Access Control vulnerability exists in SoroushPlus+ Messenger 1.0.30 in the Lock Screen Security Feature function due to insufficient permissions a… | In your normal cycle | 9.1 critical | 2.8% | 2022-03-24 |
| CVE-2020-6948 | A remote code execution issue was discovered in HashBrown CMS through 1.3.3. Server/Entity/Deployer/GitDeployer.js has a Service.AppService.exec call… | In your normal cycle | 9.8 critical | 2.8% | 2020-01-13 |
| CVE-2023-1437 | All versions prior to 9.1.4 of Advantech WebAccess/SCADA are vulnerable to use of untrusted pointers. The RPC arguments the client sent could contain… | In your normal cycle | 9.8 critical | 2.8% | 2023-08-02 |
| CVE-2018-13816 | A vulnerability has been identified in TIM 1531 IRC (All version < V2.0). The devices was missing proper authentication on port 102/tcp, although conf… | In your normal cycle | 10.0 critical | 2.8% | 2018-12-12 |
| CVE-2019-15058 | stb_image.h (aka the stb image loader) 2.23 has a heap-based buffer over-read in stbi__tga_load, leading to Information Disclosure or Denial of Servic… | In your normal cycle | 9.1 critical | 2.8% | 2019-08-14 |
| CVE-2017-11121 | On Broadcom BCM4355C0 Wi-Fi chips 9.44.78.27.0.1.56 and other chips, properly crafted malicious over-the-air Fast Transition frames can potentially tr… | In your normal cycle | 9.8 critical | 2.8% | 2017-09-28 |
| CVE-2017-18264 | An issue was discovered in libraries/common.inc.php in phpMyAdmin 4.0 before 4.0.10.20, 4.4.x, 4.6.x, and 4.7.0 prereleases. The restrictions caused b… | In your normal cycle | 9.8 critical | 2.8% | 2018-05-01 |
| CVE-2019-18313 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could g… | In your normal cycle | 9.8 critical | 2.8% | 2019-12-12 |
| CVE-2020-10964 | Serendipity before 2.3.4 on Windows allows remote attackers to execute arbitrary code because the filename of a renamed file may end with a dot. This… | In your normal cycle | 9.8 critical | 2.8% | 2020-03-25 |
| CVE-2022-0265 | Improper Restriction of XML External Entity Reference in GitHub repository hazelcast/hazelcast in 5.1-BETA-1. | In your normal cycle | 9.8 critical | 2.8% | 2022-03-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt