CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,621 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,068 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-35797 | Improper Input Validation vulnerability in Apache Software Foundation Apache Airflow Hive Provider. This issue affects Apache Airflow Apache Hive Prov… | In your normal cycle | 9.8 critical | 2.8% | 2023-07-03 |
| CVE-2022-37149 | WAVLINK WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability when operating the file adm.cgi. This vulnerabilit… | In your normal cycle | 9.8 critical | 2.8% | 2022-08-30 |
| CVE-2019-9106 | The WebApp v04.68 in the supervisor on SAET Impianti Speciali TEBE Small 05.01 build 1137 devices allows remote attackers to execute or include local… | In your normal cycle | 9.8 critical | 2.8% | 2019-05-31 |
| CVE-2015-8805 | The ecc_256_modq function in ecc-256.c in Nettle before 3.2 does not properly handle carry propagation and produces incorrect output in its implementa… | In your normal cycle | 9.8 critical | 2.8% | 2016-02-23 |
| CVE-2023-42471 | The wave.ai.browser application through 1.0.35 for Android allows a remote attacker to execute arbitrary JavaScript code via a crafted intent. It cont… | In your normal cycle | 9.8 critical | 2.8% | 2023-09-11 |
| CVE-2024-6159 | The Push Notification for Post and BuddyPress WordPress plugin before 1.9.4 does not properly sanitise and escape a parameter before using it in a SQL… | In your normal cycle | 9.8 critical | 2.8% | 2025-05-15 |
| CVE-2026-105110 | OS Command Injection in the login.xgi CGI endpoint in Iskratel Innbox GPON ONT devices allows an unauthenticated remote attacker to execute arbitrary… | In your normal cycle | 9.8 critical | 2.8% | 2026-10-08 |
| CVE-2023-5559 | The 10Web Booster WordPress plugin before 2.24.18 does not validate the option name given to some AJAX actions, allowing unauthenticated users to dele… | In your normal cycle | 9.1 critical | 2.8% | 2023-11-27 |
| CVE-2026-71921 | Multiple DrayTek VigorSwitch models contain a pre-authentication command injection vulnerability in the setget.cgi interface. The vulnerability is cau… | In your normal cycle | 9.8 critical | 2.8% | 2026-08-24 |
| CVE-2020-7634 | heroku-addonpool through 0.1.15 is vulnerable to Command Injection. | In your normal cycle | 9.8 critical | 2.8% | 2020-04-06 |
| CVE-2021-32976 | Five buffer overflows in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to init… | In your normal cycle | 9.8 critical | 2.8% | 2022-04-01 |
| CVE-2023-33270 | An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the Curl check function is vulnerable to OS command injection (blind). | In your normal cycle | 9.8 critical | 2.8% | 2023-10-03 |
| CVE-2023-33272 | An issue was discovered in DTS Monitoring 3.57.0. The parameter ip within the Ping check function is vulnerable to OS command injection (blind). | In your normal cycle | 9.8 critical | 2.8% | 2023-10-03 |
| CVE-2023-33273 | An issue was discovered in DTS Monitoring 3.57.0. The parameter url within the WGET check function is vulnerable to OS command injection (blind). | In your normal cycle | 9.8 critical | 2.8% | 2023-10-03 |
| CVE-2019-17266 | libsoup from versions 2.65.1 until 2.68.1 have a heap-based buffer over-read because soup_ntlm_parse_challenge() in soup-auth-ntlm.c does not properly… | In your normal cycle | 9.8 critical | 2.8% | 2019-10-06 |
| CVE-2015-7792 | Corega CG-WLBARGS devices allow remote attackers to perform administrative operations via unspecified vectors. | In your normal cycle | 9.8 critical | 2.8% | 2015-12-30 |
| CVE-2017-5456 | A mechanism to bypass file system access protections in the sandbox using the file system request constructor through an IPC message. This allows for… | In your normal cycle | 9.8 critical | 2.8% | 2018-06-11 |
| CVE-2021-39409 | A vulnerability exists in Online Student Rate System v1.0 that allows any user to register as an administrator without needing to be authenticated. | In your normal cycle | 9.8 critical | 2.8% | 2022-06-24 |
| CVE-2021-46361 | An issue in the Freemark Filter of Magnolia CMS v6.2.11 and below allows attackers to bypass security restrictions and execute arbitrary code via a cr… | In your normal cycle | 9.8 critical | 2.8% | 2022-02-11 |
| CVE-2019-19953 | In GraphicsMagick 1.4 snapshot-20191208 Q8, there is a heap-based buffer over-read in the function EncodeImage of coders/pict.c. | In your normal cycle | 9.1 critical | 2.8% | 2019-12-24 |
| CVE-2021-29978 | Multiple low security issues were discovered and fixed in a security audit of Mozilla VPN 2.x branch as part of a 3rd party security audit. This vulne… | In your normal cycle | 9.8 critical | 2.8% | 2021-08-05 |
| CVE-2020-2931 | Vulnerability in the Oracle Knowledge product of Oracle Knowledge (component: Web Applications - InfoCenter). Supported versions that are affected are… | In your normal cycle | 9.8 critical | 2.8% | 2020-04-15 |
| CVE-2017-14189 | An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regard… | In your normal cycle | 9.8 critical | 2.8% | 2017-11-29 |
| CVE-2016-3720 | XML external entity (XXE) vulnerability in XmlMapper in the Data format extension for Jackson (aka jackson-dataformat-xml) allows attackers to have un… | In your normal cycle | 9.8 critical | 2.8% | 2016-06-10 |
| CVE-2021-44247 | Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injec… | In your normal cycle | 9.8 critical | 2.8% | 2022-02-04 |
| CVE-2022-26208 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185… | In your normal cycle | 9.8 critical | 2.8% | 2022-03-15 |
| CVE-2022-26211 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185… | In your normal cycle | 9.8 critical | 2.8% | 2022-03-15 |
| CVE-2022-26212 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185… | In your normal cycle | 9.8 critical | 2.8% | 2022-03-15 |
| CVE-2022-26214 | Totolink A830R V5.9c.4729_B20191112, A3100R V4.1.2cu.5050_B20200504, A950RG V4.1.2cu.5161_B20200903, A800R V4.1.2cu.5137_B20200730, A3000RU V5.9c.5185… | In your normal cycle | 9.8 critical | 2.8% | 2022-03-15 |
| CVE-2025-6121 | A vulnerability, which was classified as critical, has been found in D-Link DIR-632 FW103B08. Affected by this issue is the function get_pure_content… | In your normal cycle | 9.8 critical | 2.8% | 2025-06-16 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt