CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,621 CVEs
1,739 on KEV
17,299 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,068 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-3105 | The Woody code snippets – Insert Header Footer Code, AdSense Ads plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, an… | In your normal cycle | 9.9 critical | 2.8% | 2024-06-15 |
| CVE-2026-34243 | wenxian is a tool to generate BIBTEX files from given identifiers (DOI, PMID, arXiv ID, or paper title). In versions 0.3.1 and prior, a GitHub Actions… | In your normal cycle | 9.8 critical | 2.8% | 2026-03-31 |
| CVE-2024-0057 | NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability | In your normal cycle | 9.1 critical | 2.8% | 2024-01-09 |
| CVE-2019-1010009 | DGLogik Inc DGLux Server All Versions is affected by: Insecure Permissions. The impact is: Remote Execution, Credential Leaks. The component is: IoT A… | In your normal cycle | 9.8 critical | 2.8% | 2019-07-15 |
| CVE-2019-9546 | SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. | In your normal cycle | 9.8 critical | 2.8% | 2019-03-01 |
| CVE-2019-14192 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy when parsing a UDP packet due to a net_process_received_packet int… | In your normal cycle | 9.8 critical | 2.8% | 2019-07-31 |
| CVE-2017-11381 | A command injection vulnerability exists in Trend Micro Deep Discovery Director 1.1 that allows an attacker to restore accounts that can access the pr… | In your normal cycle | 9.8 critical | 2.8% | 2017-08-01 |
| CVE-2016-0699 | Unspecified vulnerability in the Oracle FLEXCUBE Direct Banking component in Oracle Financial Services Software 12.0.2 and 12.0.3 allows remote attack… | In your normal cycle | 9.1 critical | 2.8% | 2016-04-21 |
| CVE-2020-16272 | The SRP-6a implementation in Kee Vault KeePassRPC before 1.12.0 is missing validation for a client-provided parameter, which allows remote attackers t… | In your normal cycle | 9.1 critical | 2.8% | 2020-08-03 |
| CVE-2016-4351 | SQL injection vulnerability in the authentication functionality in Trend Micro Email Encryption Gateway (TMEEG) 5.5 before build 1107 allows remote at… | In your normal cycle | 9.8 critical | 2.8% | 2016-05-05 |
| CVE-2020-8186 | A command injection vulnerability in the `devcert` module may lead to remote code execution when users of the module pass untrusted input to the `cert… | In your normal cycle | 9.8 critical | 2.8% | 2020-07-10 |
| CVE-2015-8521 | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code v… | In your normal cycle | 9.8 critical | 2.8% | 2016-04-05 |
| CVE-2015-8522 | Buffer overflow in the server in IBM Tivoli Storage Manager FastBack 5.5.x and 6.x before 6.1.12.2 allows remote attackers to execute arbitrary code v… | In your normal cycle | 9.8 critical | 2.8% | 2016-04-05 |
| CVE-2015-9479 | The ACF-Frontend-Display plugin through 2015-07-03 for WordPress has arbitrary file upload via an action=upload request to js/blueimp-jQuery-File-Uplo… | In your normal cycle | 9.8 critical | 2.8% | 2019-10-10 |
| CVE-2016-3152 | Barco ClickShare CSC-1 devices with firmware before 01.09.03 allow remote attackers to obtain the root password by downloading and extracting the firm… | In your normal cycle | 9.8 critical | 2.8% | 2017-01-12 |
| CVE-2023-27240 | Tenda AX3 V16.03.12.11 was discovered to contain a command injection vulnerability via the lanip parameter at /goform/AdvSetLanip. | In your normal cycle | 9.8 critical | 2.8% | 2023-03-15 |
| CVE-2023-28347 | An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a proof-of-concept script that functions s… | In your normal cycle | 9.6 critical | 2.8% | 2023-05-31 |
| CVE-2017-13999 | A Stack-based Buffer Overflow issue was discovered in WECON LEVI Studio HMI Editor v1.8.1 and prior. Multiple stack-based buffer overflow vulnerabilit… | In your normal cycle | 9.8 critical | 2.8% | 2017-10-17 |
| CVE-2019-25213 | The Advanced Access Manager plugin for WordPress is vulnerable to Unauthenticated Arbitrary File Read in versions up to, and including, 5.9.8.1 due to… | In your normal cycle | 9.8 critical | 2.8% | 2024-10-16 |
| CVE-2018-7238 | A buffer overflow vulnerability exist in the web-based GUI of Schneider Electric's Pelco Sarix Professional in all firmware versions prior to 3.29.67… | In your normal cycle | 9.8 critical | 2.8% | 2018-03-09 |
| CVE-2018-7243 | An authorization bypass vulnerability exists In Schneider Electric's 66074 MGE Network Management Card Transverse installed in MGE UPS and MGE STS. Th… | In your normal cycle | 9.8 critical | 2.8% | 2018-04-18 |
| CVE-2021-21024 | Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search… | In your normal cycle | 9.1 critical | 2.8% | 2021-02-11 |
| CVE-2021-45079 | In strongSwan before 5.9.5, a malicious responder can send an EAP-Success message too early without actually authenticating the client and (in the cas… | In your normal cycle | 9.1 critical | 2.8% | 2022-01-31 |
| CVE-2022-28118 | SiteServer CMS v7.x allows attackers to execute arbitrary code via a crafted plug-in. | In your normal cycle | 9.8 critical | 2.8% | 2022-05-03 |
| CVE-2020-18703 | XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/utils/atom.py'. | In your normal cycle | 9.8 critical | 2.8% | 2021-08-16 |
| CVE-2020-18705 | XML External Entities (XXE) in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the component 'quokka/core/content/views.py'. | In your normal cycle | 9.8 critical | 2.8% | 2021-08-16 |
| CVE-2014-2896 | The DoAlert function in the (1) TLS and (2) DTLS implementations in wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact and… | In your normal cycle | 9.8 critical | 2.8% | 2020-01-28 |
| CVE-2014-2897 | The SSL 3 HMAC functionality in wolfSSL CyaSSL 2.5.0 before 2.9.4 does not check the padding length when verification fails, which allows remote attac… | In your normal cycle | 9.8 critical | 2.8% | 2020-01-28 |
| CVE-2014-2898 | wolfSSL CyaSSL before 2.9.4 allows remote attackers to have unspecified impact via multiple calls to the CyaSSL_read function which triggers an out-of… | In your normal cycle | 9.8 critical | 2.8% | 2020-01-28 |
| CVE-2018-18399 | SQL injection vulnerability in the "ContentPlaceHolder1_uxTitle" component in ArchiveNews.aspx in jco.ir KARMA 6.0.0 allows a remote attacker to execu… | In your normal cycle | 9.8 critical | 2.8% | 2018-12-20 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt