CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,806 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,075 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-7810 | Memory safety bugs were reported in Firefox 55 and Firefox ESR 52.3. Some of these bugs showed evidence of memory corruption and we presume that with… | In your normal cycle | 9.8 critical | 2.8% | 2018-06-11 |
| CVE-2019-18257 | In Advantech DiagAnywhere Server, Versions 3.07.11 and prior, multiple stack-based buffer overflow vulnerabilities exist in the file transfer service… | In your normal cycle | 9.8 critical | 2.8% | 2019-12-17 |
| CVE-2025-11202 | win-cli-mcp-server resolveCommandPath Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arb… | In your normal cycle | 9.8 critical | 2.8% | 2025-10-29 |
| CVE-2024-35374 | Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute ar… | In your normal cycle | 9.8 critical | 2.8% | 2024-05-24 |
| CVE-2019-13276 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains a stack-based buffer overflow in the ssi binary. The overflow allows an unauthe… | In your normal cycle | 9.8 critical | 2.8% | 2019-07-10 |
| CVE-2022-1587 | An out-of-bounds read vulnerability was discovered in the PCRE2 library in the get_recurse_data_length() function of the pcre2_jit_compile.c file. Thi… | In your normal cycle | 9.1 critical | 2.8% | 2022-05-16 |
| CVE-2023-28706 | Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects… | In your normal cycle | 9.8 critical | 2.8% | 2023-04-07 |
| CVE-2021-41392 | static/main-preload.js in Boost Note through 0.22.0 allows remote command execution. A remote attacker may send a crafted IPC message to the exposed v… | In your normal cycle | 9.8 critical | 2.8% | 2021-09-17 |
| CVE-2019-3939 | Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 use default credentials admin/admin and moderator/moderator for the web interfa… | In your normal cycle | 9.8 critical | 2.8% | 2019-04-30 |
| CVE-2020-12471 | MonoX through 5.1.40.5152 allows remote code execution via HTML5Upload.ashx or Pages/SocialNetworking/lng/en-US/PhotoGallery.aspx because of deseriali… | In your normal cycle | 9.8 critical | 2.8% | 2020-04-29 |
| CVE-2019-9212 | SOFA-Hessian through 4.0.2 allows remote attackers to execute arbitrary commands via a crafted serialized Hessian object because blacklisting of com.c… | In your normal cycle | 9.8 critical | 2.8% | 2019-02-27 |
| CVE-2015-9351 | The feed-them-social plugin before 1.7.0 for WordPress has possible shortcode execution in the Facebook Feeds load more button. | In your normal cycle | 9.8 critical | 2.8% | 2019-08-27 |
| CVE-2019-10712 | The Web-GUI on WAGO Series 750-88x (750-330, 750-352, 750-829, 750-831, 750-852, 750-880, 750-881, 750-882, 750-884, 750-885, 750-889) and Series 750-… | In your normal cycle | 9.8 critical | 2.8% | 2019-05-07 |
| CVE-2022-26674 | ASUS RT-AX88U has a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory address and perform remo… | In your normal cycle | 9.8 critical | 2.8% | 2022-04-22 |
| CVE-2021-4048 | An out-of-bounds read flaw was found in the CLARRV, DLARRV, SLARRV, and ZLARRV functions in lapack through version 3.10.0, as also used in OpenBLAS be… | In your normal cycle | 9.1 critical | 2.8% | 2021-12-08 |
| CVE-2025-12686 | Buffer copy without checking size of input ('Classic Buffer Overflow') vulnerability in AdminCenter in Synology BeeStation OS before 1.3.2-65648 allow… | In your normal cycle | 9.8 critical | 2.8% | 2026-05-27 |
| CVE-2017-17946 | A buffer overflow in Handy Password 4.9.3 allows remote attackers to execute arbitrary code via a long "Title name" field in "mail box" data that is m… | In your normal cycle | 9.8 critical | 2.8% | 2018-01-10 |
| CVE-2021-38484 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 do not have a filter or signature check to detect or prevent an upload of maliciou… | In your normal cycle | 9.1 critical | 2.8% | 2021-10-19 |
| CVE-2021-45334 | Sourcecodester Online Thesis Archiving System 1.0 is vulnerable to SQL Injection. An attacker can bypass admin authentication and gain access to admin… | In your normal cycle | 9.8 critical | 2.8% | 2022-01-10 |
| CVE-2022-2272 | This vulnerability allows remote attackers to bypass authentication on affected installations of Sante PACS Server 3.0.4. Authentication is not requir… | In your normal cycle | 9.8 critical | 2.8% | 2022-08-03 |
| CVE-2024-3300 | An unsafe .NET object deserialization vulnerability in DELMIA Apriso Release 2019 through Release 2024 could lead to pre-authentication remote code ex… | In your normal cycle | 9.0 critical | 2.8% | 2024-05-30 |
| CVE-2023-28115 | Snappy is a PHP library allowing thumbnail, snapshot or PDF generation from a url or a html page. Prior to version 1.4.2, Snappy is vulnerable to PHAR… | In your normal cycle | 9.8 critical | 2.8% | 2023-03-17 |
| CVE-2017-2891 | An exploitable use-after-free vulnerability exists in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI… | In your normal cycle | 9.8 critical | 2.8% | 2017-11-07 |
| CVE-2020-25889 | Online Bus Booking System Project Using PHP/MySQL version 1.0 has SQL injection via the login page. By placing SQL injection payload on the login page… | In your normal cycle | 9.8 critical | 2.8% | 2020-12-08 |
| CVE-2016-9176 | Stack buffer overflow in the send.exe and receive.exe components of Micro Focus Rumba 9.4 and earlier could be used by local attackers or attackers ab… | In your normal cycle | 9.8 critical | 2.8% | 2016-11-04 |
| CVE-2018-3772 | Concatenating unsanitized user input in the `whereis` npm module < 0.4.1 allowed an attacker to execute arbitrary commands. The `whereis` module is de… | In your normal cycle | 9.8 critical | 2.8% | 2018-07-30 |
| CVE-2019-12771 | Command injection is possible in ThinStation through 6.1.1 via shell metacharacters after the cgi-bin/CdControl.cgi action= substring, or after the cg… | In your normal cycle | 9.8 critical | 2.8% | 2019-06-07 |
| CVE-2017-7903 | A Weak Password Requirements issue was discovered in Rockwell Automation Allen-Bradley MicroLogix 1100 programmable-logic controllers 1763-L16AWA, Ser… | In your normal cycle | 9.8 critical | 2.8% | 2017-06-30 |
| CVE-2018-12421 | LTB (aka LDAP Tool Box) Self Service Password before 1.3 allows a change to a user password (without knowing the old password) via a crafted POST requ… | In your normal cycle | 9.8 critical | 2.8% | 2018-06-14 |
| CVE-2020-7043 | An issue was discovered in openfortivpn 1.11.0 when used with OpenSSL before 1.0.2. tunnel.c mishandles certificate validation because hostname compar… | In your normal cycle | 9.1 critical | 2.8% | 2020-02-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt