CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
404,806 CVEs
1,739 on KEV
17,301 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-12
37,075 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-41556 | sqclass.cpp in Squirrel through 2.2.5 and 3.x through 3.1 allows an out-of-bounds read (in the core interpreter) that can lead to Code Execution. If a… | In your normal cycle | 10.0 critical | 2.8% | 2022-07-28 |
| CVE-2020-28212 | A CWE-307: Improper Restriction of Excessive Authentication Attempts vulnerability exists in PLC Simulator on EcoStruxureª Control Expert (now Unity P… | In your normal cycle | 9.8 critical | 2.8% | 2020-11-19 |
| CVE-2013-3941 | Xjp2.dll in XnView before 2.13 allows remote attackers to execute arbitrary code via (1) the Csiz parameter in a SIZ marker, which triggers an incorre… | In your normal cycle | 9.8 critical | 2.8% | 2020-01-02 |
| CVE-2019-10796 | rpi through 0.0.3 allows execution of arbritary commands. The variable pinNumbver in function GPIO within src/lib/gpio.js is used as part of the argue… | In your normal cycle | 9.8 critical | 2.8% | 2020-02-24 |
| CVE-2019-8144 | A remote code execution vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can insert a malicious payload through… | In your normal cycle | 9.8 critical | 2.8% | 2019-11-06 |
| CVE-2020-26041 | An issue was discovered in Hoosk CmS v1.8.0. There is an Remote Code Execution vulnerability in install/index.php | In your normal cycle | 9.8 critical | 2.8% | 2020-09-30 |
| CVE-2020-29287 | An SQL injection vulnerability was discovered in Car Rental Management System v1.0 can be exploited via the id parameter in view_car.php or the car_id… | In your normal cycle | 9.8 critical | 2.8% | 2020-12-02 |
| CVE-2019-18200 | An issue was discovered on Fujitsu Wireless Keyboard Set LX390 GK381 devices. Because of the lack of proper encryption of 2.4 GHz communication, they… | In your normal cycle | 9.8 critical | 2.8% | 2019-10-24 |
| CVE-2022-27773 | A privilege escalation vulnerability is identified in Ivanti EPM (LANDesk Management Suite) that allows a user to execute commands with elevated privi… | In your normal cycle | 9.8 critical | 2.8% | 2022-12-05 |
| CVE-2026-20896 | Gitea Docker image versions up to and including 1.26.2 use REVERSE_PROXY_TRUSTED_PROXIES=* by default, allowing any source IP to impersonate a user wh… | In your normal cycle | 9.8 critical | 2.8% | 2026-07-03 |
| CVE-2019-16261 | Tripp Lite PDUMH15AT 12.04.0053 and SU750XL 12.04.0052 devices allow unauthenticated POST requests to the /Forms/ directory, as demonstrated by changi… | In your normal cycle | 9.1 critical | 2.8% | 2019-09-12 |
| CVE-2019-17113 | In libopenmpt before 0.3.19 and 0.4.x before 0.4.9, ModPlug_InstrumentName and ModPlug_SampleName in libopenmpt_modplug.c do not restrict the lengths… | In your normal cycle | 9.8 critical | 2.8% | 2019-10-04 |
| CVE-2021-1770 | A buffer overflow may result in arbitrary code execution. This issue is fixed in macOS Big Sur 11.3, iOS 14.5 and iPadOS 14.5, watchOS 7.4, tvOS 14.5.… | In your normal cycle | 9.8 critical | 2.8% | 2021-09-08 |
| CVE-2020-7719 | Versions of package locutus before 2.0.12 are vulnerable to prototype Pollution via the php.strings.parse_str function. | In your normal cycle | 9.8 critical | 2.8% | 2020-09-01 |
| CVE-2026-38708 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were… | In your normal cycle | 9.8 critical | 2.8% | 2026-07-31 |
| CVE-2026-38709 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were… | In your normal cycle | 9.8 critical | 2.8% | 2026-07-30 |
| CVE-2026-38711 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were… | In your normal cycle | 9.8 critical | 2.8% | 2026-07-31 |
| CVE-2026-38713 | TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were… | In your normal cycle | 9.8 critical | 2.8% | 2026-07-31 |
| CVE-2026-50871 | An OS command injection vulnerability in the media archiving and export pipeline component of kanishka-linux Reminiscence v0.3.0 allows attackers to e… | In your normal cycle | 9.8 critical | 2.8% | 2026-06-15 |
| CVE-2018-14938 | An issue was discovered in wifipcap/wifipcap.cpp in TCPFLOW through 1.5.0-alpha. There is an integer overflow in the function handle_prism during capl… | In your normal cycle | 9.1 critical | 2.8% | 2018-08-05 |
| CVE-2017-18379 | In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c. | In your normal cycle | 9.8 critical | 2.8% | 2019-07-27 |
| CVE-2025-7404 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS C… | In your normal cycle | 9.8 critical | 2.8% | 2025-07-24 |
| CVE-2022-20083 | In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding combi… | In your normal cycle | 9.8 critical | 2.8% | 2022-07-06 |
| CVE-2020-13112 | An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashe… | In your normal cycle | 9.1 critical | 2.8% | 2020-05-21 |
| CVE-2021-38555 | An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XM… | In your normal cycle | 9.1 critical | 2.8% | 2021-09-11 |
| CVE-2019-1710 | A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could… | In your normal cycle | 9.8 critical | 2.8% | 2019-04-17 |
| CVE-2021-29996 | Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution (RCE) by opening .md files containing… | In your normal cycle | 9.6 critical | 2.8% | 2021-04-05 |
| CVE-2019-10431 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in construc… | In your normal cycle | 9.9 critical | 2.8% | 2019-10-01 |
| CVE-2021-3169 | An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have acces… | In your normal cycle | 9.8 critical | 2.8% | 2021-07-23 |
| CVE-2016-8902 | SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL… | In your normal cycle | 9.8 critical | 2.8% | 2016-11-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt