CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,357 CVEs
1,740 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-13
37,227 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-18379 | In the Linux kernel before 4.14, an out of boundary access happened in drivers/nvme/target/fc.c. | In your normal cycle | 9.8 critical | 2.8% | 2019-07-27 |
| CVE-2022-20083 | In Modem 2G/3G CC, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution when decoding combi… | In your normal cycle | 9.8 critical | 2.8% | 2022-07-06 |
| CVE-2025-7404 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Calibre Web, Autocaliweb allows Blind OS C… | In your normal cycle | 9.8 critical | 2.8% | 2025-07-24 |
| CVE-2020-13112 | An issue was discovered in libexif before 0.6.22. Several buffer over-reads in EXIF MakerNote handling could lead to information disclosure and crashe… | In your normal cycle | 9.1 critical | 2.8% | 2020-05-21 |
| CVE-2021-38555 | An XML external entity (XXE) injection vulnerability was discovered in the Any23 StreamUtils.java file and is known to affect Any23 versions < 2.5. XM… | In your normal cycle | 9.1 critical | 2.8% | 2021-09-11 |
| CVE-2019-1710 | A vulnerability in the sysadmin virtual machine (VM) on Cisco ASR 9000 Series Aggregation Services Routers running Cisco IOS XR 64-bit Software could… | In your normal cycle | 9.8 critical | 2.8% | 2019-04-17 |
| CVE-2021-29996 | Mark Text through 0.16.3 allows attackers arbitrary command execution. This could lead to Remote Code Execution (RCE) by opening .md files containing… | In your normal cycle | 9.6 critical | 2.8% | 2021-04-05 |
| CVE-2019-10431 | A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.64 and earlier related to the handling of default parameter expressions in construc… | In your normal cycle | 9.9 critical | 2.8% | 2019-10-01 |
| CVE-2021-3169 | An issue in Jumpserver before 2.6.2, before 2.5.4, before 2.4.5 allows attackers to create a connection token through an API which does not have acces… | In your normal cycle | 9.8 critical | 2.8% | 2021-07-23 |
| CVE-2016-8902 | SQL injection vulnerability in the categoriesServlet servlet in dotCMS before 3.3.1 allows remote not authenticated attackers to execute arbitrary SQL… | In your normal cycle | 9.8 critical | 2.8% | 2016-11-14 |
| CVE-2011-5331 | Distributed Ruby (aka DRuby) 1.8 mishandles instance_eval. | In your normal cycle | 9.8 critical | 2.7% | 2019-11-18 |
| CVE-2015-5244 | The NSSCipherSuite option with ciphersuites enabled in mod_nss before 1.0.12 allows remote attackers to bypass application restrictions. | In your normal cycle | 9.8 critical | 2.7% | 2017-08-07 |
| CVE-2015-7272 | Dell Integrated Remote Access Controller (iDRAC) 6 before 2.80 and 7/8 before 2.21.21.21 allows attackers to cause a denial of service (buffer overflo… | In your normal cycle | 9.8 critical | 2.7% | 2017-04-10 |
| CVE-2015-8965 | Rogue Wave JViews before 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath, such… | In your normal cycle | 9.8 critical | 2.7% | 2017-04-06 |
| CVE-2018-10740 | Axublog 1.1.0 allows remote Code Execution as demonstrated by injection of PHP code (contained in the webkeywords parameter) into the cmsconfig.php fi… | In your normal cycle | 9.8 critical | 2.7% | 2018-05-04 |
| CVE-2018-10753 | Stack-based buffer overflow in the delayed_output function in music.c in abcm2ps through 8.13.20 allows remote attackers to cause a denial of service… | In your normal cycle | 9.8 critical | 2.7% | 2018-05-05 |
| CVE-2020-6963 | In ApexPro Telemetry Server Versions 4.2 and prior, CARESCAPE Telemetry Server v4.2 & prior, Clinical Information Center (CIC) Versions 4.X and 5.X, C… | In your normal cycle | 10.0 critical | 2.7% | 2020-01-24 |
| CVE-2015-8768 | click/install.py in click does not require files in package filesystem tarballs to start with ./ (dot slash), which allows remote attackers to install… | In your normal cycle | 9.8 critical | 2.7% | 2017-02-13 |
| CVE-2015-9290 | In FreeType before 2.6.1, a buffer over-read occurs in type1/t1parse.c on function T1_Get_Private_Dict where there is no check that the new values of… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-30 |
| CVE-2019-10919 | A vulnerability has been identified in LOGO! 8 BM (incl. SIPLUS variants) (All versions < V8.3). Attackers with access to port 10005/tcp could perform… | In your normal cycle | 9.4 critical | 2.7% | 2019-05-14 |
| CVE-2019-1010297 | Linaro/OP-TEE OP-TEE 3.3.0 and earlier is affected by: Buffer Overflow. The impact is: Execution of code in TEE core (kernel) context. The component i… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-15 |
| CVE-2019-0246 | SAP Cloud Connector, before version 2.11.3, does not perform any authentication checks for functionalities that require user identity. | In your normal cycle | 9.8 critical | 2.7% | 2019-01-08 |
| CVE-2021-37334 | Umbraco Forms version 4.0.0 up to and including 8.7.5 and below are vulnerable to a security flaw that could lead to a remote code execution attack an… | In your normal cycle | 9.8 critical | 2.7% | 2021-08-25 |
| CVE-2018-12547 | In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snprintf() and jio_vsnprintf() native methods ignored the length parameter. This affects exist… | In your normal cycle | 9.8 critical | 2.7% | 2019-02-11 |
| CVE-2025-34184 | Ilevia EVE X1 Server version ≤ 4.7.18.0.eden contains an unauthenticated OS command injection vulnerability in the /ajax/php/login.php script. Remote… | In your normal cycle | 9.8 critical | 2.7% | 2025-09-16 |
| CVE-2019-11627 | gpg-key2ps in signing-party 1.1.x and 2.x before 2.10-1 contains an unsafe shell call enabling shell injection via a User ID. | In your normal cycle | 9.8 critical | 2.7% | 2019-04-30 |
| CVE-2019-15597 | A code injection exists in node-df v0.1.4 that can allow an attacker to remote code execution by unsanitized input. | In your normal cycle | 9.8 critical | 2.7% | 2019-12-18 |
| CVE-2019-15598 | A Code Injection exists in treekill on Windows which allows a remote code execution when an attacker is able to control the input into the command. | In your normal cycle | 9.8 critical | 2.7% | 2019-12-18 |
| CVE-2019-15599 | A Code Injection exists in tree-kill on Windows which allows a remote code execution when an attacker is able to control the input into the command. | In your normal cycle | 9.8 critical | 2.7% | 2019-12-18 |
| CVE-2023-1892 | Cross-site Scripting (XSS) - Reflected in GitHub repository sidekiq/sidekiq prior to 7.0.8. | In your normal cycle | 9.6 critical | 2.7% | 2023-04-21 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt