CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,366 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,227 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2023-26009 | Improper Privilege Management vulnerability in Favethemes Houzez Login Register allows Privilege Escalation.This issue affects Houzez Login Register:… | In your normal cycle | 9.8 critical | 2.7% | 2024-05-17 |
| CVE-2023-26540 | Improper Privilege Management vulnerability in Favethemes Houzez allows Privilege Escalation.This issue affects Houzez: from n/a through 2.7.1. | In your normal cycle | 9.8 critical | 2.7% | 2024-05-17 |
| CVE-2016-8418 | A remote code execution vulnerability in the Qualcomm crypto driver could enable a remote attacker to execute arbitrary code within the context of the… | In your normal cycle | 9.8 critical | 2.7% | 2017-02-08 |
| CVE-2017-15379 | An authentication bypass exists in the E-Sic 1.0 /index (aka login) URI via '=''or' values for the username and password. | In your normal cycle | 9.8 critical | 2.7% | 2017-10-23 |
| CVE-2021-22765 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that cou… | In your normal cycle | 9.8 critical | 2.7% | 2021-06-11 |
| CVE-2021-22767 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that cou… | In your normal cycle | 9.8 critical | 2.7% | 2021-06-11 |
| CVE-2021-22768 | A CWE-20: Improper Input Validation vulnerability exists in PowerLogic EGX100 (Versions 3.0.0 and newer) and PowerLogic EGX300 (All Versions) that cou… | In your normal cycle | 9.8 critical | 2.7% | 2021-06-11 |
| CVE-2022-30133 | Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability | In your normal cycle | 9.8 critical | 2.7% | 2022-08-09 |
| CVE-2025-24786 | WhoDB is an open source database management tool. While the application only displays Sqlite3 databases present in the directory `/db`, there is no pa… | In your normal cycle | 10.0 critical | 2.7% | 2025-02-06 |
| CVE-2019-17192 | The WebRTC component in the Signal Private Messenger application through 4.47.7 for Android processes videoconferencing RTP packets before a callee ch… | In your normal cycle | 9.8 critical | 2.7% | 2019-10-05 |
| CVE-2019-14527 | An issue was discovered on NETGEAR Nighthawk M1 (MR1100) devices before 12.06.03. System commands can be executed, via the web interface, after authen… | In your normal cycle | 9.8 critical | 2.7% | 2019-08-14 |
| CVE-2019-14695 | A SQL injection vulnerability exists in the Sygnoos Popup Builder plugin before 3.45 for WordPress. Successful exploitation of this vulnerability woul… | In your normal cycle | 9.8 critical | 2.7% | 2019-08-06 |
| CVE-2019-12812 | MyBuilder viewer before 6.2.2019.814 allow an attacker to execute arbitrary command via specifically crafted configuration file. This can be leveraged… | In your normal cycle | 9.8 critical | 2.7% | 2019-10-07 |
| CVE-2015-5741 | The net/http library in net/http/transfer.go in Go before 1.4.3 does not properly parse HTTP headers, which allows remote attackers to conduct HTTP re… | In your normal cycle | 9.8 critical | 2.7% | 2020-02-08 |
| CVE-2016-6727 | The Qualcomm GPS subsystem in Android on Android One devices allows remote attackers to execute arbitrary code. | In your normal cycle | 9.8 critical | 2.7% | 2017-04-17 |
| CVE-2019-15931 | Intesync Solismed 3.3sp allows Directory Traversal, a different vulnerability than CVE-2019-16246. | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2020-5664 | Deserialization of untrusted data vulnerability in XooNIps 3.49 and earlier allows remote attackers to execute arbitrary code via unspecified vectors. | In your normal cycle | 9.8 critical | 2.7% | 2020-11-16 |
| CVE-2020-29493 | DELL EMC Avamar Server, versions 19.1, 19.2, 19.3, contain a SQL Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could… | In your normal cycle | 10.0 critical | 2.7% | 2021-01-14 |
| CVE-2020-11486 | NVIDIA DGX servers, all DGX-1 with BMC firmware versions prior to 3.38.30, contain a vulnerability in the AMI BMC firmware in which software allows an… | In your normal cycle | 9.8 critical | 2.7% | 2020-10-29 |
| CVE-2022-48252 | The jokob-sk/Pi.Alert fork (before 22.12.20) of Pi.Alert allows Remote Code Execution via nmap_scan.php (scan parameter) OS Command Injection. | In your normal cycle | 9.8 critical | 2.7% | 2023-01-11 |
| CVE-2022-24148 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function mDMZSetCfg. This vulnerability allows attackers… | In your normal cycle | 9.8 critical | 2.7% | 2022-02-04 |
| CVE-2022-24150 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function formSetSafeWanWebMan. This vulnerability allows… | In your normal cycle | 9.8 critical | 2.7% | 2022-02-04 |
| CVE-2026-32892 | Chamilo LMS is a learning management system. Prior to 1.11.38 and 2.0.0-RC.3, Chamilo LMS contains an OS Command Injection vulnerability in the file m… | In your normal cycle | 9.1 critical | 2.7% | 2026-04-10 |
| CVE-2021-43616 | The npm ci command in npm 7.x and 8.x through 8.1.3 proceeds with an installation even if dependency information in package-lock.json differs from pac… | In your normal cycle | 9.0 critical | 2.7% | 2021-11-13 |
| CVE-2018-21246 | Caddy before 0.10.13 mishandles TLS client authentication, as demonstrated by an authentication bypass caused by the lack of the StrictHostMatching mo… | In your normal cycle | 9.8 critical | 2.7% | 2020-06-15 |
| CVE-2020-4493 | IBM Maximo Asset Management 7.6.0 and 7.6.1 could allow an attacker to bypass authentication and issue commands using a specially crafted HTTP command… | In your normal cycle | 9.8 critical | 2.7% | 2020-10-05 |
| CVE-2018-13259 | An issue was discovered in zsh before 5.6. Shebang lines exceeding 64 characters were truncated, potentially leading to an execve call to a program na… | In your normal cycle | 9.8 critical | 2.7% | 2018-09-05 |
| CVE-2023-43206 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerab… | In your normal cycle | 9.8 critical | 2.7% | 2023-09-20 |
| CVE-2022-25591 | BlogEngine.NET v3.3.8.0 was discovered to contain an arbitrary file deletion vulnerability which allows attackers to delete files within the web serve… | In your normal cycle | 9.1 critical | 2.7% | 2022-05-13 |
| CVE-2022-40089 | A remote file inclusion (RFI) vulnerability in Simple College Website v1.0 allows attackers to execute arbitrary code via a crafted PHP file. This vul… | In your normal cycle | 9.8 critical | 2.7% | 2022-09-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt