CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,366 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,227 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-5151 | Memory safety bugs were reported in Firefox 59. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that so… | In your normal cycle | 9.8 critical | 2.7% | 2018-06-11 |
| CVE-2018-6836 | The netmonrec_comment_destroy function in wiretap/netmon.c in Wireshark through 2.4.4 performs a free operation on an uninitialized memory address, wh… | In your normal cycle | 9.8 critical | 2.7% | 2018-02-08 |
| CVE-2019-6572 | A vulnerability has been identified in SIMATIC HMI Comfort Panels 4" - 22" (All versions < V15.1 Update 1), SIMATIC HMI Comfort Outdoor Panels 7" & 15… | In your normal cycle | 9.1 critical | 2.7% | 2019-05-14 |
| CVE-2025-23942 | Unrestricted Upload of File with Dangerous Type vulnerability in ngocuct0912 WP Load Gallery wp-load-gallery allows Upload a Web Shell to a Web Server… | In your normal cycle | 9.1 critical | 2.7% | 2025-01-22 |
| CVE-2013-7487 | On Swann DVR04B, DVR08B, DVR-16CIF, and DVR16B devices, raysharpdvr application has a vulnerable call to “system”, which allows remote attackers to ex… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-21 |
| CVE-2018-5779 | A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, c… | In your normal cycle | 9.8 critical | 2.7% | 2018-03-14 |
| CVE-2016-7950 | The XRenderQueryFilters function in X.org libXrender before 0.9.10 allows remote X servers to trigger out-of-bounds write operations via vectors invol… | In your normal cycle | 9.8 critical | 2.7% | 2016-12-13 |
| CVE-2019-7198 | This command injection vulnerability allows attackers to execute arbitrary commands in a compromised application. QNAP have already fixed this vulnera… | In your normal cycle | 9.8 critical | 2.7% | 2020-12-10 |
| CVE-2017-3758 | Improper access controls on several Android components in the Lenovo Service Framework application can be exploited to enable remote code execution. | In your normal cycle | 9.8 critical | 2.7% | 2017-10-17 |
| CVE-2017-6349 | An integer overflow at a u_read_undo memory allocation site would occur for vim before patch 8.0.0377, if it does not properly validate values for tre… | In your normal cycle | 9.8 critical | 2.7% | 2017-02-27 |
| CVE-2022-25081 | TOTOLink T10 V5.9c.5061_B20200511 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attack… | In your normal cycle | 9.8 critical | 2.7% | 2022-02-24 |
| CVE-2022-25083 | TOTOLink A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows a… | In your normal cycle | 9.8 critical | 2.7% | 2022-02-24 |
| CVE-2017-1383 | IBM InfoSphere Information Server 9.1, 11.3, and 11.5 is vulnerable to a XML External Entity Injection (XXE) attack when processing XML data. A remote… | In your normal cycle | 9.1 critical | 2.7% | 2017-08-02 |
| CVE-2017-5878 | The AMF unmarshallers in Red5 Media Server before 1.0.8 do not restrict the classes for which it performs deserialization, which allows remote attacke… | In your normal cycle | 9.8 critical | 2.7% | 2017-06-08 |
| CVE-2017-16151 | Based on details posted by the ElectronJS team; A remote code execution vulnerability has been discovered in Google Chromium that affects all recent v… | In your normal cycle | 9.8 critical | 2.7% | 2018-06-07 |
| CVE-2019-8578 | A use after free issue was addressed with improved memory management. This issue is fixed in AirPort Base Station Firmware Update 7.8.1, AirPort Base… | In your normal cycle | 9.8 critical | 2.7% | 2020-10-27 |
| CVE-2020-15391 | The UI in DevSpace 4.13.0 allows web sites to execute actions on pods (on behalf of a victim) because of a lack of authentication for the WebSocket pr… | In your normal cycle | 9.8 critical | 2.7% | 2020-07-23 |
| CVE-2014-10071 | In exec.c in zsh before 5.0.7, there is a buffer overflow for very long fds in the ">& fd" syntax. | In your normal cycle | 9.8 critical | 2.7% | 2018-02-27 |
| CVE-2016-0791 | Jenkins before 1.650 and LTS before 1.642.2 do not use a constant-time algorithm to verify CSRF tokens, which makes it easier for remote attackers to… | In your normal cycle | 9.8 critical | 2.7% | 2016-04-07 |
| CVE-2022-44928 | D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function. | In your normal cycle | 9.8 critical | 2.7% | 2022-12-02 |
| CVE-2012-2087 | ISPConfig 3.0.4.3: the "Add new Webdav user" can chmod and chown entire server from client interface. | In your normal cycle | 9.8 critical | 2.7% | 2020-01-23 |
| CVE-2014-10383 | The memphis-documents-library plugin before 3.0 for WordPress has Remote File Inclusion. | In your normal cycle | 9.8 critical | 2.7% | 2019-08-22 |
| CVE-2016-10306 | Trango Altum AC600 devices have a built-in, hidden root account, with a default password of abcd1234. This account is accessible via SSH and/or TELNET… | In your normal cycle | 9.8 critical | 2.7% | 2017-03-30 |
| CVE-2020-13995 | U.S. Air Force Sensor Data Management System extract75 has a buffer overflow that leads to code execution. An overflow in a global variable (sBuffer)… | In your normal cycle | 9.8 critical | 2.7% | 2020-09-25 |
| CVE-2019-13279 | TRENDnet TEW-827DRU with firmware up to and including 2.04B03 contains multiple stack-based buffer overflows when processing user input for the setup… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-10 |
| CVE-2018-18009 | dirary0.js on D-Link DIR-140L, DIR-640L devices allows remote unauthenticated attackers to discover admin credentials. | In your normal cycle | 9.8 critical | 2.7% | 2018-12-21 |
| CVE-2021-35474 | Stack-based Buffer Overflow vulnerability in cachekey plugin of Apache Traffic Server. This issue affects Apache Traffic Server 7.0.0 to 7.1.12, 8.0.0… | In your normal cycle | 9.8 critical | 2.7% | 2021-06-30 |
| CVE-2019-9584 | eQ-3 Homematic AddOn 'CloudMatic' on CCU2 and CCU3 allows uncontrolled admin access, resulting in the ability to obtain VPN profile details, shutting… | In your normal cycle | 9.8 critical | 2.7% | 2019-08-14 |
| CVE-2019-9585 | eQ-3 Homematic CCU2 prior to 2.47.10 and CCU3 prior to 3.47.10 JSON API has Improper Access Control for Interface.***Metadata related operations, resu… | In your normal cycle | 9.8 critical | 2.7% | 2019-08-14 |
| CVE-2020-7601 | gulp-scss-lint through 1.0.0 allows execution of arbitrary commands. It is possible to inject arbitrary commands to the "exec" function located in "sr… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-15 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt