CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,382 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,230 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-7606 | docker-compose-remote-api through 0.1.4 allows execution of arbitrary commands. Within 'index.js' of the package, the function 'exec(serviceName, cmd,… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-15 |
| CVE-2012-2166 | IBM XIV Storage System 2810-A14 and 2812-A14 devices before level 10.2.4.e-2 and 2810-114 and 2812-114 devices before level 11.1.1 have hardcoded pass… | In your normal cycle | 9.8 critical | 2.7% | 2018-02-08 |
| CVE-2016-7110 | Huawei Unified Maintenance Audit (UMA) before V200R001C00SPC200 allows remote attackers to execute arbitrary commands via "special characters," a diff… | In your normal cycle | 9.8 critical | 2.7% | 2016-09-07 |
| CVE-2020-6101 | An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An atta… | In your normal cycle | 9.9 critical | 2.7% | 2020-07-20 |
| CVE-2020-6102 | An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An atta… | In your normal cycle | 9.9 critical | 2.7% | 2020-07-20 |
| CVE-2020-6103 | An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.dll 26.20.15019.19000. An atta… | In your normal cycle | 9.9 critical | 2.7% | 2020-07-20 |
| CVE-2020-7454 | In FreeBSD 12.1-STABLE before r360971, 12.1-RELEASE before p5, 11.4-STABLE before r360971, 11.4-BETA1 before p1 and 11.3-RELEASE before p9, libalias d… | In your normal cycle | 9.8 critical | 2.7% | 2020-05-13 |
| CVE-2019-19950 | In GraphicsMagick 1.4 snapshot-20190403 Q8, there is a use-after-free in ThrowException and ThrowLoggedException of magick/error.c. | In your normal cycle | 9.8 critical | 2.7% | 2019-12-24 |
| CVE-2020-9366 | A buffer overflow was found in the way GNU Screen before 4.8.0 treated the special escape OSC 49. Specially crafted output, or a special program, coul… | In your normal cycle | 9.8 critical | 2.7% | 2020-02-24 |
| CVE-2021-26232 | SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id para… | In your normal cycle | 9.8 critical | 2.7% | 2021-07-22 |
| CVE-2017-7827 | Memory safety bugs were reported in Firefox 56. Some of these bugs showed evidence of memory corruption and we presume that with enough effort that so… | In your normal cycle | 9.8 critical | 2.7% | 2018-06-11 |
| CVE-2006-6975 | PHP remote file inclusion vulnerability in centipaid_class.php in CentiPaid 1.4.3 allows remote attackers to execute arbitrary code via a URL in the c… | In your normal cycle | 9.8 critical | 2.7% | 2007-02-08 |
| CVE-2020-7704 | The package linux-cmdline before 1.0.1 are vulnerable to Prototype Pollution via the constructor. | In your normal cycle | 9.8 critical | 2.7% | 2020-08-17 |
| CVE-2017-11673 | Reporter.exe in Acunetix 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed PRE file… | In your normal cycle | 9.8 critical | 2.7% | 2017-07-27 |
| CVE-2013-4654 | Symlink Traversal vulnerability in TP-LINK TL-WDR4300 and TL-1043ND.. | In your normal cycle | 9.8 critical | 2.7% | 2019-11-13 |
| CVE-2026-12486 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network… | In your normal cycle | 9.1 critical | 2.7% | 2026-06-24 |
| CVE-2026-12849 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network… | In your normal cycle | 9.1 critical | 2.7% | 2026-06-24 |
| CVE-2026-12850 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network… | In your normal cycle | 9.1 critical | 2.7% | 2026-06-24 |
| CVE-2026-12851 | Multiple OS command injection vulnerabilities exist in the libNetSetObj.so functionality of GeoVision GV-I/O Box 4E 2.09. A specially crafted network… | In your normal cycle | 9.1 critical | 2.7% | 2026-06-24 |
| CVE-2016-6452 | A vulnerability in the web-based graphical user interface (GUI) of Cisco Prime Home could allow an unauthenticated, remote attacker to bypass authenti… | In your normal cycle | 9.8 critical | 2.7% | 2016-11-03 |
| CVE-2017-11139 | GraphicsMagick 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c. | In your normal cycle | 9.8 critical | 2.7% | 2017-07-10 |
| CVE-2022-27082 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetInternetLanInfo. | In your normal cycle | 9.8 critical | 2.7% | 2022-03-24 |
| CVE-2020-7868 | A remote code execution vulnerability exists in helpUS(remote administration tool) due to improper validation of parameter of ShellExecutionExA functi… | In your normal cycle | 9.6 critical | 2.7% | 2021-06-29 |
| CVE-2026-93958 | A vulnerability was found in D-Link R95 BE9500_1.00.16. This vulnerability affects the function system of the file /bin/ssi of the component DHMAPI. T… | In your normal cycle | 9.1 critical | 2.7% | 2026-09-20 |
| CVE-2023-43202 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerabilit… | In your normal cycle | 9.8 critical | 2.7% | 2023-09-20 |
| CVE-2023-43204 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows att… | In your normal cycle | 9.8 critical | 2.7% | 2023-09-20 |
| CVE-2023-43207 | D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerabilit… | In your normal cycle | 9.8 critical | 2.7% | 2023-09-20 |
| CVE-2020-29282 | SQL injection vulnerability in BloodX 1.0 allows attackers to bypass authentication. | In your normal cycle | 9.8 critical | 2.7% | 2020-12-02 |
| CVE-2020-10233 | In version 4.8.0 and earlier of The Sleuth Kit (TSK), there is a heap-based buffer over-read in ntfs_dinode_lookup in fs/ntfs.c. | In your normal cycle | 9.1 critical | 2.7% | 2020-03-09 |
| CVE-2013-3367 | Undocumented TELNET service in TRENDnet TEW-691GR and TEW-692GR when a web page named backdoor contains an HTML parameter of password and a value of j… | In your normal cycle | 9.8 critical | 2.7% | 2019-11-13 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt