CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,382 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,235 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2014-3879 | OpenPAM Nummularia 9.2 through 10.0 does not properly handle the error reported when an include directive refers to a policy that does not exist, whic… | In your normal cycle | 9.8 critical | 2.7% | 2020-02-18 |
| CVE-2016-7560 | The rsyncd server in Fortinet FortiWLC 6.1-2-29 and earlier, 7.0-9-1, 7.0-10-0, 8.0-5-0, 8.1-2-0, and 8.2-4-0 has a hardcoded rsync account, which all… | In your normal cycle | 9.8 critical | 2.7% | 2016-10-05 |
| CVE-2017-8858 | In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' p… | In your normal cycle | 9.8 critical | 2.7% | 2017-05-09 |
| CVE-2017-2343 | The Integrated User Firewall (UserFW) feature was introduced in Junos OS version 12.1X47-D10 on the Juniper SRX Series devices to provide simple integ… | In your normal cycle | 10.0 critical | 2.7% | 2017-07-17 |
| CVE-2021-32974 | Improper input validation in the built-in web server in Moxa NPort IAW5000A-I/O series firmware version 2.2 or earlier may allow a remote attacker to… | In your normal cycle | 9.8 critical | 2.7% | 2022-04-01 |
| CVE-2021-3210 | components/Modals/HelpTexts/GenericAll/GenericAll.jsx in Bloodhound <= 4.0.1 allows remote attackers to execute arbitrary system commands when the vic… | In your normal cycle | 9.6 critical | 2.7% | 2021-02-19 |
| CVE-2004-2214 | Mbedthis AppWeb HTTP server before 1.1.3 allows remote attackers to bypass access restrictions via a URI with mixed case characters. | In your normal cycle | 9.8 critical | 2.7% | 2004-12-31 |
| CVE-2018-10731 | All Phoenix Contact managed FL SWITCH 3xxx, 4xxx, 48xx products running firmware version 1.0 to 1.33 are prone to buffer overflows when handling very… | In your normal cycle | 9.0 critical | 2.7% | 2018-05-17 |
| CVE-2021-28834 | Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated. | In your normal cycle | 9.8 critical | 2.7% | 2021-03-19 |
| CVE-2022-31691 | Spring Tools 4 for Eclipse version 4.16.0 and below as well as VSCode extensions such as Spring Boot Tools, Concourse CI Pipeline Editor, Bosh Editor… | In your normal cycle | 9.8 critical | 2.7% | 2022-11-04 |
| CVE-2022-36749 | RPi-Jukebox-RFID v2.3.0 was discovered to contain a command injection vulnerability via the component /htdocs/utils/Files.php. This vulnerability is e… | In your normal cycle | 9.8 critical | 2.7% | 2022-08-30 |
| CVE-2020-10655 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's Writ… | In your normal cycle | 9.8 critical | 2.7% | 2021-01-06 |
| CVE-2020-10656 | The Proofpoint Insider Threat Management Server (formerly ObserveIT Server) before 7.9.1 contains a vulnerability in the ITM application server's Writ… | In your normal cycle | 9.8 critical | 2.7% | 2021-01-06 |
| CVE-2019-13169 | Some Xerox printers (such as the Phaser 3320 V53.006.16.000) were affected by a buffer overflow vulnerability in the Content-Type HTTP Header of the w… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-13 |
| CVE-2020-35125 | A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via m… | In your normal cycle | 9.6 critical | 2.7% | 2021-02-09 |
| CVE-2021-21876 | Specially-crafted HTTP requests can lead to arbitrary command execution in PUT requests. An attacker can make authenticated HTTP requests to trigger t… | In your normal cycle | 9.1 critical | 2.7% | 2021-12-22 |
| CVE-2021-21877 | Specially-crafted HTTP requests can lead to arbitrary command execution in “GET” requests. An attacker can make authenticated HTTP requests to trigger… | In your normal cycle | 9.1 critical | 2.7% | 2021-12-22 |
| CVE-2018-25083 | The pullit package before 1.4.0 for Node.js allows OS Command Injection because eval is used on an attacker-supplied Git branch name. | In your normal cycle | 9.8 critical | 2.7% | 2023-03-27 |
| CVE-2026-41304 | WWBN AVideo is an open source video platform. In versions 29.0 and below, the `cloneServer.json.php` endpoint in the CloneSite plugin constructs shell… | In your normal cycle | 9.8 critical | 2.7% | 2026-04-22 |
| CVE-2022-41030 | Several stack-based buffer overflow vulnerabilities exist in the DetranCLI command parsing functionality of Siretta QUARTZ-GOLD G5.0.1.5-210720-141020… | In your normal cycle | 9.8 critical | 2.7% | 2023-01-26 |
| CVE-2023-26921 | OS Command Injection vulnerability in quectel AG550QCN allows attackers to execute arbitrary commands via ql_atfwd. | In your normal cycle | 9.8 critical | 2.7% | 2023-04-04 |
| CVE-2022-26991 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in t… | In your normal cycle | 9.8 critical | 2.7% | 2022-03-15 |
| CVE-2022-26993 | Arris routers SBR-AC1900P 1.0.7-B05, SBR-AC3200P 1.0.7-B05 and SBR-AC1200P 1.0.5-B05 were discovered to contain a command injection vulnerability in t… | In your normal cycle | 9.8 critical | 2.7% | 2022-03-15 |
| CVE-2020-8128 | An unintended require and server-side request forgery vulnerabilities in jsreport version 2.5.0 and earlier allow attackers to execute arbitrary code. | In your normal cycle | 9.8 critical | 2.7% | 2020-02-14 |
| CVE-2018-15362 | XXE in GE Proficy Cimplicity GDS versions 9.0 R2, 9.5, 10.0 | In your normal cycle | 9.1 critical | 2.7% | 2018-12-07 |
| CVE-2022-24303 | Pillow before 9.0.1 allows attackers to delete files because spaces in temporary pathnames are mishandled. | In your normal cycle | 9.1 critical | 2.7% | 2022-03-28 |
| CVE-2022-24553 | An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote command executi… | In your normal cycle | 9.8 critical | 2.7% | 2022-02-21 |
| CVE-2020-14983 | The server in Chocolate Doom 3.0.0 and Crispy Doom 5.8.0 doesn't validate the user-controlled num_players value, leading to a buffer overflow. A malic… | In your normal cycle | 9.8 critical | 2.7% | 2020-06-22 |
| CVE-2020-26759 | clickhouse-driver before 0.1.5 allows a malicious clickhouse server to trigger a crash or execute arbitrary code (on a database client) via a crafted… | In your normal cycle | 9.8 critical | 2.7% | 2021-01-06 |
| CVE-2018-4852 | A vulnerability has been identified in SICLOCK TC100 (All versions) and SICLOCK TC400 (All versions). An attacker with network access to the device co… | In your normal cycle | 9.8 critical | 2.7% | 2018-07-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt