CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,410 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,235 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-5770 | An issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a request to /goform/telnet, creating a telnetd service on… | In your normal cycle | 9.8 critical | 2.7% | 2018-03-20 |
| CVE-2015-10143 | The Platform theme for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability… | In your normal cycle | 9.8 critical | 2.7% | 2025-07-25 |
| CVE-2015-6319 | SQL injection vulnerability in the web-based management interface on Cisco RV220W devices allows remote attackers to execute arbitrary SQL commands vi… | In your normal cycle | 9.8 critical | 2.7% | 2016-01-27 |
| CVE-2017-14127 | Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OI_Fw_v7 devices allows remote attackers to execute arbitrary OS comma… | In your normal cycle | 9.8 critical | 2.7% | 2017-09-04 |
| CVE-2019-11888 | Go through 1.12.5 on Windows mishandles process creation with a nil environment in conjunction with a non-nil token, which allows attackers to obtain… | In your normal cycle | 9.8 critical | 2.7% | 2019-05-13 |
| CVE-2017-2738 | VCM5010 with software versions earlier before V100R002C50SPC100 has an authentication bypass vulnerability. This is due to improper implementation of… | In your normal cycle | 9.8 critical | 2.7% | 2017-11-22 |
| CVE-2022-25329 | Trend Micro ServerProtect 6.0/5.8 Information Server uses a static credential to perform authentication when a specific command is typed in the consol… | In your normal cycle | 9.8 critical | 2.7% | 2022-02-24 |
| CVE-2022-30310 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-acknerr-request" POST request doesn’t check for port synt… | In your normal cycle | 9.8 critical | 2.7% | 2022-06-13 |
| CVE-2022-30311 | In Festo Controller CECC-X-M1 product family in multiple versions, the http-endpoint "cecc-x-refresh-request" POST request doesn’t check for port synt… | In your normal cycle | 9.8 critical | 2.7% | 2022-06-13 |
| CVE-2023-3961 | A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory.… | In your normal cycle | 9.1 critical | 2.7% | 2023-11-03 |
| CVE-2024-3806 | The Porto theme for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 7.1.0 via the 'porto_ajax_posts' function. T… | In your normal cycle | 9.8 critical | 2.7% | 2024-05-14 |
| CVE-2020-25260 | An issue was discovered in Hyland OnBase 16.0.2.83 and below, 17.0.2.109 and below, 18.0.0.37 and below, 19.8.16.1000 and below and 20.3.10.1000 and b… | In your normal cycle | 9.8 critical | 2.7% | 2020-09-11 |
| CVE-2022-24803 | Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-s… | In your normal cycle | 10.0 critical | 2.7% | 2022-04-01 |
| CVE-2022-24720 | image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the `#apply` method from im… | In your normal cycle | 9.8 critical | 2.7% | 2022-03-01 |
| CVE-2021-38697 | SoftVibe SARABAN for INFOMA 1.1 allows Unauthenticated unrestricted File Upload, that allows attackers to upload files with any file extension which c… | In your normal cycle | 9.8 critical | 2.7% | 2022-01-18 |
| CVE-2018-14502 | controllers/quizzes.php in the Kiboko Chained Quiz plugin before 1.0.9 for WordPress allows remote unauthenticated users to execute arbitrary SQL comm… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-10 |
| CVE-2020-8443 | In OSSEC-HIDS 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) is vulnerable to an off-by-one heap-based buffer… | In your normal cycle | 9.8 critical | 2.7% | 2020-01-30 |
| CVE-2020-8465 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an attacker to manipulate system updates using a combinati… | In your normal cycle | 9.8 critical | 2.7% | 2020-12-17 |
| CVE-2013-7378 | scripts/email.coffee in the Hubot Scripts module before 2.4.4 for Node.js allows remote attackers to execute arbitrary commands. | In your normal cycle | 9.8 critical | 2.7% | 2020-02-12 |
| CVE-2013-7381 | libnotify before 1.0.4 for Node.js allows remote attackers to execute arbitrary commands via unspecified characters in a call to libnotify.notify. | In your normal cycle | 9.8 critical | 2.7% | 2020-02-12 |
| CVE-2015-5988 | The web management interface on Belkin F9K1102 2 devices with firmware 2.10.17 has a blank password, which allows remote attackers to obtain administr… | In your normal cycle | 9.8 critical | 2.7% | 2015-12-31 |
| CVE-2024-4343 | A Python command injection vulnerability exists in the `SagemakerLLM` class's `complete()` method within `./private_gpt/components/llm/custom/sagemake… | In your normal cycle | 9.8 critical | 2.7% | 2024-11-14 |
| CVE-2024-5181 | A command injection vulnerability exists in the mudler/localai version 2.14.0. The vulnerability arises from the application's handling of the backend… | In your normal cycle | 9.8 critical | 2.7% | 2024-06-26 |
| CVE-2020-20184 | GateOne allows remote attackers to execute arbitrary commands via shell metacharacters in the port field when attempting an SSH connection. | In your normal cycle | 9.8 critical | 2.7% | 2020-12-14 |
| CVE-2020-20298 | Eval injection vulnerability in the parserCommom method in the ParserTemplate class in zzz_template.php in zzzphp 1.7.2 allows remote attackers to exe… | In your normal cycle | 9.8 critical | 2.7% | 2020-12-18 |
| CVE-2018-19528 | TP-Link TL-WR886N 7.0 1.1.0 devices allow remote attackers to cause a denial of service (Tlb Load Exception) via crafted DNS packets to port 53/udp. | In your normal cycle | 9.8 critical | 2.7% | 2018-11-26 |
| CVE-2019-18190 | Trend Micro Security (Consumer) 2020 (v16.x) is affected by a vulnerability in where null pointer dereference errors result in the crash of applicatio… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-09 |
| CVE-2019-8981 | tls1.c in Cameron Hamilton-Rich axTLS before 2.1.5 has a Buffer Overflow via a crafted sequence of TLS packets because the need_bytes value is mismana… | In your normal cycle | 9.8 critical | 2.7% | 2019-03-26 |
| CVE-2020-8963 | TimeTools SC7105 1.0.007, SC9205 1.0.007, SC9705 1.0.007, SR7110 1.0.007, SR9210 1.0.007, SR9750 1.0.007, SR9850 1.0.007, T100 1.0.003, T300 1.0.003,… | In your normal cycle | 9.8 critical | 2.7% | 2020-02-13 |
| CVE-2019-13027 | Realization Concerto Critical Chain Planner (aka CCPM) 5.10.8071 has SQL Injection in at least in the taskupdt/taskdetails.aspx webpage via the projec… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-12 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt