CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,432 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,235 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-7103 | An issue was discovered in certain Apple products. iOS before 11 is affected. tvOS before 11 is affected. watchOS before 4 is affected. The issue invo… | In your normal cycle | 9.8 critical | 2.7% | 2017-10-23 |
| CVE-2018-13821 | A lack of authentication, in CA Unified Infrastructure Management 8.5.1, 8.5, and 8.4.7, allows remote attackers to conduct a variety of attacks, incl… | In your normal cycle | 9.8 critical | 2.7% | 2018-08-30 |
| CVE-2020-0225 | In a2dp_vendor_ldac_decoder_decode_packet of a2dp_vendor_ldac_decoder.cc, there is a possible out of bounds write due to a missing bounds check. This… | In your normal cycle | 9.8 critical | 2.7% | 2020-07-17 |
| CVE-2011-4889 | The javax.naming.directory.AttributeInUseException class in the Virtual Member Manager in IBM WebSphere Application Server (WAS) 6.1 before 6.1.0.43,… | In your normal cycle | 9.8 critical | 2.7% | 2018-02-08 |
| CVE-2023-41544 | SSTI injection vulnerability in jeecg-boot version 3.5.3, allows remote attackers to execute arbitrary code via crafted HTTP request to the /jmreport/… | In your normal cycle | 9.8 critical | 2.7% | 2023-12-30 |
| CVE-2014-0931 | Multiple XML external entity (XXE) vulnerabilities in the (1) CCRC WAN Server / CM Server, (2) Perl CC/CQ integration trigger scripts, (3) CMAPI Java… | In your normal cycle | 9.1 critical | 2.7% | 2018-04-20 |
| CVE-2023-30192 | Prestashop possearchproducts 1.7 is vulnerable to SQL Injection via PosSearch::find(). | In your normal cycle | 9.8 critical | 2.7% | 2023-05-12 |
| CVE-2018-1383 | A software logic bug creates a vulnerability in an AIX 6.1, 7.1, and 7.2 daemon which could allow a user with root privileges on one system, to obtain… | In your normal cycle | 9.1 critical | 2.7% | 2018-02-13 |
| CVE-2017-7802 | A use-after-free vulnerability can occur when manipulating the DOM during the resize event of an image element. If these elements have been freed due… | In your normal cycle | 9.8 critical | 2.7% | 2018-06-11 |
| CVE-2020-18758 | An issue in Dut Computer Control Engineering Co.'s PLC MAC1100 allows attackers to execute arbitrary code. | In your normal cycle | 9.8 critical | 2.7% | 2021-08-13 |
| CVE-2020-1952 | An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2. When starting IoTDB, the JMX port 31999 is exposed with no certification.Then, cl… | In your normal cycle | 9.8 critical | 2.7% | 2020-04-27 |
| CVE-2018-5459 | An Improper Authentication issue was discovered in WAGO PFC200 Series 3S CoDeSys Runtime versions 2.3.X and 2.4.X. An attacker can execute different u… | In your normal cycle | 9.8 critical | 2.7% | 2018-02-13 |
| CVE-2021-42897 | A remote command execution (RCE) vulnerability was found in FeMiner wms V1.0 in /wms/src/system/datarec.php. The $_POST[r_name] is directly passed int… | In your normal cycle | 9.8 critical | 2.7% | 2022-05-16 |
| CVE-2019-11830 | PharMetaDataInterceptor in the PharStreamWrapper (aka phar-stream-wrapper) package 2.x before 2.1.1 and 3.x before 3.1.1 for TYPO3 mishandles Phar stu… | In your normal cycle | 9.8 critical | 2.7% | 2019-05-09 |
| CVE-2013-1607 | Ruby PDFKit gem prior to 0.5.3 has a Code Execution Vulnerability | In your normal cycle | 9.8 critical | 2.7% | 2020-02-11 |
| CVE-2020-15683 | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of… | In your normal cycle | 9.8 critical | 2.7% | 2020-10-22 |
| CVE-2018-10511 | A vulnerability in Trend Micro Control Manager (versions 6.0 and 7.0) could allow an attacker to conduct a server-side request forgery (SSRF) attack o… | In your normal cycle | 10.0 critical | 2.7% | 2018-08-15 |
| CVE-2017-5624 | An issue was discovered in OxygenOS before 4.0.3 for OnePlus 3 and 3T. The attacker can persistently make the (locked) bootloader start the platform w… | In your normal cycle | 9.8 critical | 2.7% | 2017-03-12 |
| CVE-2019-18323 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could c… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2019-18324 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cau… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2019-18325 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cau… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2019-18326 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cau… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2019-18327 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cau… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2019-18328 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cau… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2019-18329 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server can cau… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2019-18330 | A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server (All versions). An attacker with network access to the MS3000 Server could c… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2019-5160 | An exploitable improper host validation vulnerability exists in the Cloud Connectivity functionality of WAGO PFC200 Firmware versions 03.02.02(14), 03… | In your normal cycle | 9.1 critical | 2.7% | 2020-03-11 |
| CVE-2019-7743 | An issue was discovered in Joomla! before 3.9.3. The phar:// stream wrapper can be used for objection injection attacks because there is no protection… | In your normal cycle | 9.8 critical | 2.7% | 2019-02-12 |
| CVE-2020-11789 | Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84, R6700 before 1.0.2.8,… | In your normal cycle | 9.8 critical | 2.7% | 2020-04-15 |
| CVE-2018-16771 | Hoosk v1.7.0 allows PHP code execution via a SiteUrl that is provided during installation and mishandled in config.php. | In your normal cycle | 9.8 critical | 2.7% | 2018-09-10 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt