CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,432 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,235 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2025-55037 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in TkEasyGUI versions prior to v1.0.22. If thi… | In your normal cycle | 9.8 critical | 2.7% | 2025-09-05 |
| CVE-2018-4031 | An exploitable vulnerability exists in the safe browsing function of the CUJO Smart Firewall, version 7003. The flaw lies in the way the safe browsing… | In your normal cycle | 10.0 critical | 2.7% | 2019-10-31 |
| CVE-2017-8988 | A Remote Bypass of Security Restrictions vulnerability was identified in HPE XP Command View Advanced Edition Software Earlier than 8.5.3-00. The vuln… | In your normal cycle | 9.8 critical | 2.7% | 2018-08-06 |
| CVE-2026-8713 | The Avada (Fusion) Builder plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the maybe_delete_… | In your normal cycle | 9.1 critical | 2.7% | 2026-06-19 |
| CVE-2018-3294 | Vulnerability in the Oracle VM VirtualBox component of Oracle Virtualization (subcomponent: Core). The supported version that is affected is Prior to… | In your normal cycle | 9.0 critical | 2.7% | 2018-10-17 |
| CVE-2017-10912 | Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217. | In your normal cycle | 10.0 critical | 2.7% | 2017-07-05 |
| CVE-2018-9208 | Unauthenticated arbitrary file upload vulnerability in jQuery Picture Cut <= v1.1Beta | In your normal cycle | 9.8 critical | 2.7% | 2018-11-05 |
| CVE-2017-9426 | ws.php in the Facetag extension 0.0.3 for Piwigo allows SQL injection via the imageId parameter in a facetag.changeTag or facetag.listTags action. | In your normal cycle | 9.8 critical | 2.7% | 2018-02-26 |
| CVE-2022-28890 | A vulnerability in the RDF/XML parser of Apache Jena allows an attacker to cause an external DTD to be retrieved. This issue affects Apache Jena versi… | In your normal cycle | 9.8 critical | 2.7% | 2022-05-05 |
| CVE-2022-29351 | An arbitrary file upload vulnerability in the file upload module of Tiddlywiki5 v5.2.2 allows attackers to execute arbitrary code via a crafted SVG fi… | In your normal cycle | 9.8 critical | 2.7% | 2022-05-16 |
| CVE-2019-5391 | A stack buffer overflow vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09. | In your normal cycle | 9.8 critical | 2.7% | 2019-06-05 |
| CVE-2020-24030 | ForLogic Qualiex v1 and v3 has weak token expiration. This allows remote unauthenticated privilege escalation and access to sensitive data via token r… | In your normal cycle | 9.8 critical | 2.7% | 2020-09-02 |
| CVE-2017-7779 | Memory safety bugs were reported in Firefox 54, Firefox ESR 52.2, and Thunderbird 52.2. Some of these bugs showed evidence of memory corruption and we… | In your normal cycle | 9.8 critical | 2.7% | 2018-06-11 |
| CVE-2014-3449 | BSS Continuity CMS 4.2.22640.0 has an Authentication Bypass vulnerability | In your normal cycle | 9.8 critical | 2.7% | 2020-01-09 |
| CVE-2002-2119 | Novell eDirectory 8.6.2 and 8.7 use case insensitive passwords, which makes it easier for remote attackers to conduct brute force password guessing. | In your normal cycle | 9.8 critical | 2.7% | 2002-12-31 |
| CVE-2017-1000421 | Gifsicle gifview 1.89 and older is vulnerable to a use-after-free in the read_gif function resulting potential code execution | In your normal cycle | 9.8 critical | 2.7% | 2018-01-02 |
| CVE-2018-13347 | mpatch.c in Mercurial before 4.6.1 mishandles integer addition and subtraction, aka OVE-20180430-0002. | In your normal cycle | 9.8 critical | 2.7% | 2018-07-06 |
| CVE-2021-30642 | An input validation flaw in the Symantec Security Analytics web UI 7.2 prior 7.2.7, 8.1, prior to 8.1.3-NSR3, 8.2, prior to 8.2.1-NSR2 or 8.2.2 allows… | In your normal cycle | 9.8 critical | 2.7% | 2021-04-27 |
| CVE-2011-2195 | A flaw was found in WebSVN 2.3.2. Without prior authentication, if the 'allowDownload' option is enabled in config.php, an attacker can invoke the dl.… | In your normal cycle | 9.8 critical | 2.7% | 2021-10-26 |
| CVE-2022-27596 | A vulnerability has been reported to affect QNAP device running QuTS hero, QTS. If exploited, this vulnerability allows remote attackers to inject mal… | In your normal cycle | 9.8 critical | 2.7% | 2023-01-30 |
| CVE-2026-93674 | IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote attacker to execute arbitrary code due to improper neutralization of special elements used… | In your normal cycle | 9.8 critical | 2.7% | 2026-10-07 |
| CVE-2020-36328 | A flaw was found in libwebp in versions before 1.0.1. A heap-based buffer overflow in function WebPDecodeRGBInto is possible due to an invalid check f… | In your normal cycle | 9.8 critical | 2.7% | 2021-05-21 |
| CVE-2019-14200 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: rpc_lookup_re… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-31 |
| CVE-2019-14201 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_lookup_re… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-31 |
| CVE-2019-14202 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_readlink_… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-31 |
| CVE-2019-14203 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_mount_rep… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-31 |
| CVE-2019-14204 | An issue was discovered in Das U-Boot through 2019.07. There is a stack-based buffer overflow in this nfs_handler reply helper function: nfs_umountall… | In your normal cycle | 9.8 critical | 2.7% | 2019-07-31 |
| CVE-2026-28289 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. A patch bypass vulnerability for CVE-2026-27636 in FreeScout 1.8.20… | In your normal cycle | 10.0 critical | 2.7% | 2026-03-03 |
| CVE-2019-12550 | WAGO 852-303 before FW06, 852-1305 before FW06, and 852-1505 before FW03 devices contain hardcoded users and passwords that can be used to login via S… | In your normal cycle | 9.8 critical | 2.7% | 2019-06-17 |
| CVE-2019-16190 | SharePort Web Access on D-Link DIR-868L REVB through 2.03, DIR-885L REVA through 1.20, and DIR-895L REVA through 1.21 devices allows Authentication By… | In your normal cycle | 9.8 critical | 2.7% | 2019-09-09 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt