CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,501 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,238 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2017-12424 | In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may le… | In your normal cycle | 9.8 critical | 2.7% | 2017-08-04 |
| CVE-2025-66219 | willitmerge is a command line tool to check if pull requests are mergeable. In versions 0.2.1 and prior, there is a command Injection vulnerability in… | In your normal cycle | 9.8 critical | 2.7% | 2025-11-29 |
| CVE-2014-2294 | Open Web Analytics (OWA) before 1.5.7 allows remote attackers to conduct PHP object injection attacks via a crafted serialized object in the owa_event… | In your normal cycle | 9.8 critical | 2.7% | 2018-04-17 |
| CVE-2016-9125 | Revive Adserver before 3.2.3 suffers from session fixation, by allowing arbitrary session identifiers to be forced and, at the same time, by not inval… | In your normal cycle | 9.8 critical | 2.7% | 2017-03-28 |
| CVE-2018-14809 | Fuji Electric V-Server 4.0.3.0 and prior, A use after free vulnerability has been identified, which may allow remote code execution. | In your normal cycle | 9.8 critical | 2.7% | 2018-09-26 |
| CVE-2025-44868 | Wavlink WL-WN530H4 20220801 was found to contain a command injection vulnerability in the ping_test function of the adm.cgi via the pingIp parameter.… | In your normal cycle | 9.8 critical | 2.7% | 2025-05-02 |
| CVE-2018-3100 | Vulnerability in the Oracle Business Process Management Suite component of Oracle Fusion Middleware (subcomponent: Process Analysis & Discovery). Supp… | In your normal cycle | 9.1 critical | 2.7% | 2018-07-18 |
| CVE-2022-26147 | The Quectel RG502Q-EA modem before 2022-02-23 allow OS Command Injection. | In your normal cycle | 9.8 critical | 2.7% | 2022-06-21 |
| CVE-2024-5988 | Due to an improper input validation, an unauthenticated threat actor can send a malicious message to invoke a local or remote executable and cause a r… | In your normal cycle | 9.8 critical | 2.7% | 2024-06-25 |
| CVE-2022-24651 | sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in PHP code execution t… | In your normal cycle | 9.8 critical | 2.7% | 2022-03-10 |
| CVE-2022-24652 | sentcms 4.0.x allows remote attackers to cause arbitrary file uploads through an unauthorized file upload interface, resulting in php code execution i… | In your normal cycle | 9.8 critical | 2.7% | 2022-03-10 |
| CVE-2019-13197 | Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the URI paths of the web appl… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-13 |
| CVE-2019-13201 | Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the LPD service. This would a… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-13 |
| CVE-2019-13202 | Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by a buffer overflow vulnerability in the okhtmlfile and failhtmlfi… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-13 |
| CVE-2019-13204 | Some Kyocera printers (such as the ECOSYS M5526cdw 2R7_2000.001.701) were affected by multiple buffer overflow vulnerabilities in the IPP service. Thi… | In your normal cycle | 9.8 critical | 2.7% | 2020-03-13 |
| CVE-2017-1000231 | A double-free vulnerability in parse.c in ldns 1.7.0 have unspecified impact and attack vectors. | In your normal cycle | 9.8 critical | 2.7% | 2017-11-17 |
| CVE-2019-15785 | FontForge 20190813 through 20190820 has a buffer overflow in PrefsUI_LoadPrefs in prefs.c. | In your normal cycle | 9.8 critical | 2.7% | 2019-08-29 |
| CVE-2026-41247 | elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.67, elFinder contains a command injection vulnera… | In your normal cycle | 9.8 critical | 2.7% | 2026-04-23 |
| CVE-2026-48687 | FastNetMon Community Edition through 1.2.9 contains an OS command injection vulnerability in the Juniper router integration plugin. The _log() functio… | In your normal cycle | 9.8 critical | 2.7% | 2026-05-26 |
| CVE-2019-18339 | A vulnerability has been identified in SiNVR/SiVMS Video Server (All versions < V5.0.0). The HTTP service (default port 5401/tcp) of the SiVMS/SiNVR V… | In your normal cycle | 9.8 critical | 2.7% | 2019-12-12 |
| CVE-2018-14360 | An issue was discovered in NeoMutt before 2018-07-16. nntp_add_group in newsrc.c has a stack-based buffer overflow because of incorrect sscanf usage. | In your normal cycle | 9.8 critical | 2.7% | 2018-07-17 |
| CVE-2020-25189 | The affected product is vulnerable to three stack-based buffer overflows, which may allow an unauthenticated attacker to remotely execute arbitrary co… | In your normal cycle | 9.8 critical | 2.7% | 2020-11-21 |
| CVE-2025-54857 | Improper neutralization of special elements used in an OS command ('OS Command Injection') issue exists in SkyBridge BASIC MB-A130 Ver.1.5.8 and earli… | In your normal cycle | 9.8 critical | 2.7% | 2025-09-01 |
| CVE-2025-30216 | CryptoLib provides a software-only solution using the CCSDS Space Data Link Security Protocol - Extended Procedures (SDLS-EP) to secure communications… | In your normal cycle | 9.4 critical | 2.7% | 2025-03-25 |
| CVE-2019-14457 | VIVOTEK IP Camera devices with firmware before 0x20x have a stack-based buffer overflow via a crafted HTTP header. | In your normal cycle | 9.8 critical | 2.6% | 2019-09-10 |
| CVE-2017-14451 | An exploitable out-of-bounds read vulnerability exists in libevm (Ethereum Virtual Machine) of CPP-Ethereum. A specially crafted smart contract code c… | In your normal cycle | 10.0 critical | 2.6% | 2020-12-02 |
| CVE-2020-13442 | A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handl… | In your normal cycle | 9.8 critical | 2.6% | 2020-05-25 |
| CVE-2020-8614 | An issue was discovered on Askey AP4000W TDC_V1.01.003 devices. An attacker can perform Remote Code Execution (RCE) by sending a specially crafted net… | In your normal cycle | 9.8 critical | 2.6% | 2020-02-13 |
| CVE-2020-1647 | On Juniper Networks SRX Series with ICAP (Internet Content Adaptation Protocol) redirect service enabled, a double free vulnerability can lead to a De… | In your normal cycle | 9.8 critical | 2.6% | 2020-07-17 |
| CVE-2020-24133 | A heap buffer overflow vulnerability in the r_asm_swf_disass function of Radare2-extras before commit e74a93c allows attackers to execute arbitrary co… | In your normal cycle | 9.8 critical | 2.6% | 2021-07-14 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt