CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,501 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,238 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-9855 | LibreOffice is typically bundled with LibreLogo, a programmable turtle vector graphics script, which can execute arbitrary python commands contained w… | In your normal cycle | 9.8 critical | 2.6% | 2019-09-06 |
| CVE-2015-1000003 | Blind SQL Injection in filedownload v1.4 wordpress plugin | In your normal cycle | 9.8 critical | 2.6% | 2016-10-06 |
| CVE-2015-1000011 | Blind SQL Injection in wordpress plugin dukapress v2.5.9 | In your normal cycle | 9.8 critical | 2.6% | 2016-10-06 |
| CVE-2018-18995 | Pluto Safety PLC Gateway Ethernet devices ABB GATE-E1 and GATE-E2 all versions do not allow authentication to be configured on administrative telnet o… | In your normal cycle | 9.8 critical | 2.6% | 2019-01-03 |
| CVE-2018-5451 | In Philips Alice 6 System version R8.0.2 or prior, when an actor claims to have a given identity, the software does not prove or insufficiently proves… | In your normal cycle | 9.8 critical | 2.6% | 2018-03-28 |
| CVE-2016-8731 | Hard-coded FTP credentials (r:r) are included in the Foscam C1 running firmware 1.9.1.12. Knowledge of these credentials would allow remote access to… | In your normal cycle | 9.8 critical | 2.6% | 2017-06-21 |
| CVE-2020-29591 | Versions of the Official registry Docker images through 2.7.0 contain a blank password for the root user. Systems deployed using affected versions of… | In your normal cycle | 9.8 critical | 2.6% | 2020-12-11 |
| CVE-2022-35516 | DedeCMS v5.7.93 - v5.7.96 was discovered to contain a remote code execution vulnerability in login.php. | In your normal cycle | 9.8 critical | 2.6% | 2022-08-17 |
| CVE-2020-24753 | A memory corruption vulnerability in Objective Open CBOR Run-time (oocborrt) in versions before 2020-08-12 could allow an attacker to execute code via… | In your normal cycle | 9.8 critical | 2.6% | 2020-09-17 |
| CVE-2015-0537 | Integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite (MES) 4.0.x before 4.0.8 and 4.1.x before 4.1.3, RSA BSAF… | In your normal cycle | 9.8 critical | 2.6% | 2015-08-20 |
| CVE-2019-16377 | The makandra consul gem through 1.0.2 for Ruby has Incorrect Access Control. | In your normal cycle | 9.8 critical | 2.6% | 2019-09-23 |
| CVE-2017-7801 | A use-after-free vulnerability can occur while re-computing layout for a "marquee" element during window resizing where the updated style object is fr… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-11 |
| CVE-2017-7809 | A use-after-free vulnerability can occur when an editor DOM node is deleted prematurely during tree traversal while still bound to the document. This… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-11 |
| CVE-2017-12905 | Server Side Request Forgery vulnerability in Vebto Pixie Image Editor 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary… | In your normal cycle | 10.0 critical | 2.6% | 2017-09-25 |
| CVE-2019-10783 | All versions including 0.0.4 of lsof npm module are vulnerable to Command Injection. Every exported method used by the package uses the exec function… | In your normal cycle | 9.8 critical | 2.6% | 2020-01-29 |
| CVE-2026-85688 | TEN Framework 0.11.71 contains unauthenticated arbitrary file read and write vulnerabilities in the TMAN Designer file-content API endpoints. Attacker… | In your normal cycle | 9.8 critical | 2.6% | 2026-09-04 |
| CVE-2019-10922 | A vulnerability has been identified in SIMATIC PCS 7 V8.0 and earlier (All versions), SIMATIC PCS 7 V8.1 and newer (All versions), SIMATIC WinCC V7.2… | In your normal cycle | 9.8 critical | 2.6% | 2019-05-14 |
| CVE-2019-20790 | OpenDMARC through 1.3.2 and 1.4.x, when used with pypolicyd-spf 2.0.2, allows attacks that bypass SPF and DMARC authentication in situations where the… | In your normal cycle | 9.8 critical | 2.6% | 2020-04-27 |
| CVE-2021-21960 | A stack-based buffer overflow vulnerability exists in both the LLMNR functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-craf… | In your normal cycle | 10.0 critical | 2.6% | 2022-02-04 |
| CVE-2021-21961 | A stack-based buffer overflow vulnerability exists in the NBNS functionality of Sealevel Systems, Inc. SeaConnect 370W v1.3.34. A specially-crafted ne… | In your normal cycle | 10.0 critical | 2.6% | 2022-02-04 |
| CVE-2005-0269 | The file extension check in GNUBoard 3.40 and earlier only verifies extensions that contain all lowercase letters, which allows remote attackers to up… | In your normal cycle | 9.8 critical | 2.6% | 2005-05-02 |
| CVE-2016-1629 | Google Chrome before 48.0.2564.116 allows remote attackers to bypass the Blink Same Origin Policy and a sandbox protection mechanism via unspecified v… | In your normal cycle | 9.8 critical | 2.6% | 2016-02-21 |
| CVE-2026-56265 | Crawl4AI before 0.8.7 contains an authentication bypass vulnerability due to a hardcoded default JWT signing key in the Docker API server. Attackers w… | In your normal cycle | 9.8 critical | 2.6% | 2026-06-21 |
| CVE-2026-30824 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.0.13, the NVIDIA NIM router (/api/v1/nvidi… | In your normal cycle | 9.8 critical | 2.6% | 2026-03-07 |
| CVE-2017-14349 | An authentication vulnerability in HPE SiteScope product versions 11.2x and 11.3x, allows read-only accounts to view all SiteScope interfaces and moni… | In your normal cycle | 9.8 critical | 2.6% | 2017-09-30 |
| CVE-2019-8293 | Due to a logic error in the code, upload-image-with-ajax v1.0 allows arbitrary files to be uploaded to the web root allowing code execution. | In your normal cycle | 9.8 critical | 2.6% | 2019-12-23 |
| CVE-2019-10708 | S-CMS PHP v1.0 has SQL injection via the 4/js/scms.php?action=unlike id parameter. | In your normal cycle | 9.8 critical | 2.6% | 2019-04-02 |
| CVE-2023-20101 | A vulnerability in Cisco Emergency Responder could allow an unauthenticated, remote attacker to log in to an affected device using the root account, w… | In your normal cycle | 9.8 critical | 2.6% | 2023-10-04 |
| CVE-2012-6069 | The CoDeSys Runtime Toolkit’s file transfer functionality does not perform input validation, which allows an attacker to access files and directorie… | In your normal cycle | 10.0 critical | 2.6% | 2013-01-21 |
| CVE-2018-5923 | In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature checking… | In your normal cycle | 9.8 critical | 2.6% | 2019-03-27 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt