CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,516 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,238 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-10170 | NordVPN 6.12.7.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "nordvpn-service" service. This service establishes… | In your normal cycle | 9.8 critical | 2.6% | 2018-04-16 |
| CVE-2019-6318 | HP LaserJet Enterprise printers, HP PageWide Enterprise printers, HP LaserJet Managed printers, HP Officejet Enterprise printers have an insufficient… | In your normal cycle | 9.8 critical | 2.6% | 2019-04-11 |
| CVE-2021-36159 | libfetch before 2021-07-26, as used in apk-tools, xbps, and other products, mishandles numeric strings for the FTP and HTTP protocols. The FTP passive… | In your normal cycle | 9.1 critical | 2.6% | 2021-08-03 |
| CVE-2019-0187 | Unauthenticated RCE is possible when JMeter is used in distributed mode (-r or -R command line options). Attacker can establish a RMI connection to a… | In your normal cycle | 9.8 critical | 2.6% | 2019-03-06 |
| CVE-2026-101001 | A vulnerability was identified in Netcore NBR200V2 1.3.241127.071246. This impacts the function eval of the file /www/cgi-bin/network_tools of the com… | In your normal cycle | 10.0 critical | 2.6% | 2026-09-28 |
| CVE-2024-0705 | The Stripe Payment Plugin for WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'id' parameter in all versions up to, and includ… | In your normal cycle | 9.8 critical | 2.6% | 2024-01-19 |
| CVE-2018-12268 | acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file, as demonstrated by injection into an s… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-13 |
| CVE-2017-1376 | A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges. IBM X-Force ID: 126873. | In your normal cycle | 9.8 critical | 2.6% | 2017-08-29 |
| CVE-2020-6137 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the password reset pa… | In your normal cycle | 9.8 critical | 2.6% | 2020-09-01 |
| CVE-2020-6138 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The uname parameter in the password reset page /opensis/R… | In your normal cycle | 9.8 critical | 2.6% | 2020-09-01 |
| CVE-2020-6139 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The username_stf_email parameter in the password reset pa… | In your normal cycle | 9.8 critical | 2.6% | 2020-09-01 |
| CVE-2020-6140 | SQL injection vulnerability exists in the password reset functionality of OS4Ed openSIS 7.3. The password_stf_email parameter in the password reset pa… | In your normal cycle | 9.8 critical | 2.6% | 2020-09-01 |
| CVE-2021-24375 | Lack of authentication or validation in motor_load_more, motor_gallery_load_more, motor_quick_view and motor_project_quick_view AJAX handlers of the M… | In your normal cycle | 9.8 critical | 2.6% | 2021-07-06 |
| CVE-2016-6604 | NULL pointer dereference in Samsung Exynos fimg2d driver for Android L(5.0/5.1) and M(6.0) allows attackers to have unspecified impact via unknown vec… | In your normal cycle | 9.8 critical | 2.6% | 2017-01-30 |
| CVE-2018-3934 | An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted set of UD… | In your normal cycle | 9.8 critical | 2.6% | 2018-11-02 |
| CVE-2017-6027 | An Arbitrary File Upload issue was discovered in 3S-Smart Software Solutions GmbH CODESYS Web Server. The following versions of CODESYS Web Server, pa… | In your normal cycle | 9.8 critical | 2.6% | 2017-05-19 |
| CVE-2015-5721 | Malware Information Sharing Platform (MISP) before 2.3.90 allows remote attackers to conduct PHP object injection attacks via crafted serialized data,… | In your normal cycle | 9.8 critical | 2.6% | 2016-09-03 |
| CVE-2024-1374 | A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to… | In your normal cycle | 9.1 critical | 2.6% | 2024-02-13 |
| CVE-2017-5442 | A use-after-free vulnerability during changes in style when manipulating DOM elements. This results in a potentially exploitable crash. This vulnerabi… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-11 |
| CVE-2017-5472 | A use-after-free vulnerability with the frameloader during tree reconstruction while regenerating CSS layout when attempting to use a node in the tree… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-11 |
| CVE-2017-7749 | A use-after-free vulnerability when using an incorrect URL during the reloading of a docshell. This results in a potentially exploitable crash. This v… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-11 |
| CVE-2017-7756 | A use-after-free and use-after-scope vulnerability when logging errors from headers for XML HTTP Requests (XHR). This could result in a potentially ex… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-11 |
| CVE-2017-7757 | A use-after-free vulnerability in IndexedDB when one of its objects is destroyed in memory while a method on it is still being executed. This results… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-11 |
| CVE-2020-25412 | com_line() in command.c in gnuplot 5.4 leads to an out-of-bounds-write from strncpy() that may lead to arbitrary code execution. | In your normal cycle | 9.8 critical | 2.6% | 2020-09-16 |
| CVE-2020-29015 | A blind SQL injection in the user interface of FortiWeb 6.3.0 through 6.3.7 and version before 6.2.4 may allow an unauthenticated, remote attacker to… | In your normal cycle | 9.8 critical | 2.6% | 2021-01-14 |
| CVE-2026-28672 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Ranger. This issue affects Apache Ranger:… | In your normal cycle | 9.8 critical | 2.6% | 2026-08-10 |
| CVE-2016-10722 | partclone.fat in Partclone before 0.2.88 is prone to a heap-based buffer overflow vulnerability due to insufficient validation of the FAT superblock,… | In your normal cycle | 9.8 critical | 2.6% | 2018-05-02 |
| CVE-2018-5703 | The tcp_v6_syn_recv_sock function in net/ipv6/tcp_ipv6.c in the Linux kernel through 4.14.11 allows attackers to cause a denial of service (slab out-o… | In your normal cycle | 9.8 critical | 2.6% | 2018-01-16 |
| CVE-2020-10250 | BWA DiREX-Pro 1.2181 devices allow remote attackers to execute arbitrary OS commands via shell metacharacters in the PKG parameter to uninstall.php3. | In your normal cycle | 9.8 critical | 2.6% | 2020-03-09 |
| CVE-2021-34727 | A vulnerability in the vDaemon process in Cisco IOS XE SD-WAN Software could allow an unauthenticated, remote attacker to cause a buffer overflow on a… | In your normal cycle | 9.8 critical | 2.6% | 2021-09-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt