CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,543 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,239 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2021-34111 | Thecus 4800Eco was discovered to contain a command injection vulnerability via the username parameter in /adm/setmain.php. | In your normal cycle | 9.8 critical | 2.6% | 2022-05-20 |
| CVE-2021-40540 | ulfius_uri_logger in Ulfius HTTP Framework before 2.7.4 omits con_info initialization and a con_info->request NULL check for certain malformed HTTP re… | In your normal cycle | 9.8 critical | 2.6% | 2021-09-07 |
| CVE-2022-24673 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Canon imageCLASS MF644Cdw 10.02 printers. Authentica… | In your normal cycle | 9.8 critical | 2.6% | 2023-03-28 |
| CVE-2022-26289 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/exeCommand. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2022-26290 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/WriteFacMac. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2022-26536 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2022-27076 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2022-27077 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2022-27078 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setAdInfoDetail. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2022-27079 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setPicListItem. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2022-27080 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setWorkmode. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2022-27081 | Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/SetLanInfo. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-24 |
| CVE-2026-7840 | UltraVNC repeater through 1.8.2.2 contains a global buffer overflow in its embedded HTTP administration server. The functions wi_senderr() and wi_repl… | In your normal cycle | 9.8 critical | 2.6% | 2026-07-01 |
| CVE-2019-12147 | The Sangoma Session Border Controller (SBC) 2.3.23-119 GA web interface is vulnerable to Argument Injection via special characters in the username fie… | In your normal cycle | 9.8 critical | 2.6% | 2019-10-22 |
| CVE-2025-22939 | A command injection vulnerability in the telnet service of Adtran 411 ONT L80.00.0011.M2 allows attackers to escalate privileges to root and execute a… | In your normal cycle | 9.8 critical | 2.6% | 2025-03-31 |
| CVE-2021-34458 | Windows Kernel Remote Code Execution Vulnerability | In your normal cycle | 9.9 critical | 2.6% | 2021-07-16 |
| CVE-2017-2922 | An exploitable memory corruption vulnerability exists in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket… | In your normal cycle | 9.8 critical | 2.6% | 2017-11-07 |
| CVE-2017-6900 | An issue was discovered in Riello NetMan 204 14-2 and 15-2. The issue is with the login script and wrongpass Python script used for authentication. Wh… | In your normal cycle | 9.8 critical | 2.6% | 2019-07-03 |
| CVE-2018-0403 | Multiple vulnerabilities in the web-based management interface of Cisco Unified Contact Center Express (Unified CCX) could allow an unauthenticated, r… | In your normal cycle | 9.8 critical | 2.6% | 2018-07-18 |
| CVE-2017-1000039 | Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution | In your normal cycle | 9.8 critical | 2.6% | 2017-07-17 |
| CVE-2019-12450 | file_copy_fallback in gio/gfile.c in GNOME GLib 2.15.0 through 2.61.1 does not properly restrict file permissions while a copy operation is in progres… | In your normal cycle | 9.8 critical | 2.6% | 2019-05-29 |
| CVE-2019-9885 | eClass platform < ip.2.5.10.2.1 allows an attacker to execute SQL command via /admin/academic/studenview_left.php StudentID parameter. | In your normal cycle | 9.8 critical | 2.6% | 2019-07-25 |
| CVE-2022-39198 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.12 and its earlier versions, which could lead to malicious code execution. This issu… | In your normal cycle | 9.8 critical | 2.6% | 2022-10-18 |
| CVE-2021-29922 | library/std/src/net/parser.rs in Rust before 1.53.0 does not properly consider extraneous zero characters at the beginning of an IP address string, wh… | In your normal cycle | 9.1 critical | 2.6% | 2021-08-07 |
| CVE-2022-24665 | PHP Everywhere <= 2.0.3 included functionality that allowed execution of PHP Code Snippets via a WordPress gutenberg block by any user able to edit po… | In your normal cycle | 9.9 critical | 2.6% | 2022-02-16 |
| CVE-2022-28022 | Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delete_item. | In your normal cycle | 9.8 critical | 2.6% | 2022-04-21 |
| CVE-2022-28023 | Purchase Order Management System v1.0 was discovered to contain a SQL injection vulnerability via /purchase_order/classes/Master.php?f=delete_supplier… | In your normal cycle | 9.8 critical | 2.6% | 2022-04-21 |
| CVE-2021-36705 | In ProLink PRC2402M V1.0.18 and older, the set_TR069 function in the adm.cgi binary, accessible with a page parameter value of TR069 contains a trivia… | In your normal cycle | 9.8 critical | 2.6% | 2021-08-06 |
| CVE-2021-36706 | In ProLink PRC2402M V1.0.18 and older, the set_sys_cmd function in the adm.cgi binary, accessible with a page parameter value of sysCMD contains a tri… | In your normal cycle | 9.8 critical | 2.6% | 2021-08-06 |
| CVE-2021-36707 | In ProLink PRC2402M V1.0.18 and older, the set_ledonoff function in the adm.cgi binary, accessible with a page parameter value of ledonoff contains a… | In your normal cycle | 9.8 critical | 2.6% | 2021-08-06 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt