CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,543 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,239 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2018-0374 | A vulnerability in the Policy Builder database of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to connect directly… | In your normal cycle | 9.8 critical | 2.6% | 2018-07-18 |
| CVE-2018-0376 | A vulnerability in the Policy Builder interface of Cisco Policy Suite before 18.2.0 could allow an unauthenticated, remote attacker to access the Poli… | In your normal cycle | 9.8 critical | 2.6% | 2018-07-18 |
| CVE-2018-0377 | A vulnerability in the Open Systems Gateway initiative (OSGi) interface of Cisco Policy Suite before 18.1.0 could allow an unauthenticated, remote att… | In your normal cycle | 9.8 critical | 2.6% | 2018-07-18 |
| CVE-2017-8297 | A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole "Simple PHP File Manager" component). | In your normal cycle | 9.8 critical | 2.6% | 2017-04-27 |
| CVE-2020-7602 | node-prompt-here through 1.0.1 allows execution of arbitrary commands. The "runCommand()" is called by "getDevices()" function in file "linux/manager.… | In your normal cycle | 9.8 critical | 2.6% | 2020-03-15 |
| CVE-2015-8981 | Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in base/PdfParser.cpp in PoDoFo allows attackers to have unspecified impact v… | In your normal cycle | 9.8 critical | 2.6% | 2017-03-16 |
| CVE-2025-68916 | Riello UPS NetMan 208 Application before 1.12 allows cgi-bin/certsupload.cgi /../ directory traversal for file upload with resultant code execution. | In your normal cycle | 9.1 critical | 2.6% | 2025-12-24 |
| CVE-2019-6258 | D-Link DIR-822 Rev.Bx devices with firmware v.202KRb06 and older allow a buffer overflow via long MacAddress data in a /HNAP1/SetClientInfo HNAP proto… | In your normal cycle | 9.8 critical | 2.6% | 2020-08-18 |
| CVE-2020-37027 | Sickbeard alpha contains a remote command injection vulnerability that allows unauthenticated attackers to execute arbitrary commands through the extr… | In your normal cycle | 9.8 critical | 2.6% | 2026-01-30 |
| CVE-2019-14195 | An issue was discovered in Das U-Boot through 2019.07. There is an unbounded memcpy with unvalidated length at nfs_readlink_reply in the "else" block… | In your normal cycle | 9.8 critical | 2.6% | 2019-07-31 |
| CVE-2018-1000132 | Mercurial version 4.5 and earlier contains a Incorrect Access Control (CWE-285) vulnerability in Protocol server that can result in Unauthorized data… | In your normal cycle | 9.1 critical | 2.6% | 2018-03-14 |
| CVE-2020-7378 | CRIXP OpenCRX version 4.30 and 5.0-20200717 and prior suffers from an unverified password change vulnerability. An attacker who is able to connect to… | In your normal cycle | 9.1 critical | 2.6% | 2020-11-24 |
| CVE-2017-0906 | The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerabilit… | In your normal cycle | 9.8 critical | 2.6% | 2017-11-13 |
| CVE-2017-2869 | An exploitable code execution vulnerability exists in the OpenProducer functionality of Natus Xltek NeuroWorks 8. A specially crafted network packet c… | In your normal cycle | 9.8 critical | 2.6% | 2018-04-05 |
| CVE-2017-7909 | A Use of Client-Side Authentication issue was discovered in Advantech B+B SmartWorx MESR901 firmware versions 1.5.2 and prior. The web interface uses… | In your normal cycle | 9.8 critical | 2.6% | 2017-05-06 |
| CVE-2021-47728 | Selea Targa IP OCR-ANPR Camera contains an unauthenticated command injection vulnerability in utils.php that allows remote attackers to execute arbitr… | In your normal cycle | 9.8 critical | 2.6% | 2025-12-09 |
| CVE-2016-10127 | PySAML2 allows remote attackers to conduct XML external entity (XXE) attacks via a crafted SAML XML request or response. | In your normal cycle | 9.0 critical | 2.6% | 2017-03-03 |
| CVE-2016-0913 | The client in EMC Replication Manager (RM) before 5.5.3.0_01-PatchHotfix, EMC Network Module for Microsoft 3.x, and EMC Networker Module for Microsoft… | In your normal cycle | 9.8 critical | 2.6% | 2016-10-05 |
| CVE-2023-32250 | A flaw was found in the Linux kernel's ksmbd, a high-performance in-kernel SMB server. The specific flaw exists within the processing of SMB2_SESSION_… | In your normal cycle | 9.0 critical | 2.6% | 2023-07-10 |
| CVE-2016-1505 | The filesystem storage backend in Radicale before 1.1 on Windows allows remote attackers to read or write to arbitrary files via a crafted path, as de… | In your normal cycle | 10.0 critical | 2.6% | 2016-02-03 |
| CVE-2020-15917 | common/session.c in Claws Mail before 3.17.6 has a protocol violation because suffix data after STARTTLS is mishandled. | In your normal cycle | 9.8 critical | 2.6% | 2020-07-23 |
| CVE-2020-28144 | Certain Moxa Inc products are affected by an improper restriction of operations in EDR-G903 Series Firmware Version 5.5 or lower, EDR-G902 Series Firm… | In your normal cycle | 9.8 critical | 2.6% | 2021-02-03 |
| CVE-2021-27213 | config.py in pystemon before 2021-02-13 allows code execution via YAML deserialization because SafeLoader and safe_load are not used. | In your normal cycle | 9.8 critical | 2.6% | 2021-02-14 |
| CVE-2026-8450 | HTTP::Daemon versions before 6.17 for Perl allow OS command injection via send_file(). send_file() opens its string argument with Perl's 2-arg open()… | In your normal cycle | 9.1 critical | 2.6% | 2026-05-27 |
| CVE-2020-24193 | A SQL injection vulnerability in login in Sourcecodetester Daily Tracker System 1.0 allows unauthenticated user to execute authentication bypass with… | In your normal cycle | 9.8 critical | 2.6% | 2020-09-03 |
| CVE-2017-12707 | A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior. Opening a maliciously crafted ht… | In your normal cycle | 9.8 critical | 2.6% | 2017-08-25 |
| CVE-2019-4521 | Platform System Manager in IBM Cloud Pak System 2.3 is potentially vulnerable to CVS Injection. A remote attacker could execute arbitrary commands on… | In your normal cycle | 9.8 critical | 2.6% | 2019-12-10 |
| CVE-2019-15753 | In OpenStack os-vif 1.15.x before 1.15.2, and 1.16.0, a hard-coded MAC aging time of 0 disables MAC learning in linuxbridge, forcing obligatory Ethern… | In your normal cycle | 9.1 critical | 2.6% | 2019-08-28 |
| CVE-2026-53976 | OpenChamber 1.11.7 contains a path traversal vulnerability in the file-serving endpoints /api/fs/read, /api/fs/stat, and /api/fs/raw that allows unaut… | In your normal cycle | 9.1 critical | 2.6% | 2026-08-06 |
| CVE-2020-23907 | An issue was discovered in retdec v3.3. In function canSplitFunctionOn() of ir_modifications.cpp, there is a possible out of bounds read due to a heap… | In your normal cycle | 9.8 critical | 2.6% | 2021-04-21 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt