CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,615 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,255 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2012-6451 | Lorex LNC116 and LNC104 IP Cameras have a Remote Authentication Bypass Vulnerability | In your normal cycle | 9.8 critical | 2.6% | 2020-01-24 |
| CVE-2017-14532 | ImageMagick 7.0.7-0 has a NULL Pointer Dereference in TIFFIgnoreTags in coders/tiff.c. | In your normal cycle | 9.8 critical | 2.6% | 2017-09-18 |
| CVE-2017-14626 | ImageMagick 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c. | In your normal cycle | 9.8 critical | 2.6% | 2017-09-21 |
| CVE-2022-30470 | In Afian Filerun 20220202 Changing the "search_tika_path" variable to a custom (and previously uploaded) jar file results in remote code execution in… | In your normal cycle | 9.8 critical | 2.6% | 2022-06-02 |
| CVE-2018-6596 | webhooks/base.py in Anymail (aka django-anymail) before 1.2.1 is prone to a timing attack vulnerability on the WEBHOOK_AUTHORIZATION secret, which all… | In your normal cycle | 9.1 critical | 2.6% | 2018-02-03 |
| CVE-2016-10321 | web2py before 2.14.6 does not properly check if a host is denied before verifying passwords, allowing a remote attacker to perform brute-force attacks… | In your normal cycle | 9.8 critical | 2.6% | 2017-04-10 |
| CVE-2020-8802 | SuiteCRM through 7.11.11 has Incorrect Access Control via action_saveHTMLField Bean Manipulation. | In your normal cycle | 9.8 critical | 2.6% | 2020-02-13 |
| CVE-2023-39007 | /ui/cron/item/open in the Cron component of OPNsense Community Edition before 23.7 and Business Edition before 23.4.2 allows XSS via openAction in app… | In your normal cycle | 9.6 critical | 2.6% | 2023-08-09 |
| CVE-2024-42479 | llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. This vu… | In your normal cycle | 10.0 critical | 2.6% | 2024-08-12 |
| CVE-2017-7357 | Hipchat Server before 2.2.3 allows remote authenticated users with Server Administrator level privileges to execute arbitrary code by importing a file… | In your normal cycle | 9.1 critical | 2.6% | 2017-04-14 |
| CVE-2026-38835 | Tenda W30E V2.0 V16.01.0.21 was found to contain a command injection vulnerability in the formSetUSBPartitionUmount function via the usbPartitionName… | In your normal cycle | 9.8 critical | 2.6% | 2026-04-21 |
| CVE-2022-35619 | D-LINK DIR-818LW A1:DIR818L_FW105b01 was discovered to contain a remote code execution (RCE) vulnerability via the function ssdpcgi_main. | In your normal cycle | 9.8 critical | 2.6% | 2022-08-03 |
| CVE-2022-48522 | In Perl 5.34.0, function S_find_uninit_var in sv.c has a stack-based crash that can lead to remote code execution or local privilege escalation. | In your normal cycle | 9.8 critical | 2.6% | 2023-08-22 |
| CVE-2018-0712 | Command injection vulnerability in LDAP Server in QNAP QTS 4.2.6 build 20171208, QTS 4.3.3 build 20180402, QTS 4.3.4 build 20180413 and their earlier… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-21 |
| CVE-2019-13275 | An issue was discovered in the VeronaLabs wp-statistics plugin before 12.6.7 for WordPress. The v1/hit endpoint of the API, when the non-default "use… | In your normal cycle | 9.8 critical | 2.6% | 2019-07-04 |
| CVE-2020-1026 | A Security Feature Bypass vulnerability exists in the MSR JavaScript Cryptography Library that is caused by multiple bugs in the library’s Elliptic… | In your normal cycle | 9.8 critical | 2.6% | 2020-04-15 |
| CVE-2021-35942 | The wordexp function in the GNU C Library (aka glibc) through 2.33 may crash or read arbitrary memory in parse_param (in posix/wordexp.c) when called… | In your normal cycle | 9.1 critical | 2.6% | 2021-07-22 |
| CVE-2021-32802 | Nextcloud server is an open source, self hosted personal cloud. Nextcloud supports rendering image previews for user provided file content. For some i… | In your normal cycle | 9.3 critical | 2.6% | 2021-09-07 |
| CVE-2021-33575 | The Pixar ruby-jss gem before 1.6.0 allows remote attackers to execute arbitrary code because of the Plist gem's documented behavior of using Marshal.… | In your normal cycle | 9.8 critical | 2.6% | 2021-05-25 |
| CVE-2026-26832 | node-tesseract-ocr is an npm package that provides a Node.js wrapper for Tesseract OCR. In all versions through 2.2.1, the recognize() function in src… | In your normal cycle | 9.8 critical | 2.6% | 2026-03-25 |
| CVE-2013-3542 | Grandstream GXV3501, GXV3504, GXV3601, GXV3601HD/LL, GXV3611HD/LL, GXV3615W/P, GXV3651FHD, GXV3662HD, GXV3615WP_HD, GXV3500, and possibly other camera… | In your normal cycle | 10.0 critical | 2.6% | 2019-12-11 |
| CVE-2017-14003 | An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versi… | In your normal cycle | 9.8 critical | 2.6% | 2017-10-11 |
| CVE-2017-7126 | An issue was discovered in certain Apple products. macOS before 10.13 is affected. The issue involves the third-party "file" product. Versions before… | In your normal cycle | 9.8 critical | 2.6% | 2017-10-23 |
| CVE-2017-7919 | An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform re… | In your normal cycle | 9.8 critical | 2.6% | 2017-07-03 |
| CVE-2025-23311 | NVIDIA Triton Inference Server contains a vulnerability where an attacker could cause a stack overflow through specially crafted HTTP requests. A succ… | In your normal cycle | 9.8 critical | 2.6% | 2025-08-06 |
| CVE-2016-9639 | Salt before 2015.8.11 allows deleted minions to read or write to minions with the same id, related to caching. | In your normal cycle | 9.1 critical | 2.6% | 2017-02-07 |
| CVE-2018-11106 | NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: W… | In your normal cycle | 9.8 critical | 2.6% | 2020-04-01 |
| CVE-2019-14771 | Backdrop CMS 1.12.x before 1.12.8 and 1.13.x before 1.13.3 allows the upload of entire-site configuration archives through the user interface or comma… | In your normal cycle | 9.8 critical | 2.6% | 2019-08-08 |
| CVE-2022-32224 | A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which… | In your normal cycle | 9.8 critical | 2.6% | 2022-12-05 |
| CVE-2020-17563 | Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to " /index.php?s=/admin-tpl-del&… | In your normal cycle | 9.1 critical | 2.6% | 2021-04-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt