CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,615 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,255 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-17564 | Path Traversal in FeiFeiCMS v4.0 allows remote attackers to delete arbitrary files by sending a crafted HTTP request to the " Admin/DataAction.class.p… | In your normal cycle | 9.1 critical | 2.6% | 2021-04-22 |
| CVE-2016-6725 | A remote code execution vulnerability in the Qualcomm crypto driver in Android before 2016-11-05 could enable a remote attacker to execute arbitrary c… | In your normal cycle | 9.8 critical | 2.6% | 2016-11-25 |
| CVE-2021-38298 | Zoho ManageEngine ADManager Plus before 7110 is vulnerable to blind XXE. | In your normal cycle | 9.8 critical | 2.6% | 2021-10-07 |
| CVE-2022-25420 | NTT Resonant Incorporated goo blog App Web Application 1.0 is vulnerable to CLRF injection. This vulnerability allows attackers to execute arbitrary c… | In your normal cycle | 9.8 critical | 2.6% | 2022-03-29 |
| CVE-2019-11011 | Akamai CloudTest before 58.30 allows remote code execution. | In your normal cycle | 9.8 critical | 2.6% | 2019-06-21 |
| CVE-2013-1910 | yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Troj… | In your normal cycle | 9.8 critical | 2.6% | 2019-10-31 |
| CVE-2018-16947 | An issue was discovered in OpenAFS before 1.6.23 and 1.8.x before 1.8.2. The backup tape controller (butc) process accepts incoming RPCs but does not… | In your normal cycle | 9.8 critical | 2.6% | 2018-09-12 |
| CVE-2022-23096 | An issue was discovered in the DNS proxy in Connman through 1.40. The TCP server reply implementation lacks a check for the presence of sufficient Hea… | In your normal cycle | 9.1 critical | 2.6% | 2022-01-28 |
| CVE-2022-29354 | An arbitrary file upload vulnerability in the file upload module of Keystone v4.2.1 allows attackers to execute arbitrary code via a crafted file. | In your normal cycle | 9.8 critical | 2.6% | 2022-05-16 |
| CVE-2020-12395 | Mozilla developers and community members reported memory safety bugs present in Firefox 75 and Firefox ESR 68.7. Some of these bugs showed evidence of… | In your normal cycle | 9.8 critical | 2.6% | 2020-05-26 |
| CVE-2018-14054 | A double free exists in the MP4StringProperty class in mp4property.cpp in MP4v2 2.0.0. A dangling pointer is freed again in the destructor once an exc… | In your normal cycle | 9.8 critical | 2.6% | 2018-07-13 |
| CVE-2018-14403 | MP4NameFirstMatches in mp4util.cpp in MP4v2 2.0.0 mishandles substrings of atom names, leading to use of an inappropriate data type for associated ato… | In your normal cycle | 9.8 critical | 2.6% | 2018-07-19 |
| CVE-2022-24984 | Forms generated by JQueryForm.com before 2022-02-05 (if file-upload capability is enabled) allow remote unauthenticated attackers to upload executable… | In your normal cycle | 9.8 critical | 2.6% | 2022-02-16 |
| CVE-2023-27648 | Directory Traversal vulnerability found in T-ME Studios Change Color of Keypad v.1.275.1.277 allows a remote attacker to execute arbitrary code via th… | In your normal cycle | 9.8 critical | 2.6% | 2023-04-14 |
| CVE-2026-5965 | NewSoftOA developed by NewSoft has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands and… | In your normal cycle | 9.8 critical | 2.6% | 2026-04-21 |
| CVE-2026-6349 | The iSherlock developed by HGiga has an OS Command Injection vulnerability, allowing unauthenticated local attackers to inject arbitrary OS commands… | In your normal cycle | 9.8 critical | 2.6% | 2026-04-16 |
| CVE-2018-0112 | A vulnerability in Cisco WebEx Business Suite clients, Cisco WebEx Meetings, and Cisco WebEx Meetings Server could allow an authenticated, remote atta… | In your normal cycle | 9.0 critical | 2.6% | 2018-04-19 |
| CVE-2020-11543 | OpsRamp Gateway before 7.0.0 has a backdoor account vadmin with the password 9vt@f3Vt that allows root SSH access to the server. This issue has been r… | In your normal cycle | 9.8 critical | 2.6% | 2020-04-08 |
| CVE-2018-5195 | Hancom NEO versions 9.6.1.5183 and earlier have a buffer Overflow vulnerability that leads remote attackers to execute arbitrary commands when perform… | In your normal cycle | 9.8 critical | 2.6% | 2018-01-17 |
| CVE-2019-10769 | safer-eval is a npm package to sandbox the he evaluation of code used within the eval function. Affected versions of this package are vulnerable to Ar… | In your normal cycle | 9.8 critical | 2.6% | 2019-12-06 |
| CVE-2021-44093 | A Remote Command Execution vulnerability on the background in zrlog 2.2.2, at the upload avatar function, could bypass the original limit, upload the… | In your normal cycle | 9.8 critical | 2.6% | 2021-11-28 |
| CVE-2017-8992 | HPE has identified a remote privilege escalation vulnerability in HPE CentralView Fraud Risk Management earlier than version CV 6.1. This issue is res… | In your normal cycle | 9.8 critical | 2.6% | 2018-08-06 |
| CVE-2017-0905 | The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Ser… | In your normal cycle | 9.8 critical | 2.6% | 2017-11-13 |
| CVE-2017-0907 | The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery… | In your normal cycle | 9.8 critical | 2.6% | 2017-11-13 |
| CVE-2020-29288 | An SQL injection vulnerability was discovered in Gym Management System In manage_user.php file, GET parameter 'id' is vulnerable. | In your normal cycle | 9.8 critical | 2.6% | 2020-12-02 |
| CVE-2018-18571 | An Incorrect Access Control vulnerability has been identified in Citrix XenMobile Server 10.8.0 before Rolling Patch 6 and 10.9.0 before Rolling Patch… | In your normal cycle | 9.1 critical | 2.6% | 2019-06-05 |
| CVE-2020-27224 | In Eclipse Theia versions up to and including 1.2.0, the Markdown Preview (@theia/preview), can be exploited to execute arbitrary code. | In your normal cycle | 9.6 critical | 2.6% | 2021-02-24 |
| CVE-2014-2048 | The user_openid app in ownCloud Server before 5.0.15 allows remote attackers to obtain access by leveraging an insecure OpenID implementation. | In your normal cycle | 9.8 critical | 2.6% | 2018-03-26 |
| CVE-2021-40247 | SQL injection vulnerability in Sourcecodester Budget and Expense Tracker System v1 by oretnom23, allows attackers to execute arbitrary SQL commands vi… | In your normal cycle | 9.8 critical | 2.6% | 2022-01-21 |
| CVE-2021-46007 | totolink a3100r V5.9c.4577 is vulnerable to os command injection. The backend of a page is executing the "ping" command, and the input field does not… | In your normal cycle | 9.8 critical | 2.6% | 2022-03-30 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt