CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
407,798 CVEs
1,741 on KEV
17,302 EPSS ≥ 10%
25,091 with exploits
synced 2026-10-14
37,273 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2020-24791 | FUEL CMS 1.4.8 allows SQL injection via the 'fuel_replace_id' parameter in pages/replace/1. Exploiting this issue could allow an attacker to compromis… | In your normal cycle | 9.8 critical | 2.6% | 2021-03-10 |
| CVE-2020-25020 | MPXJ through 8.1.3 allows XXE attacks. This affects the GanttProjectReader and PhoenixReader components. | In your normal cycle | 9.8 critical | 2.6% | 2020-08-29 |
| CVE-2017-7375 | A flaw in libxml2 allows remote XML entity inclusion with default parser flags (i.e., when the caller did not request entity substitution, DTD validat… | In your normal cycle | 9.8 critical | 2.6% | 2018-02-19 |
| CVE-2024-28038 | The web interface of the affected devices processes a cookie value improperly, leading to a stack buffer overflow. More precisely, giving too long cha… | In your normal cycle | 9.0 critical | 2.6% | 2024-11-26 |
| CVE-2018-20399 | Motorola SBG901 SBG901-2.10.1.1-GA-00-581-NOSH, SBG941 SBG941-2.11.0.0-GA-07-624-NOSH, and SVG1202 SVG1202-2.1.0.0-GA-14-LTSH devices allow remote att… | In your normal cycle | 9.8 critical | 2.6% | 2018-12-23 |
| CVE-2017-14695 | Directory traversal vulnerability in minion id validation in SaltStack Salt before 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2… | In your normal cycle | 9.8 critical | 2.6% | 2017-10-24 |
| CVE-2017-16724 | A Stack-based Buffer Overflow issue was discovered in Advantech WebAccess versions prior to 8.3. There are multiple instances of a vulnerability that… | In your normal cycle | 9.8 critical | 2.6% | 2018-01-05 |
| CVE-2018-17174 | A stack-based buffer overflow was discovered in the xtimor NMEA library (aka nmealib) 0.5.3. nmea_parse() in parser.c allows an attacker to trigger de… | In your normal cycle | 9.8 critical | 2.6% | 2018-09-21 |
| CVE-2019-19617 | phpMyAdmin before 4.9.2 does not escape certain Git information, related to libraries/classes/Display/GitRevision.php and libraries/classes/Footer.php… | In your normal cycle | 9.8 critical | 2.6% | 2019-12-06 |
| CVE-2018-10191 | In versions of mruby up to and including 1.4.0, an integer overflow exists in src/vm.c::mrb_vm_exec() when handling OP_GETUPVAR in the presence of dee… | In your normal cycle | 9.8 critical | 2.6% | 2018-04-17 |
| CVE-2022-24305 | Zoho ManageEngine SharePoint Manager Plus before 4329 is vulnerable to a sensitive data leak that leads to privilege escalation. | In your normal cycle | 9.8 critical | 2.6% | 2022-03-02 |
| CVE-2025-4334 | The Simple User Registration plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 6.3. This is due to insu… | In your normal cycle | 9.8 critical | 2.6% | 2025-06-26 |
| CVE-2024-5057 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Easy Digital Downloads allows SQL Injection.This… | In your normal cycle | 9.3 critical | 2.6% | 2024-08-29 |
| CVE-2017-9664 | In ABB SREA-01 revisions A, B, C: application versions up to 3.31.5, and SREA-50 revision A: application versions up to 3.32.8, an attacker may access… | In your normal cycle | 9.8 critical | 2.6% | 2018-05-24 |
| CVE-2020-21523 | A Server-Side Freemarker template injection vulnerability in halo CMS v1.1.3 In the Edit Theme File function. The ftl file can be edited. This is the… | In your normal cycle | 9.8 critical | 2.6% | 2020-09-30 |
| CVE-2020-11536 | An issue was discovered in ONLYOFFICE Document Server 5.5.0. An attacker can craft a malicious .docx file, and exploit the unzip function to rewrite a… | In your normal cycle | 9.8 critical | 2.6% | 2020-04-15 |
| CVE-2014-10072 | In utils.c in zsh before 5.0.6, there is a buffer overflow when scanning very long directory paths for symbolic links. | In your normal cycle | 9.8 critical | 2.6% | 2018-02-27 |
| CVE-2021-43899 | Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability | In your normal cycle | 9.8 critical | 2.6% | 2021-12-15 |
| CVE-2024-32700 | Unrestricted Upload of File with Dangerous Type vulnerability in Kognetiks Kognetiks Chatbot for WordPress.This issue affects Kognetiks Chatbot for Wo… | In your normal cycle | 10.0 critical | 2.6% | 2024-05-14 |
| CVE-2022-23884 | Mojang Bedrock Dedicated Server 1.18.2 is affected by an integer overflow leading to a bound check bypass caused by PurchaseReceiptPacket::_read (pack… | In your normal cycle | 9.8 critical | 2.6% | 2022-03-28 |
| CVE-2021-26918 | The ProBot bot through 2021-02-08 for Discord might allow attackers to interfere with the intended purpose of the "Send an image when a user joins the… | In your normal cycle | 9.8 critical | 2.6% | 2021-02-09 |
| CVE-2019-19725 | sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c. | In your normal cycle | 9.8 critical | 2.6% | 2019-12-11 |
| CVE-2022-37021 | Apache Geode versions up to 1.12.5, 1.13.4 and 1.14.0 are vulnerable to a deserialization of untrusted data flaw when using JMX over RMI on Java 8. An… | In your normal cycle | 9.8 critical | 2.6% | 2022-08-31 |
| CVE-2020-3158 | A vulnerability in the High Availability (HA) service of Cisco Smart Software Manager On-Prem could allow an unauthenticated, remote attacker to acces… | In your normal cycle | 9.1 critical | 2.6% | 2020-02-19 |
| CVE-2020-13901 | An issue was discovered in janus-gateway (aka Janus WebRTC Server) through 0.10.0. janus_sdp_merge in sdp.c has a stack-based buffer overflow. | In your normal cycle | 9.8 critical | 2.6% | 2020-06-10 |
| CVE-2017-9052 | An issue, also known as DW201703-006, was discovered in libdwarf 2017-03-21. A heap-based buffer over-read in dwarf_formsdata() is due to a failure to… | In your normal cycle | 9.8 critical | 2.6% | 2017-05-18 |
| CVE-2018-9246 | The PGObject::Util::DBAdmin module before 0.120.0 for Perl, as used in LedgerSMB through 1.5.x, insufficiently sanitizes or escapes variable values us… | In your normal cycle | 9.8 critical | 2.6% | 2018-06-08 |
| CVE-2019-13575 | A SQL injection vulnerability exists in WPEverest Everest Forms plugin for WordPress through 1.4.9. Successful exploitation of this vulnerability woul… | In your normal cycle | 9.8 critical | 2.6% | 2019-07-18 |
| CVE-2018-18892 | MiniCMS 1.10 allows execution of arbitrary PHP code via the install.php sitename parameter, which affects the site_name field in mc_conf.php. | In your normal cycle | 9.8 critical | 2.6% | 2018-11-01 |
| CVE-2016-6536 | The /setup URI on AVer Information EH6108H+ devices with firmware X9.03.24.00.07l allows remote attackers to bypass intended page-access restrictions… | In your normal cycle | 9.8 critical | 2.6% | 2016-09-19 |
← previous page 334 of 334
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt