CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,984 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
217,421 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2019-14470 EXP | cosenary Instagram-PHP-API (aka Instagram PHP API V2), as used in the UserPro plugin through 4.9.32 for WordPress, has XSS via the example/success.php… | Patch early | 6.1 medium | 83% | 2019-09-04 |
| CVE-2018-16763 EXP | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. This can lead to Pre-Auth Remote Code… | Patch early | 9.8 critical | 82.9% | 2018-09-09 |
| CVE-2019-1619 EXP | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to b… | Patch early | 9.8 critical | 82.8% | 2019-06-27 |
| CVE-2006-0003 EXP | Unspecified vulnerability in the RDS.Dataspace ActiveX control, which is contained in ActiveX Data Objects (ADO) and distributed in Microsoft Data Acc… | Patch early | 5.1 medium | 82.8% | 2006-04-12 |
| CVE-2005-0356 EXP | Multiple TCP implementations with Protection Against Wrapped Sequence Numbers (PAWS) with the timestamps option enabled allow remote attackers to caus… | Patch early | 5.0 medium | 82.8% | 2005-05-31 |
| CVE-2020-2230 EXP | Jenkins 2.251 and earlier, LTS 2.235.3 and earlier does not escape the project naming strategy description, resulting in a stored cross-site scripting… | Patch early | 5.4 medium | 82.7% | 2020-08-12 |
| CVE-2017-5817 EXP | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found. | Patch early | 9.8 critical | 82.6% | 2018-02-15 |
| CVE-2021-28164 EXP | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to ac… | Patch early | 5.3 medium | 82.4% | 2021-04-01 |
| CVE-2024-44000 EXP | Insufficiently Protected Credentials vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Authentication Bypass.This issue a… | Patch early | 9.8 critical | 82.3% | 2024-10-20 |
| CVE-2017-2741 EXP | A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D. This vulnerab… | Patch early | 9.8 critical | 82.3% | 2018-01-23 |
| CVE-2018-9995 EXP | TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which ru… | Patch early | 9.8 critical | 82.3% | 2018-04-10 |
| CVE-2009-2521 EXP | Stack consumption vulnerability in the FTP Service in Microsoft Internet Information Services (IIS) 5.0 through 7.0 allows remote authenticated users… | Patch early | 5.0 medium | 82.3% | 2009-09-04 |
| CVE-2017-0038 EXP | gdi32.dll in Graphics Device Interface (GDI) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows S… | Patch early | 5.5 medium | 82.2% | 2017-02-20 |
| CVE-2024-10924 EXP | The Really Simple Security (Free, Pro, and Pro Multisite) plugins for WordPress are vulnerable to authentication bypass in versions 9.0.0 to 9.1.1.1.… | Patch early | 9.8 critical | 82.2% | 2024-11-15 |
| CVE-2014-1510 EXP | The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows rem… | Patch early | 9.8 critical | 82.2% | 2014-03-19 |
| CVE-2012-0053 EXP | protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) e… | Patch early | 4.3 medium | 82.2% | 2012-01-28 |
| CVE-2015-6922 EXP | Kaseya Virtual System Administrator (VSA) 7.x before 7.0.0.33, 8.x before 8.0.0.23, 9.0 before 9.0.0.19, and 9.1 before 9.1.0.9 does not properly requ… | Patch early | 9.8 critical | 82.1% | 2020-02-17 |
| CVE-2016-3087 EXP | Apache Struts 2.3.19 to 2.3.20.2, 2.3.21 to 2.3.24.1, and 2.3.25 to 2.3.28, when Dynamic Method Invocation is enabled, allow remote attackers to execu… | Patch early | 9.8 critical | 81.9% | 2016-06-07 |
| CVE-2021-20034 EXP | An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrar… | Patch early | 9.1 critical | 81.8% | 2021-09-27 |
| CVE-2018-10660 EXP | An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection. | Patch early | 9.8 critical | 81.8% | 2018-06-26 |
| CVE-2014-8516 EXP | Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an… | Patch early | 9.8 critical | 81.7% | 2020-01-03 |
| CVE-2018-5955 EXP | An issue was discovered in GitStack through 2.3.10. User controlled input is not sufficiently filtered, allowing an unauthenticated attacker to add a… | Patch early | 9.8 critical | 81.6% | 2018-01-21 |
| CVE-2019-10092 EXP | In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. An attacker could cause the… | Patch early | 6.1 medium | 81.5% | 2019-09-26 |
| CVE-2024-2054 EXP | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code… | Patch early | 9.8 critical | 81.3% | 2024-03-21 |
| CVE-2013-4212 EXP | Certain getText methods in the ActionSupport controller in Apache Roller before 5.0.2 allow remote attackers to execute arbitrary OGNL expressions via… | Patch early | 6.8 medium | 81.1% | 2013-12-07 |
| CVE-2014-7862 EXP | The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrato… | Patch early | 9.8 critical | 81% | 2018-01-04 |
| CVE-2016-5734 EXP | phpMyAdmin 4.0.x before 4.0.10.16, 4.4.x before 4.4.15.7, and 4.6.x before 4.6.3 does not properly choose delimiters to prevent use of the preg_replac… | Patch early | 9.8 critical | 80.9% | 2016-07-03 |
| CVE-2022-25148 EXP | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter f… | Patch early | 9.8 critical | 80.9% | 2022-02-24 |
| CVE-2024-20419 EXP | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to… | Patch early | 10.0 critical | 80.9% | 2024-07-17 |
| CVE-2007-6203 EXP | Apache HTTP Server 2.0.x and 2.2.x does not sanitize the HTTP Method specifier header from an HTTP request when it is reflected back in a "413 Request… | Patch early | 4.3 medium | 80.7% | 2007-12-03 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt