CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
398,692 CVEs
1,728 on KEV
17,267 EPSS ≥ 10%
25,086 with exploits
synced 2026-09-28
36,469 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2016-7866 EXP | Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code… | Patch early | 9.8 critical | 15.8% | 2016-12-15 |
| CVE-2017-3549 EXP | Vulnerability in the Oracle Scripting component of Oracle E-Business Suite (subcomponent: Scripting Administration). Supported versions that are affec… | Patch early | 9.1 critical | 15.8% | 2017-04-24 |
| CVE-2025-4094 EXP | The DIGITS: WordPress Mobile Number Signup and Login WordPress plugin before 8.4.6.1 does not rate limit OTP validation attempts, making it straightfo… | Patch early | 9.8 critical | 15.8% | 2025-05-21 |
| CVE-2021-43136 EXP | An authentication bypass issue in FormaLMS <= 2.4.4 allows an attacker to bypass the authentication mechanism and obtain a valid access to the platfor… | Patch early | 9.8 critical | 15.7% | 2021-11-10 |
| CVE-2017-12965 EXP | Session fixation vulnerability in Apache2Triad 1.5.4 allows remote attackers to hijack web sessions via the PHPSESSID parameter. | Patch early | 9.8 critical | 15.7% | 2017-08-23 |
| CVE-2021-38759 EXP | Raspberry Pi OS through 5.10 has the raspberry default password for the pi account. If not changed, attackers can gain administrator privileges. | Patch early | 9.8 critical | 15.7% | 2021-12-07 |
| CVE-2015-8352 EXP | Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act… | Patch early | 9.8 critical | 15.6% | 2017-08-24 |
| CVE-2017-15580 EXP | osTicket 1.10.1 provides a functionality to upload 'html' files with associated formats. However, it does not properly validate the uploaded file's co… | Patch early | 9.8 critical | 15.6% | 2017-10-23 |
| CVE-2014-6437 EXP | Aztech ADSL DSL5018EN (1T1R), DSL705E, and DSL705EU devices allow remote attackers to obtain sensitive device configuration information via vectors in… | Patch early | 9.8 critical | 15.5% | 2018-01-12 |
| CVE-2022-2651 EXP | Authentication Bypass by Primary Weakness in GitHub repository bookwyrm-social/bookwyrm prior to 0.4.5. | Patch early | 9.8 critical | 15.4% | 2022-08-04 |
| CVE-2022-35583 EXP | wkhtmlTOpdf 0.12.6 is vulnerable to SSRF which allows an attacker to get initial access into the target's system by injecting iframe tag with initial… | Patch early | 9.8 critical | 15.4% | 2022-08-22 |
| CVE-2017-6558 EXP | iball Baton 150M iB-WRA150N v1 00000001 1.2.6 build 110401 Rel.47776n devices are prone to an authentication bypass vulnerability that allows remote a… | Patch early | 9.8 critical | 15.3% | 2017-03-09 |
| CVE-2023-0777 EXP | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. | Patch early | 9.8 critical | 15.2% | 2023-02-10 |
| CVE-2018-11311 EXP | A hardcoded FTP username of myscada and password of Vikuk63 in 'myscadagate.exe' in mySCADA myPRO 7 allows remote attackers to access the FTP server o… | Patch early | 9.1 critical | 15.2% | 2018-05-20 |
| CVE-2007-1383 EXP | Integer overflow in the 16 bit variable reference counter in PHP 4 allows context-dependent attackers to execute arbitrary code by overflowing this co… | Patch early | 9.8 critical | 15.2% | 2007-03-10 |
| CVE-2017-17672 EXP | In vBulletin through 5.3.x, there is an unauthenticated deserialization vulnerability that leads to arbitrary file deletion and, under certain circums… | Patch early | 9.8 critical | 15.2% | 2017-12-14 |
| CVE-2013-6924 EXP | Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip… | Patch early | 9.8 critical | 15.2% | 2017-10-11 |
| CVE-2014-5091 EXP | A vulnerability exits in Status2K 2.5 Server Monitoring Software via the multies parameter to includes/functions.php, which could let a malicious user… | Patch early | 9.8 critical | 15.2% | 2020-02-07 |
| CVE-2018-18322 EXP | CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injection via shell metacharacters in the admin/index.php service_start, service_… | Patch early | 9.8 critical | 15.1% | 2018-10-15 |
| CVE-2015-2780 EXP | Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an execut… | Patch early | 9.8 critical | 15.1% | 2017-10-16 |
| CVE-2019-8024 EXP | Adobe Acrobat and Reader versions 2019.012.20035 and earlier, 2019.012.20035 and earlier, 2017.011.30142 and earlier, 2017.011.30143 and earlier, 2015… | Patch early | 9.8 critical | 15.1% | 2019-08-20 |
| CVE-2016-5228 EXP | Stack-based buffer overflow in the PlayMacro function in ObjectXMacro.ObjectXMacro in WdMacCtl.ocx in Micro Focus Rumba 9.x before 9.3 HF 11997 and 9.… | Patch early | 9.8 critical | 15.1% | 2016-07-03 |
| CVE-2016-3974 EXP | XML external entity (XXE) vulnerability in the Configuration Wizard in SAP NetWeaver Java AS 7.1 through 7.5 allows remote attackers to cause a denial… | Patch early | 9.1 critical | 15.1% | 2016-04-07 |
| CVE-2018-11586 EXP | XML external entity (XXE) vulnerability in api/rest/status in SearchBlox 8.6.7 allows remote unauthenticated users to read arbitrary files or conduct… | Patch early | 9.8 critical | 15% | 2018-06-05 |
| CVE-2023-22855 EXP | Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. It spawns a web interface listening on port 8088. A user-controllable path is… | Patch early | 9.8 critical | 14.8% | 2023-02-15 |
| CVE-2017-14243 EXP | An authentication bypass vulnerability on UTStar WA3002G4 ADSL Broadband Modem WA3002G4-0021.01 devices allows attackers to directly access administra… | Patch early | 9.8 critical | 14.8% | 2017-09-17 |
| CVE-2008-1160 EXP | ZyXEL ZyWALL 1050 has a hard-coded password for the Quagga and Zebra processes that is not changed when it is set by a user, which allows remote attac… | Patch early | 9.8 critical | 14.8% | 2008-03-25 |
| CVE-2002-0083 EXP | Off-by-one error in the channel code of OpenSSH 2.0 through 3.0.2 allows local users or remote malicious servers to gain privileges. | Patch early | 9.8 critical | 14.7% | 2002-03-15 |
| CVE-2026-58138 EXP | Orkes Conductor 3.21.21 before 3.30.2 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute arbitrar… | Patch early | 9.8 critical | 14.7% | 2026-06-30 |
| CVE-2017-6972 EXP | AlienVault USM and OSSIM before 5.3.7 and NfSen before 1.3.8 have an error in privilege dropping and unnecessarily execute the NfSen Perl code as root… | Patch early | 9.8 critical | 14.6% | 2017-03-22 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt