CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
425,548 CVEs
1,779 on KEV
17,545 EPSS ≥ 10%
25,095 with exploits
synced 2026-11-13
197,392 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2026-85046 KEV | Type confusion in V8 in Google Chrome prior to 152.0.7977.82 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML… | Patch first | 8.8 high | 1.8% | 2026-09-03 |
| CVE-2024-7694 KEV | ThreatSonar Anti-Ransomware from TeamT5 does not properly validate the content of uploaded files. Remote attackers with administrator privileges on t… | Patch first | 7.2 high | 1.8% | 2024-08-12 |
| CVE-2026-96656 KEV | Plex Media Server before 1.43.3.10861 allows an admin user to write arbitrary files that may be executed on load. The preference TranscoderH264Options… | Patch first | 7.2 high | 1.8% | 2026-09-23 |
| CVE-2019-1129 KEV | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of… | Patch first | 7.8 high | 1.8% | 2019-07-15 |
| CVE-2026-16812 KEV | VeloCloud Orchestrator (VCO) on-prem has a security issue where this issue may allow a remote attacker to access privileged internal functionality and… | Patch first | 10.0 critical | 1.8% | 2026-07-27 |
| CVE-2025-15556 KEV | Notepad++ versions prior to 8.8.9, when using the WinGUp updater, contain an update integrity verification vulnerability where downloaded update metad… | Patch first | 7.5 high | 1.7% | 2026-02-03 |
| CVE-2024-21287 KEV | Vulnerability in the Oracle Agile PLM Framework product of Oracle Supply Chain (component: Software Development Kit, Process Extension). The support… | Patch first | 7.5 high | 1.7% | 2024-11-18 |
| CVE-2019-1130 KEV | An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation of… | Patch first | 7.8 high | 1.7% | 2019-07-15 |
| CVE-2026-72530 KEV | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, a… | Patch first | 9.0 critical | 1.7% | 2026-08-19 |
| CVE-2025-31277 KEV | The issue was addressed with improved memory handling. This issue is fixed in Safari 18.6, iOS 18.6 and iPadOS 18.6, macOS Sequoia 15.6, tvOS 18.6, vi… | Patch first | 8.8 high | 1.7% | 2025-07-30 |
| CVE-2023-28229 KEV | Windows CNG Key Isolation Service Elevation of Privilege Vulnerability | Patch first | 7.0 high | 1.7% | 2023-04-11 |
| CVE-2026-20700 KEV | A memory corruption issue was addressed with improved state management. This issue is fixed in iOS 26.3 and iPadOS 26.3, macOS Tahoe 26.3, tvOS 26.3,… | Patch first | 7.8 high | 1.7% | 2026-02-11 |
| CVE-2024-38107 KEV | Windows Power Dependency Coordinator Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.6% | 2024-08-13 |
| CVE-2025-22226 KEV | VMware ESXi, Workstation, and Fusion contain an information disclosure vulnerability due to an out-of-bounds read in HGFS. A malicious actor with admi… | Patch first | 7.1 high | 1.6% | 2025-03-04 |
| CVE-2025-24989 KEV | An improper access control vulnerability in Power Pages allows an unauthorized attacker to elevate privileges over a network potentially bypassing the… | Patch first | 8.2 high | 1.6% | 2025-02-19 |
| CVE-2025-39964 KEV | In the Linux kernel, the following vulnerability has been resolved: crypto: af_alg - Disallow concurrent writes in af_alg_sendmsg Issuing two writes… | Patch first | 7.8 high | 1.6% | 2025-10-13 |
| CVE-2026-21514 KEV | Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally. | Patch first | 7.8 high | 1.6% | 2026-02-10 |
| CVE-2025-21334 KEV | Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.6% | 2025-01-14 |
| CVE-2025-22224 KEV | VMware ESXi, and Workstation contain a TOCTOU (Time-of-Check Time-of-Use) vulnerability that leads to an out-of-bounds write. A malicious actor with l… | Patch first | 9.3 critical | 1.6% | 2025-03-04 |
| CVE-2026-67277 KEV | RouterOS accepts a "related" btest connection before the corresponding primary session has completed authentication. An unauthenticated client can use… | Patch first | 8.2 high | 1.6% | 2026-09-05 |
| CVE-2019-8720 KEV | A vulnerability was found in WebKit. The flaw is triggered when processing maliciously crafted web content that may lead to arbitrary code execution.… | Patch first | 8.8 high | 1.6% | 2023-03-06 |
| CVE-2021-1905 KEV | Possible use after free due to improper handling of memory mapping of multiple processes simultaneously. in Snapdragon Auto, Snapdragon Compute, Snapd… | Patch first | 8.4 high | 1.5% | 2021-05-07 |
| CVE-2020-11261 KEV | Memory corruption due to improper check to return error when user application requests memory allocation of a huge size in Snapdragon Auto, Snapdragon… | Patch first | 7.8 high | 1.5% | 2021-06-09 |
| CVE-2021-41357 KEV | Win32k Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.5% | 2021-10-13 |
| CVE-2021-40450 KEV | Win32k Elevation of Privilege Vulnerability | Patch first | 7.8 high | 1.5% | 2021-10-13 |
| CVE-2013-2597 KEV | Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6.x and 3.x, as used in Qualcom… | Patch first | 8.4 high | 1.5% | 2014-08-31 |
| CVE-2021-36742 KEV | A improper input validation vulnerability in Trend Micro Apex One, Apex One as a Service, OfficeScan XG and Worry-Free Business Security 10.0 SP1 allo… | Patch first | 7.8 high | 1.5% | 2021-07-29 |
| CVE-2024-23225 KEV | A memory corruption issue was addressed with improved validation. This issue is fixed in iOS 16.7.6 and iPadOS 16.7.6, iOS 17.4 and iPadOS 17.4, macOS… | Patch first | 7.8 high | 1.5% | 2024-03-05 |
| CVE-2023-20963 KEV | In WorkSource, there is a possible parcel mismatch. This could lead to local escalation of privilege with no additional execution privileges needed. U… | Patch first | 7.8 high | 1.5% | 2023-03-24 |
| CVE-2026-72529 KEV | A remote unauthorized attacker with network access via port 4307/TCP to the TrueConf server versions 5.3.X to 5.3.9, 5.4.X to 5.4.9, 5.5.X to 5.5.5, a… | Patch first | 9.8 critical | 1.5% | 2026-08-19 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt