CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,330 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,094 with exploits
synced 2026-11-11
217,147 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2024-5910 KEV EXP | Missing authentication for a critical function in Palo Alto Networks Expedition can lead to an Expedition admin account takeover for attackers with ne… | Patch first | 9.8 critical | 91.7% | 2024-07-10 |
| CVE-2018-11138 KEV EXP | The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be ab… | Patch first | 9.8 critical | 91.6% | 2018-05-31 |
| CVE-2012-5076 KEV EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 7 and earlier allows remote attackers to affect c… | Patch first | 9.8 critical | 91.3% | 2012-10-16 |
| CVE-2025-64446 KEV EXP | A relative path traversal vulnerability in Fortinet FortiWeb 8.0.0 through 8.0.1, FortiWeb 7.6.0 through 7.6.4, FortiWeb 7.4.0 through 7.4.9, FortiWeb… | Patch first | 9.8 critical | 91.1% | 2025-11-14 |
| CVE-2017-3066 KEV EXP | Adobe ColdFusion 2016 Update 3 and earlier, ColdFusion 11 update 11 and earlier, ColdFusion 10 Update 22 and earlier have a Java deserialization vulne… | Patch first | 9.8 critical | 90.6% | 2017-04-27 |
| CVE-2020-3952 KEV EXP | Under certain conditions, vmdir that ships with VMware vCenter Server, as part of an embedded or external Platform Services Controller (PSC), does not… | Patch first | 9.8 critical | 90.4% | 2020-04-10 |
| CVE-2009-3960 KEV EXP | Unspecified vulnerability in BlazeDS 3.2 and earlier, as used in LiveCycle 8.0.1, 8.2.1, and 9.0, LiveCycle Data Services 2.5.1, 2.6.1, and 3.0, Flex… | Patch first | 6.5 medium | 90.1% | 2010-02-15 |
| CVE-2026-9082 KEV EXP | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal Drupal core allows SQL Injection. This i… | Patch first | 9.8 critical | 89.4% | 2026-05-20 |
| CVE-2011-2462 KEV EXP | Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.… | Patch first | 9.8 critical | 88.6% | 2011-12-07 |
| CVE-2015-5122 KEV EXP | Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Wi… | Patch first | 9.8 critical | 87% | 2015-07-14 |
| CVE-2020-11652 KEV EXP | An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some metho… | Patch first | 6.5 medium | 86.4% | 2020-04-30 |
| CVE-2019-4716 KEV EXP | IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and the… | Patch first | 9.8 critical | 86.4% | 2019-12-18 |
| CVE-2020-8644 KEV EXP | PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. | Patch first | 9.8 critical | 86.3% | 2020-02-05 |
| CVE-2015-0311 KEV EXP | Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.20… | Patch first | 9.8 critical | 85.6% | 2015-01-23 |
| CVE-2026-48907 KEV EXP | A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in P… | Patch first | 9.8 critical | 85.4% | 2026-06-05 |
| CVE-2020-11023 KEV EXP | In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sani… | Patch first | 6.9 medium | 84.9% | 2020-04-29 |
| CVE-2020-5722 KEV EXP | The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker ca… | Patch first | 9.8 critical | 84.3% | 2020-03-23 |
| CVE-2017-11317 KEV EXP | Telerik.Web.UI in Progress Telerik UI for ASP.NET AJAX before R1 2017 and R2 before R2 2017 SP2 uses weak RadAsyncUpload encryption, which allows remo… | Patch first | 9.8 critical | 84.2% | 2017-08-23 |
| CVE-2020-3161 KEV EXP | A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a… | Patch first | 9.8 critical | 83.9% | 2020-04-15 |
| CVE-2016-10174 KEV EXP | The NETGEAR WNR2000v5 router contains a buffer overflow in the hidden_lang_avi parameter when invoking the URL /apply.cgi?/lang_check.html. This buffe… | Patch first | 9.8 critical | 83.3% | 2017-01-30 |
| CVE-2010-3765 KEV EXP | Mozilla Firefox 3.5.x through 3.5.14 and 3.6.x through 3.6.11, Thunderbird 3.1.6 before 3.1.6 and 3.0.x before 3.0.10, and SeaMonkey 2.x before 2.0.10… | Patch first | 9.8 critical | 83.2% | 2010-10-28 |
| CVE-2015-1187 KEV EXP | The ping tool in multiple D-Link and TRENDnet devices allow remote attackers to execute arbitrary code via the ping_addr parameter to ping.ccp. | Patch first | 9.8 critical | 82.7% | 2017-09-21 |
| CVE-2018-6789 KEV EXP | An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. By sending a handcrafted message, a buffer overflow may ha… | Patch first | 9.8 critical | 82.1% | 2018-02-08 |
| CVE-2018-13382 KEV EXP | An Improper Authorization vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.8 and 5.4.1 to 5.4.10 and FortiProxy 2.0.0, 1.2.0 to 1.2.8, 1… | Patch first | 9.1 critical | 81.7% | 2019-06-04 |
| CVE-2020-14871 KEV EXP | Vulnerability in the Oracle Solaris product of Oracle Systems (component: Pluggable authentication module). Supported versions that are affected are 1… | Patch first | 10.0 critical | 80.2% | 2020-10-21 |
| CVE-2013-4810 KEV EXP | HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attack… | Patch first | 9.8 critical | 79.5% | 2013-09-16 |
| CVE-2013-3346 KEV EXP | Adobe Reader and Acrobat 9.x before 9.5.5, 10.x before 10.1.7, and 11.x before 11.0.03 allow attackers to execute arbitrary code or cause a denial of… | Patch first | 9.8 critical | 78.9% | 2013-08-30 |
| CVE-2017-11357 KEV EXP | Progress Telerik UI for ASP.NET AJAX before R2 2017 SP2 does not properly restrict user input to RadAsyncUpload, which allows remote attackers to perf… | Patch first | 9.8 critical | 77.7% | 2017-08-23 |
| CVE-2016-3718 KEV EXP | The (1) HTTP and (2) FTP coders in ImageMagick before 6.9.3-10 and 7.x before 7.0.1-1 allow remote attackers to conduct server-side request forgery (S… | Patch first | 5.5 medium | 75.7% | 2016-05-05 |
| CVE-2012-0391 KEV EXP | The ExceptionDelegator component in Apache Struts before 2.2.3.1 interprets parameter values as OGNL expressions during certain exception handling for… | Patch first | 9.8 critical | 75.6% | 2012-01-08 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt