CVE Explorer.
Every published CVE, ranked the way you should actually patch: KEV first, then anything with a public exploit or an EPSS above ten per cent, then down by CVSS.
424,477 CVEs
1,779 on KEV
17,541 EPSS ≥ 10%
25,094 with exploits
synced 2026-11-11
424,477 results
| CVE | Summary | Priority | CVSS | EPSS | Published |
|---|---|---|---|---|---|
| CVE-2011-2462 KEV EXP | Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x through 9.… | Patch first | 9.8 critical | 88.6% | 2011-12-07 |
| CVE-2014-3120 KEV EXP | The default configuration in Elasticsearch before 1.2 enables dynamic scripting, which allows remote attackers to execute arbitrary MVEL expressions a… | Patch first | 8.1 high | 88.6% | 2014-07-28 |
| CVE-2021-43798 KEV EXP | Grafana is an open-source platform for monitoring and observability. Grafana versions 8.0.0-beta1 through 8.3.0 (except for patched versions) iss vuln… | Patch first | 7.5 high | 88.5% | 2021-12-07 |
| CVE-2018-8174 KEV EXP | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code E… | Patch first | 7.5 high | 88.2% | 2018-05-09 |
| CVE-2010-0188 KEV EXP | Unspecified vulnerability in Adobe Reader and Acrobat 8.x before 8.2.1 and 9.x before 9.3.1 allows attackers to cause a denial of service (application… | Patch first | 7.8 high | 88.1% | 2010-02-22 |
| CVE-2016-6415 KEV EXP | The server IKEv1 implementation in Cisco IOS 12.2 through 12.4 and 15.0 through 15.6, IOS XE through 3.18S, IOS XR 4.3.x and 5.0.x through 5.2.x, and… | Patch first | 7.5 high | 87.7% | 2016-09-19 |
| CVE-2013-3893 KEV EXP | Use-after-free vulnerability in the SetMouseCapture implementation in mshtml.dll in Microsoft Internet Explorer 6 through 11 allows remote attackers t… | Patch first | 8.8 high | 87.6% | 2013-09-18 |
| CVE-2016-6366 KEV EXP | Buffer overflow in Cisco Adaptive Security Appliance (ASA) Software through 9.4.2.3 on ASA 5500, ASA 5500-X, ASA Services Module, ASA 1000V, ASAv, Fir… | Patch first | 8.8 high | 87.6% | 2016-08-18 |
| CVE-2016-9079 KEV EXP | A use-after-free vulnerability in SVG Animation has been discovered. An exploit built on this vulnerability has been discovered in the wild targeting… | Patch first | 7.5 high | 87.4% | 2018-06-11 |
| CVE-2014-6324 KEV EXP | The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,… | Patch first | 8.8 high | 87.3% | 2014-11-18 |
| CVE-2007-5659 KEV EXP | Multiple buffer overflows in Adobe Reader and Acrobat 8.1.1 and earlier allow remote attackers to execute arbitrary code via a PDF file with long argu… | Patch first | 7.8 high | 87.3% | 2008-02-12 |
| CVE-2015-5122 KEV EXP | Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Wi… | Patch first | 9.8 critical | 87% | 2015-07-14 |
| CVE-2013-0640 KEV EXP | Adobe Reader and Acrobat 9.x before 9.5.4, 10.x before 10.1.6, and 11.x before 11.0.02 allow remote attackers to execute arbitrary code or cause a den… | Patch first | 7.8 high | 86.9% | 2013-02-14 |
| CVE-2018-9276 KEV EXP | An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administr… | Patch first | 7.2 high | 86.9% | 2018-07-02 |
| CVE-2020-0674 KEV EXP | A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engin… | Patch first | 7.5 high | 86.9% | 2020-02-11 |
| CVE-2014-4113 KEV EXP | win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Wind… | Patch first | 7.8 high | 86.6% | 2014-10-15 |
| CVE-2015-2426 KEV EXP | Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7… | Patch first | 8.8 high | 86.6% | 2015-07-20 |
| CVE-2009-3459 KEV EXP | Heap-based buffer overflow in Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7, and 9.x before 9.2 allows remote attackers to execute arbit… | Patch first | 8.8 high | 86.5% | 2009-10-13 |
| CVE-2020-11652 KEV EXP | An issue was discovered in SaltStack Salt before 2019.2.4 and 3000 before 3000.2. The salt-master process ClearFuncs class allows access to some metho… | Patch first | 6.5 medium | 86.4% | 2020-04-30 |
| CVE-2019-4716 KEV EXP | IBM Planning Analytics 2.0.0 through 2.0.8 is vulnerable to a configuration overwrite that allows an unauthenticated user to login as "admin", and the… | Patch first | 9.8 critical | 86.4% | 2019-12-18 |
| CVE-2020-8644 KEV EXP | PlaySMS before 1.4.3 does not sanitize inputs from a malicious string. | Patch first | 9.8 critical | 86.3% | 2020-02-05 |
| CVE-2015-0311 KEV EXP | Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and 16.x through 16.0.0.287 on Windows and OS X and through 11.2.20… | Patch first | 9.8 critical | 85.6% | 2015-01-23 |
| CVE-2018-6961 KEV EXP | VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is… | Patch first | 8.1 high | 85.5% | 2018-06-11 |
| CVE-2026-48907 KEV EXP | A vulnerability in the JCE editor extension for Joomla allows the creation of new editor profiles for unauthenticated users, ultimately resulting in P… | Patch first | 9.8 critical | 85.4% | 2026-06-05 |
| CVE-2013-2423 KEV EXP | Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote atta… | Patch first | 3.7 low | 85.2% | 2013-04-17 |
| CVE-2014-0322 KEV EXP | Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving crafted J… | Patch first | 8.8 high | 85.1% | 2014-02-14 |
| CVE-2020-11023 KEV EXP | In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sani… | Patch first | 6.9 medium | 84.9% | 2020-04-29 |
| CVE-2013-3906 KEV EXP | GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and Lync 2010… | Patch first | 7.8 high | 84.9% | 2013-11-06 |
| CVE-2018-17463 KEV EXP | Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via… | Patch first | 8.8 high | 84.6% | 2018-11-14 |
| CVE-2020-5722 KEV EXP | The HTTP interface of the Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. An attacker ca… | Patch first | 9.8 critical | 84.3% | 2020-03-23 |
How to read it
Patch the KEV entries first — those are being exploited in the wild right now — then anything with a public exploit or an EPSS above ten per cent, then work down by CVSS in your normal cycle. That order, not raw CVSS, is what keeps you ahead of what is actually being used against people. The data is drawn daily from NVD, FIRST EPSS, CISA KEV and Exploit-DB.
Watch your own stack → and get told only when something that matters to it moves.
→ all tools · exposure · dns · email · headers · tls · ct · cookies · reputation · security.txt