Skip to content
Noroxi

CVE databaseCVE tracking.What comes first?

We combine CVSS, CISA KEV and EPSS into a single action score. Pick your stack, filter to what affects you, follow it and get notified on change.

410,762 records · last updated Nov 15, 2026

Action score · 0–100

CVSS
40
Technical severity
KEV
30
Exploited in the wild
EPSS
30
30-day probability

80 and above: now · 60–79: this week · 40–59: plan · below 40: monitor

How is it calculated?
Total records
410,762
Actively exploited (KEV)
1,781
Weaponized
4,439
Fix today
489
Last 7 days
4,803
Vulnerability classes Exploited CVEs by month CVE statistics Import scanner output Banner to CVE Bulk lookup Scan SBOM API Open data

Watch your stack · no account needed

What technologies do you use?

Pick them and we’ll filter the live database down to the CVEs that affect you.

Popular picks

All410,762Actively exploited1,781Last 7 days4,803Weaponized4,439N-day window2,170EPSS rising17
Filters1
Severity
Exploit status
Attack profile · Tags derived automatically from the CVSS vector, CWE and text; pick several and all must match.
More tags
Clear

25 of 10,000+ records

  • CVE-2020-0796
    100Now

    A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain reque

    CriticalCVSS 10.0KEVWeaponizedEPSS 99%

    microsoft · windows 10 1903Mar 12, 2020

  • CVE-2019-0708
    99Now

    A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    microsoft · windows 7May 16, 2019

  • CVE-2025-22457
    99Now

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    ivanti · connect secureApr 3, 2025

  • CVE-2021-20038
    99Now

    A Stack-based buffer overflow vulnerability in SMA100 Apache httpd server's mod_cgi module environment variables allows a remote unauthentic

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    sonicwall · sma 200 firmwareDec 8, 2021

  • CVE-2014-0497
    99Now

    Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 1

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · flash playerFeb 5, 2014

  • CVE-2021-31166
    99Now

    HTTP Protocol Stack Remote Code Execution Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    microsoft · windows 10 2004May 11, 2021

  • CVE-2017-7269
    99Now

    Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows S

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    microsoft · internet information servicesMar 26, 2017

  • CVE-2015-3113
    99Now

    Heap-based buffer overflow in Adobe Flash Player before 13.0.0.296 and 14.x through 18.x before 18.0.0.194 on Windows and OS X and before 11

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    adobe · flash playerJun 23, 2015

  • CVE-2019-11043
    99Now

    Underflow in PHP-FPM can lead to RCE

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    php · phpOct 28, 2019

  • CVE-2023-34048
    99Now

    VMware vCenter Server Out-of-Bounds Write Vulnerability

    CriticalCVSS 9.8KEVWeaponizedEPSS 99%

    vmware · vcenter serverOct 25, 2023

  • CVE-2015-5119
    99Now

    Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    adobe · flash playerJul 8, 2015

  • CVE-2019-5544
    98Now

    OpenSLP as used in ESXi and the Horizon DaaS appliances has a heap overwrite issue.

    CriticalCVSS 9.8KEVWeaponizedEPSS 98%

    openslp · openslpDec 6, 2019

  • CVE-2015-0313
    98Now

    Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through 16.x before 16.0.0.305 on Windows and OS X and before

    CriticalCVSS 9.8KEVWeaponizedEPSS 95%

    adobe · flash playerFeb 2, 2015

  • CVE-2025-5777
    97Now

    NetScaler ADC and NetScaler Gateway - Insufficient input validation leading to memory overread

    CriticalCVSS 9.3KEVWeaponizedEPSS 99%

    citrix · netscaler application delivery controllerJun 17, 2025

  • CVE-2021-35211
    97Now

    Serv-U Remote Memory Escape Vulnerability

    CriticalCVSS 10.0KEVWeaponizedEPSS 91%

    solarwinds · serv-uJul 14, 2021

  • CVE-2026-109618
    96Now

    RCE via OOM corruption

    CriticalCVSS 9.2KEVWeaponizedEPSS 99%

    php · phpOct 21, 2026

  • CVE-2026-109619
    96Now

    RCE via stale global state

    CriticalCVSS 9.2KEVWeaponizedEPSS 99%

    php · phpOct 21, 2026

  • CVE-2025-0282
    96Now

    A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neu

    CriticalCVSS 9.0KEVWeaponizedEPSS 99%

    ivanti · connect secureJan 8, 2025

  • CVE-2011-2462
    96Now

    Unspecified vulnerability in the U3D component in Adobe Reader and Acrobat 10.1.1 and earlier on Windows and Mac OS X, and Adobe Reader 9.x

    CriticalCVSS 9.8KEVWeaponizedEPSS 88%

    adobe · acrobatDec 7, 2011

  • CVE-2023-4863
    95Now

    Heap buffer overflow in libwebp in Google Chrome prior to 116.0.5845.187 and libwebp 1.3.2 allowed a remote attacker to perform an out of bo

    HighCVSS 8.8KEVWeaponizedEPSS 99%

    google · chromeSep 12, 2023

  • CVE-2025-9242
    95Now

    WatchGuard Firebox iked Out of Bounds Write Vulnerability

    CriticalCVSS 9.3KEVWeaponizedEPSS 92%

    watchguard · firewareSep 17, 2025

  • CVE-2015-5122
    95Now

    Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0

    CriticalCVSS 9.8KEVWeaponizedEPSS 87%

    adobe · flash playerJul 14, 2015

  • CVE-2023-27997
    95Now

    A heap-based buffer overflow vulnerability [CWE-122] in FortiOS version 7.2.4 and below, version 7.0.11 and below, version 6.4.12 and below,

    CriticalCVSS 9.8KEVWeaponizedEPSS 86%

    fortinet · fortiproxyJun 13, 2023

  • CVE-2021-31755
    95Now

    An issue was discovered on Tenda AC11 devices with firmware through 02.03.01.104_CN.

    CriticalCVSS 9.8KEVWeaponizedEPSS 86%

    tenda · ac11 firmwareMay 7, 2021

  • CVE-2018-0798
    94Now

    Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execu

    HighCVSS 8.8KEVWeaponizedEPSS 95%

    microsoft · officeJan 9, 2018

Have a CVE or analysis to share?

Share detection methods, affected versions, or remediation details. Our team reviews every submission and credits you by name.

Contribute