Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
404,199 CVEs1,739 in CISA KEV17,300 with EPSS ≥ 10%25,052 with a public exploitUpdated 11 October 2026
Known exploited — most recently added
All KEV entries →| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2021-3199 | ONLYOFFICE Docs Server Path Traversal Vulnerability | KEVCRITICAL 9.8EPSS 19.4% | 26 January 2021 |
| CVE-2015-3306 | ProFTPD Improper Access Control Vulnerability | KEVEXPLOIT ×4 ✓CRITICAL 10.0EPSS 99.5% | 18 May 2015 |
| CVE-2015-5477 | ISC BIND Data Processing Errors Vulnerability | KEVEXPLOIT ×2 ✓HIGH 7.5EPSS 99.4% | 29 July 2015 |
| CVE-2023-22894 | Strapi Cleartext Storage of Sensitive Information Vulnerability | KEVMEDIUM 4.9EPSS 3.61% | 19 April 2023 |
| CVE-2016-3081 | Apache Struts Command Injection Vulnerability | KEVEXPLOIT ✓HIGH 8.1EPSS 96.1% | 26 April 2016 |
| CVE-2026-88779 | Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability | KEVHIGH 8.7EPSS 0.59% | 4 October 2026 |
| CVE-2026-102489 | Zammad GmbH Zammad Session Fixation Vulnerability | KEVCRITICAL 9.4EPSS 1.26% | 30 September 2026 |
| CVE-2026-102490 | Zammad GmbH Zammad Improper Privilege Management Vulnerability | KEVCRITICAL 9.4EPSS 0.55% | 30 September 2026 |
Newest public exploits
All with a public exploit →| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-100885 | A vulnerability was found in Krayin laravel-crm up to 2.2.4. | EXPLOITMEDIUM 5.5EPSS 1.00% | 27 September 2026 |
| CVE-2026-87902 | WordPress Core Remote File Inclusion Vulnerability | KEVEXPLOITHIGH 8.1EPSS 40.0% | 22 September 2026 |
| CVE-2026-86060 | MikroTik RouterOS Improper Neutralization of Argument Delimiters in a Command Vulnerability | KEVEXPLOITCRITICAL 9.2EPSS 6.39% | 5 September 2026 |
| CVE-2026-80428 | ILIAS before versions 9.22, 10.10, and 11.3 contains an unauthenticated PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by injecting serialized objects through the LTI authentication endpoint and… | EXPLOITCRITICAL 9.3EPSS 4.67% | 26 August 2026 |
| CVE-2025-57819 | Sangoma FreePBX Authentication Bypass Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 86.3% | 28 August 2025 |
| CVE-2026-59827 | Prior to 1.58.15, 1.59.12, 1.60.6.3, and 1.61.1.4, Metabase instances with an H2 database connection, including the default sample database, deserialize arbitrary Java objects returned in H2 native query result columns of type OTHER without validation,… | EXPLOITHIGH 8.8EPSS 3.79% | 9 July 2026 |
| CVE-2026-39987 | Marimo Remote Code Execution Vulnerability | KEVEXPLOITCRITICAL 9.3EPSS 37.9% | 9 April 2026 |
| CVE-2025-70336 | A Stored cross-site scripting (XSS) vulnerability in 'Create New Live Item' in PodcastGenerator 3.2.9 allows remote attackers to inject arbitrary script or HTML via the 'TITLE', 'SHORT DESCRIPTION' and 'LONG DESCRIPTION' parameters. | EXPLOITMEDIUM 4.8EPSS 0.55% | 28 January 2026 |
Most likely to be exploited this month
All with EPSS ≥ 10% →| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2025-53770 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 20 July 2025 |
| CVE-2024-7593 | Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 13 August 2024 |
| CVE-2024-3400 | Palo Alto Networks PAN-OS Command Injection Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 100.0% | 12 April 2024 |
| CVE-2024-23897 | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 24 January 2024 |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | KEVHIGH 8.2EPSS 100.0% | 31 January 2024 |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | KEVCRITICAL 9.1EPSS 100.0% | 12 January 2024 |
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | KEVHIGH 7.5EPSS 100.0% | 10 October 2023 |
| CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability | KEVEXPLOITHIGH 7.5EPSS 100.0% | 10 October 2023 |
Newest CVEs
Browse everything →| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-108544 | A vulnerability was identified in Lippu Docx Reader Office Viewer App up to 1.4.5 on Android. | MEDIUM 5.3EPSS — | 11 October 2026 |
| CVE-2026-108543 | A vulnerability was determined in ag2ai ag2 up to 0.13.4. | LOW 2.1EPSS — | 11 October 2026 |
| CVE-2026-108542 | A vulnerability was found in 021is elvix-sdk up to 0.10.1. | LOW 2.1EPSS — | 11 October 2026 |
| CVE-2026-97183 | The WP-Invoice WordPress plugin through 4.3.1 does not perform capability checks in several of its AJAX handlers, allowing any authenticated user, such as a Subscriber, to retrieve the email addresses, display names and profile details of all registered… | UnscoredEPSS — | 11 October 2026 |
| CVE-2026-96227 | The Piotnet Forms WordPress plugin through 1.0.30 does not authenticate or validate a form-submission file-upload request and permits browser-renderable file types to be stored, allowing unauthenticated attackers to store a file that executes arbitrary… | UnscoredEPSS — | 11 October 2026 |
| CVE-2026-94235 | The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its… | UnscoredEPSS — | 11 October 2026 |
| CVE-2026-93550 | The Veeqo for WooCommerce WordPress plugin through 2.2.8 does not restrict who can trigger its remote bridge-installation process or validate the URL it is given before downloading and extracting it, allowing users with Subscriber-level access and above… | UnscoredEPSS — | 11 October 2026 |
| CVE-2026-91829 | The Subscribe to Comments WordPress plugin before 2.3.3 does not properly validate a parameter before reflecting it into a link target, allowing unauthenticated attackers to perform Reflected Cross-Site Scripting via a crafted URL against anyone who… | UnscoredEPSS — | 11 October 2026 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.