Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,669 CVEs1,716 in CISA KEV17,392 with EPSS ≥ 10%25,049 with a public exploitUpdated 21 September 2026
25,049 results · page 42 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2019-13272 | Linux Kernel Improper Privilege Management Vulnerability | KEVEXPLOIT ×4 ✓HIGH 7.8EPSS 52.2% | 17 July 2019 |
| CVE-2019-13623 | In NSA Ghidra before 9.1, path traversal can occur in RestoreTask.java (from the package ghidra.app.plugin.core.archive) via an archive with an executable file that has an initial ../ in its filename. | EXPLOIT ✓HIGH 7.8EPSS 4.96% | 17 July 2019 |
| CVE-2019-13359 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user. | EXPLOITHIGH 7.5EPSS 25.8% | 16 July 2019 |
| CVE-2019-12991 | Citrix SD-WAN and NetScaler Command Injection Vulnerability | KEVEXPLOIT ✓HIGH 8.8EPSS 74.1% | 16 July 2019 |
| CVE-2019-12989 | Citrix SD-WAN and NetScaler SQL Injection Vulnerability | KEVEXPLOIT ✓CRITICAL 9.8EPSS 94.1% | 16 July 2019 |
| CVE-2019-13605 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.838 to 0.9.8.846, remote attackers can bypass authentication in the login process by leveraging the knowledge of a valid username. | EXPLOITHIGH 8.8EPSS 15.3% | 16 July 2019 |
| CVE-2019-13383 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.846, the Login process allows attackers to check whether a username is valid by reading the HTTP response. | EXPLOITMEDIUM 5.3EPSS 14.2% | 16 July 2019 |
| CVE-2019-13360 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username. | EXPLOITCRITICAL 9.8EPSS 24.4% | 16 July 2019 |
| CVE-2019-1132 | Microsoft Win32k Privilege Escalation Vulnerability | KEVEXPLOITHIGH 7.8EPSS 9.79% | 15 July 2019 |
| CVE-2019-1128 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 16.9% | 15 July 2019 |
| CVE-2019-1127 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 20.6% | 15 July 2019 |
| CVE-2019-1124 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 18.4% | 15 July 2019 |
| CVE-2019-1123 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 16.9% | 15 July 2019 |
| CVE-2019-1122 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 16.9% | 15 July 2019 |
| CVE-2019-1121 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 16.9% | 15 July 2019 |
| CVE-2019-1120 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 16.9% | 15 July 2019 |
| CVE-2019-1119 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 19.4% | 15 July 2019 |
| CVE-2019-1118 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 23.6% | 15 July 2019 |
| CVE-2019-1117 | A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory, aka 'DirectWrite Remote Code Execution Vulnerability'. | EXPLOIT ✓HIGH 8.8EPSS 23.6% | 15 July 2019 |
| CVE-2019-1089 | An elevation of privilege vulnerability exists in rpcss.dll when the RPC service Activation Kernel improperly handles an RPC request. | EXPLOIT ✓HIGH 7.8EPSS 4.91% | 15 July 2019 |
| CVE-2019-13597 | _s_/sprm/_s_/dyn/Player_setScriptFile in Sahi Pro 8.0.0 allows command execution. | EXPLOITCRITICAL 9.8EPSS 14.3% | 14 July 2019 |
| CVE-2019-13494 | nodeimp.exe in Castle Rock SNMPc before 9.0.12.1 and 10.x before 10.0.9 has a stack-based buffer overflow via a long variable string in a Map Objects text file. | EXPLOITHIGH 7.8EPSS 3.89% | 12 July 2019 |
| CVE-2019-13029 | Multiple stored Cross-site scripting (XSS) issues in the admin panel and survey system in REDCap 8 before 8.10.20 and 9 before 9.1.2 allow an attacker to inject arbitrary malicious HTML or JavaScript code into a user's web browser. | EXPLOITMEDIUM 4.8EPSS 2.47% | 11 July 2019 |
| CVE-2019-10349 | A stored cross site scripting vulnerability in Jenkins Dependency Graph Viewer Plugin 0.13 and earlier allowed attackers able to configure jobs in Jenkins to inject arbitrary HTML and JavaScript in the plugin-provided web pages in Jenkins. | EXPLOITMEDIUM 5.4EPSS 3.89% | 11 July 2019 |
| CVE-2018-19571 | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks. | EXPLOIT ×2HIGH 7.7EPSS 28.2% | 10 July 2019 |
| CVE-2019-13396 | FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in… | EXPLOITMEDIUM 5.3EPSS 62.6% | 10 July 2019 |
| CVE-2019-2107 | In ihevcd_parse_pps of ihevcd_parse_headers.c, there is a possible out of bounds write due to a missing bounds check. | EXPLOIT ×2HIGH 8.8EPSS 8.93% | 8 July 2019 |
| CVE-2019-13358 | lib/DocumentToText.php in OpenCats before 0.9.4-3 has XXE that allows remote users to read files on the underlying operating system. | EXPLOITHIGH 7.5EPSS 23.8% | 5 July 2019 |
| CVE-2019-13344 | An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. | EXPLOITMEDIUM 5.3EPSS 45.1% | 5 July 2019 |
| CVE-2019-13294 | AROX School-ERP Pro has a command execution vulnerability. import_stud.php and upload_fille.php do not have session control. | EXPLOITCRITICAL 9.8EPSS 18.8% | 4 July 2019 |
| CVE-2019-13292 | A SQL Injection issue was discovered in webERP 4.15. | EXPLOITCRITICAL 9.8EPSS 9.27% | 4 July 2019 |
| CVE-2018-18326 | DNN (aka DotNetNuke) 9.2 through 9.2.2 incorrectly converts encryption key source values, resulting in lower than expected entropy. | EXPLOIT ✓HIGH 7.5EPSS 54.5% | 3 July 2019 |
| CVE-2018-18325 | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability | KEVEXPLOIT ✓HIGH 7.5EPSS 74.0% | 3 July 2019 |
| CVE-2018-15812 | DNN (aka DotNetNuke) 9.2 through 9.2.1 incorrectly converts encryption key source values, resulting in lower than expected entropy. | EXPLOIT ✓HIGH 7.5EPSS 47.5% | 3 July 2019 |
| CVE-2018-15811 | DotNetNuke (DNN) Inadequate Encryption Strength Vulnerability | KEVEXPLOIT ✓HIGH 7.5EPSS 74.0% | 3 July 2019 |
| CVE-2018-11686 | The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php. | EXPLOITCRITICAL 9.8EPSS 52.5% | 3 July 2019 |
| CVE-2019-7257 | Linear eMerge E3-Series devices allow Unrestricted File Upload. | EXPLOITCRITICAL 10.0EPSS 70.0% | 2 July 2019 |
| CVE-2019-7256 | Nice Linear eMerge E3-Series OS Command Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 97.1% | 2 July 2019 |
| CVE-2019-7255 | Linear eMerge E3-Series devices allow XSS. | EXPLOITMEDIUM 6.1EPSS 55.8% | 2 July 2019 |
| CVE-2019-7254 | Linear eMerge E3-Series devices allow File Inclusion. | EXPLOIT ×2HIGH 7.5EPSS 82.3% | 2 July 2019 |
| CVE-2019-7262 | Linear eMerge E3-Series devices allow Cross-Site Request Forgery (CSRF). | EXPLOITHIGH 8.8EPSS 16.3% | 2 July 2019 |
| CVE-2019-7269 | Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution. | EXPLOITCRITICAL 9.8EPSS 40.0% | 2 July 2019 |
| CVE-2019-7265 | Linear eMerge E3-Series devices allow Remote Code Execution (root access over SSH). | EXPLOITCRITICAL 9.8EPSS 23.1% | 2 July 2019 |
| CVE-2019-7274 | Optergy Proton/Enterprise devices allow Authenticated File Upload with Code Execution as root. | EXPLOITCRITICAL 9.8EPSS 29.0% | 1 July 2019 |
| CVE-2019-7273 | Optergy Proton/Enterprise devices allow Cross-Site Request Forgery (CSRF). | EXPLOITHIGH 8.8EPSS 4.48% | 1 July 2019 |
| CVE-2019-7272 | Optergy Proton/Enterprise devices allow Username Disclosure. | EXPLOITMEDIUM 5.3EPSS 10.5% | 1 July 2019 |
| CVE-2019-7276 | Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console. | EXPLOITCRITICAL 9.8EPSS 93.4% | 1 July 2019 |
| CVE-2019-7670 | The application incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component, which could allow attackers to execute commands directly on the operating system. | EXPLOITHIGH 7.2EPSS 18.3% | 1 July 2019 |
| CVE-2019-7666 | The application allows improper authentication using the MD5 hash value of the password, which may allow an attacker with access to the database to login as admin without decrypting the password. | EXPLOITHIGH 8.8EPSS 14.8% | 1 July 2019 |
| CVE-2019-13024 | Centreon 18.x before 18.10.6, 19.x before 19.04.3, and Centreon web before 2.8.29 allows the attacker to execute arbitrary system commands by using the value "init_script"-"Monitoring Engine Binary" in main.get.php to insert a arbitrary command into the… | EXPLOIT ×2HIGH 8.8EPSS 32.2% | 1 July 2019 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.