Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
395,626 CVEs1,716 in CISA KEV17,391 with EPSS ≥ 10%25,049 with a public exploitUpdated 20 September 2026
25,049 results · page 6 of 501
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2025-27007 | Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This issue affects OttoKit: from n/a through <= 1.0.82. | EXPLOITCRITICAL 9.8EPSS 51.5% | 1 May 2025 |
| CVE-2025-31650 | Improper Input Validation vulnerability in Apache Tomcat. | EXPLOITHIGH 7.5EPSS 59.9% | 28 April 2025 |
| CVE-2025-32432 | Craft CMS Code Injection Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 99.8% | 25 April 2025 |
| CVE-2025-2594 | The User Registration & Membership WordPress plugin before 4.1.3 does not properly validate data in an AJAX action when the Membership Addon is enabled, allowing attackers to authenticate as any user, including administrators, by simply using the target… | EXPLOITHIGH 8.1EPSS 9.44% | 22 April 2025 |
| CVE-2025-1731 | An incorrect permission assignment vulnerability in the PostgreSQL commands of the Zyxel USG FLEX H series uOS firmware versions from V1.20 through V1.31 could allow an authenticated local attacker with low privileges to gain access to the Linux shell… | EXPLOITHIGH 7.8EPSS 0.94% | 22 April 2025 |
| CVE-2025-28121 | code-projects Online Exam Mastering System 1.0 is vulnerable to Cross Site Scripting (XSS) in feedback.php via the "q" parameter allowing remote attackers to execute arbitrary code. | EXPLOITMEDIUM 6.1EPSS 0.90% | 21 April 2025 |
| CVE-2025-29471 | Cross Site Scripting vulnerability in Nagios Log Server v.2024R1.3.1 allows a remote attacker to execute arbitrary code via a payload into the Email field. | EXPLOITHIGH 8.3EPSS 7.16% | 15 April 2025 |
| CVE-2025-27751 | Use after free in Microsoft Office Excel allows an unauthorized attacker to execute code locally. | EXPLOITHIGH 7.8EPSS 2.48% | 8 April 2025 |
| CVE-2025-3248 | Langflow Missing Authentication Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 100.0% | 7 April 2025 |
| CVE-2025-32370 | Kentico Xperience before 13.0.178 has a specific set of allowed ContentUploader file extensions for unauthenticated uploads; however, because .zip is processed through TryZipProviderSafe, there is additional functionality to create files with other… | EXPLOITCRITICAL 9.8EPSS 1.52% | 6 April 2025 |
| CVE-2025-31161 | CrushFTP Authentication Bypass Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 3 April 2025 |
| CVE-2003-20001 | When a remote user attempts to log in via TELNET during the login wait time and an external call comes in, the system incorrectly divulges information about the call and any SMDR records generated by the system. | EXPLOITMEDIUM 5.6EPSS 1.58% | 1 April 2025 |
| CVE-2025-31131 | The squelette parameter is vulnerable to path traversal attacks, enabling read access to arbitrary files on the server. | EXPLOITHIGH 7.5EPSS 5.38% | 1 April 2025 |
| CVE-2025-2294 | The Kubio AI Page Builder plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.5.1 via thekubio_hybrid_theme_load_template function. | EXPLOITCRITICAL 9.8EPSS 78.4% | 28 March 2025 |
| CVE-2025-29306 | An issue in FoxCMS v.1.2.5 allows a remote attacker to execute arbitrary code via the case display page in the index.html component. | EXPLOITCRITICAL 9.8EPSS 46.6% | 27 March 2025 |
| CVE-2024-12905 | An Improper Link Resolution Before File Access ("Link Following") and Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal"). | EXPLOITHIGH 7.5EPSS 2.22% | 27 March 2025 |
| CVE-2024-55963 | This is still within the Appsmith container, and the impact is limited to Appsmith's own server only, but there is a denial of service because it can be continually restarted. | EXPLOITMEDIUM 6.5EPSS 30.7% | 26 March 2025 |
| CVE-2025-2783 | Google Chromium Mojo Sandbox Escape Vulnerability | KEVEXPLOITHIGH 8.3EPSS 9.24% | 26 March 2025 |
| CVE-2025-24514 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingress annotation can be used to inject configuration into nginx. | EXPLOITHIGH 8.8EPSS 32.6% | 25 March 2025 |
| CVE-2025-1974 | A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. | EXPLOIT ×2 ✓CRITICAL 9.8EPSS 99.5% | 25 March 2025 |
| CVE-2025-1098 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `mirror-target` and `mirror-host` Ingress annotations can be used to inject arbitrary configuration into nginx. | EXPLOITHIGH 8.8EPSS 83.5% | 25 March 2025 |
| CVE-2025-1097 | A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-cn` Ingress annotation can be used to inject configuration into nginx. | EXPLOITHIGH 8.8EPSS 35.5% | 25 March 2025 |
| CVE-2025-30208 | Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` denies access to files outside of Vite serving allow list. | EXPLOITHIGH 7.5EPSS 75.0% | 24 March 2025 |
| CVE-2025-29927 | Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js application, if the authorization check occurs in middleware. | EXPLOITCRITICAL 9.1EPSS 99.2% | 21 March 2025 |
| CVE-2025-26633 | Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability | KEVEXPLOITHIGH 7.0EPSS 30.4% | 11 March 2025 |
| CVE-2025-24076 | Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally. | EXPLOITHIGH 7.3EPSS 3.15% | 11 March 2025 |
| CVE-2025-24071 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. | EXPLOIT ×2MEDIUM 6.5EPSS 22.9% | 11 March 2025 |
| CVE-2025-24054 | Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability | KEVEXPLOIT ×3MEDIUM 5.4EPSS 58.9% | 11 March 2025 |
| CVE-2025-1550 | The Keras Model.load_model function permits arbitrary code execution, even with safe_mode=True, through a manually constructed, malicious .keras archive. | EXPLOITHIGH 7.3EPSS 2.63% | 11 March 2025 |
| CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.9% | 10 March 2025 |
| CVE-2025-2126 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. | EXPLOITMEDIUM 5.3EPSS 11.2% | 9 March 2025 |
| CVE-2024-9458 | The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed… | EXPLOITMEDIUM 4.8EPSS 0.87% | 7 March 2025 |
| CVE-2025-26263 | GeoVision ASManager Windows desktop application with the version 6.1.2.0 or less (fixed in 6.2.0), is vulnerable to credentials disclosure due to improper memory handling in the ASManagerService.exe process. | EXPLOITMEDIUM 5.1EPSS 1.34% | 28 February 2025 |
| CVE-2025-26264 | GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. | EXPLOITHIGH 8.8EPSS 23.0% | 27 February 2025 |
| CVE-2025-24893 | XWiki Platform Eval Injection Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 99.9% | 20 February 2025 |
| CVE-2025-0868 | A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. | EXPLOIT ✓CRITICAL 9.3EPSS 17.1% | 20 February 2025 |
| CVE-2025-27218 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. | EXPLOITMEDIUM 5.3EPSS 65.0% | 20 February 2025 |
| CVE-2025-25198 | Prior to version 2025-01a, a vulnerability in mailcow's password reset functionality allows an attacker to manipulate the `Host HTTP` header to generate a password reset link pointing to an attacker-controlled domain. | EXPLOITHIGH 8.8EPSS 1.12% | 12 February 2025 |
| CVE-2024-53586 | An issue in the relPath parameter of WebFileSys version 2.31.0 allows attackers to perform directory traversal via a crafted HTTP request. | EXPLOITMEDIUM 5.3EPSS 1.87% | 6 February 2025 |
| CVE-2025-20125 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker with valid read-only credentials to obtain sensitive information, change node configurations, and restart the node. | EXPLOITHIGH 7.2EPSS 16.7% | 5 February 2025 |
| CVE-2025-20124 | A vulnerability in an API of Cisco ISE could allow an authenticated, remote attacker to execute arbitrary commands as the root user on an affected device. | EXPLOITHIGH 7.2EPSS 18.5% | 5 February 2025 |
| CVE-2024-48445 | An issue in compop.ca ONLINE MALL v.3.5.3 allows a remote attacker to execute arbitrary code via the rid, tid, et, and ts parameters. | EXPLOITCRITICAL 9.8EPSS 1.99% | 4 February 2025 |
| CVE-2024-56902 | Information disclosure vulnerability in Geovision GV-ASManager web application with the version v6.1.0.0 or less, which discloses account information, including cleartext password. | EXPLOITHIGH 7.5EPSS 23.4% | 3 February 2025 |
| CVE-2024-56901 | A Cross-Site Request Forgery (CSRF) vulnerability in Geovision GV-ASWeb application with the version 6.1.1.0 or less that allows attackers to arbitrarily create Administrator accounts via a crafted GET request method. | EXPLOITHIGH 8.8EPSS 1.81% | 3 February 2025 |
| CVE-2024-56898 | Broken access control vulnerability in Geovision GV-ASWeb with version v6.1.0.0 or less. | EXPLOITHIGH 8.8EPSS 2.58% | 3 February 2025 |
| CVE-2024-53584 | OpenPanel v0.3.4 was discovered to contain an OS command injection vulnerability via the timezone parameter. | EXPLOITCRITICAL 9.8EPSS 4.19% | 31 January 2025 |
| CVE-2024-53582 | An issue found in the Copy and View functions in the File Manager component of OpenPanel v0.3.4 allows attackers to execute a directory traversal via a crafted HTTP request. | EXPLOIT ×2HIGH 7.5EPSS 3.27% | 31 January 2025 |
| CVE-2024-53537 | An issue in OpenPanel v0.3.4 to v0.2.1 allows attackers to execute a directory traversal in File Actions of File Manager. | EXPLOITCRITICAL 9.1EPSS 2.36% | 31 January 2025 |
| CVE-2024-23733 | The /WmAdmin/,/invoke/vm.server/login login page in the Integration Server in Software AG webMethods 10.15.0 before Core_Fix7 allows remote attackers to reach the administration panel and discover hostname and version information by sending an arbitrary… | EXPLOITHIGH 7.5EPSS 2.42% | 29 January 2025 |
| CVE-2024-48852 | Insertion of Sensitive Information into Log File vulnerability observed in FLEXON. | EXPLOITMEDIUM 6.9EPSS 2.45% | 29 January 2025 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.