Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,489 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
1,766 results · page 11 of 36
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2024-4577 | PHP-CGI OS Command Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 9 June 2024 |
| CVE-2024-4610 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | KEVHIGH 7.8EPSS 0.76% | 7 June 2024 |
| CVE-2024-37383 | RoundCube Webmail Cross-Site Scripting (XSS) Vulnerability | KEVEXPLOITMEDIUM 6.1EPSS 74.0% | 7 June 2024 |
| CVE-2024-28995 | SolarWinds Serv-U Path Traversal Vulnerability | KEVEXPLOITHIGH 7.5EPSS 99.6% | 6 June 2024 |
| CVE-2024-29824 | Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability | KEVHIGH 8.8EPSS 99.9% | 31 May 2024 |
| CVE-2024-23692 | Rejetto HTTP File Server Improper Neutralization of Special Elements Used in a Template Engine Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.5% | 31 May 2024 |
| CVE-2024-4358 | Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 97.5% | 29 May 2024 |
| CVE-2024-24919 | Check Point Quantum Security Gateways Information Disclosure Vulnerability | KEVHIGH 8.6EPSS 100.0% | 28 May 2024 |
| CVE-2024-5274 | Google Chromium V8 Type Confusion Vulnerability | KEVCRITICAL 9.6EPSS 7.73% | 28 May 2024 |
| CVE-2024-4978 | Justice AV Solutions (JAVS) Viewer Installer Embedded Malicious Code Vulnerability | KEVHIGH 8.7EPSS 26.9% | 23 May 2024 |
| CVE-2024-4947 | Google Chromium V8 Type Confusion Vulnerability | KEVCRITICAL 9.6EPSS 15.2% | 15 May 2024 |
| CVE-2024-30051 | Microsoft DWM Core Library Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 5.69% | 14 May 2024 |
| CVE-2024-30040 | Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability | KEVHIGH 8.8EPSS 3.94% | 14 May 2024 |
| CVE-2024-4761 | Google Chromium V8 Out-of-Bounds Memory Write Vulnerability | KEVHIGH 8.8EPSS 11.0% | 14 May 2024 |
| CVE-2024-4671 | Google Chromium Visuals Use-After-Free Vulnerability | KEVCRITICAL 9.6EPSS 8.35% | 14 May 2024 |
| CVE-2024-32113 | Apache OFBiz Path Traversal Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.9% | 8 May 2024 |
| CVE-2023-50224 | TP-Link TL-WR841N Authentication Bypass by Spoofing Vulnerability | KEVMEDIUM 6.5EPSS 20.0% | 3 May 2024 |
| CVE-2024-20359 | Cisco ASA and FTD Privilege Escalation Vulnerability | KEVMEDIUM 6.0EPSS 18.8% | 24 April 2024 |
| CVE-2024-20353 | Cisco ASA and FTD Denial of Service Vulnerability | KEVHIGH 8.6EPSS 69.8% | 24 April 2024 |
| CVE-2024-4040 | CrushFTP VFS Sandbox Escape Vulnerability | KEVCRITICAL 10.0EPSS 99.5% | 22 April 2024 |
| CVE-2024-27348 | Apache HugeGraph-Server Improper Access Control Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.2% | 22 April 2024 |
| CVE-2024-3400 | Palo Alto Networks PAN-OS Command Injection Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 100.0% | 12 April 2024 |
| CVE-2024-29988 | Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability | KEVHIGH 8.8EPSS 45.2% | 9 April 2024 |
| CVE-2024-29748 | Android Pixel Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 0.68% | 5 April 2024 |
| CVE-2024-29745 | Android Pixel Information Disclosure Vulnerability | KEVMEDIUM 5.5EPSS 0.49% | 5 April 2024 |
| CVE-2024-3273 | D-Link Multiple NAS Devices Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 4 April 2024 |
| CVE-2024-3272 | D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability | KEVCRITICAL 9.8EPSS 98.1% | 4 April 2024 |
| CVE-2024-29059 | Microsoft .NET Framework Information Disclosure Vulnerability | KEVHIGH 7.5EPSS 98.6% | 23 March 2024 |
| CVE-2024-20767 | Adobe ColdFusion Improper Access Control Vulnerability | KEVEXPLOITHIGH 7.4EPSS 98.5% | 18 March 2024 |
| CVE-2024-26169 | Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability | KEVHIGH 7.8EPSS 3.98% | 12 March 2024 |
| CVE-2023-48788 | Fortinet FortiClient EMS SQL Injection Vulnerability | KEVCRITICAL 9.8EPSS 98.4% | 12 March 2024 |
| CVE-2024-23296 | Apple Multiple Products Memory Corruption Vulnerability | KEVHIGH 7.8EPSS 1.41% | 5 March 2024 |
| CVE-2024-23225 | Apple Multiple Products Memory Corruption Vulnerability | KEVHIGH 7.8EPSS 1.48% | 5 March 2024 |
| CVE-2024-27199 | JetBrains TeamCity Relative Path Traversal Vulnerability | KEVHIGH 7.3EPSS 100.0% | 4 March 2024 |
| CVE-2024-27198 | JetBrains TeamCity Authentication Bypass Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.9% | 4 March 2024 |
| CVE-2024-1212 | Progress Kemp LoadMaster OS Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 95.4% | 21 February 2024 |
| CVE-2024-1709 | ConnectWise ScreenConnect Authentication Bypass Vulnerability | KEVCRITICAL 10.0EPSS 100.0% | 21 February 2024 |
| CVE-2024-1708 | ConnectWise ScreenConnect Path Traversal Vulnerability | KEVHIGH 8.4EPSS 95.4% | 21 February 2024 |
| CVE-2024-20953 | Oracle Agile Product Lifecycle Management (PLM) Deserialization Vulnerability | KEVHIGH 8.8EPSS 3.93% | 17 February 2024 |
| CVE-2024-23113 | Fortinet Multiple Products Format String Vulnerability | KEVCRITICAL 9.8EPSS 61.7% | 15 February 2024 |
| CVE-2024-21413 | Microsoft Outlook Improper Input Validation Vulnerability | KEVCRITICAL 9.8EPSS 94.7% | 13 February 2024 |
| CVE-2024-21412 | Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability | KEVHIGH 8.1EPSS 99.4% | 13 February 2024 |
| CVE-2024-21410 | Microsoft Exchange Server Privilege Escalation Vulnerability | KEVCRITICAL 9.8EPSS 12.7% | 13 February 2024 |
| CVE-2024-21351 | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | KEVHIGH 7.6EPSS 27.8% | 13 February 2024 |
| CVE-2024-21338 | Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability | KEVEXPLOIT ×2HIGH 7.8EPSS 59.8% | 13 February 2024 |
| CVE-2024-21762 | Fortinet FortiOS Out-of-Bound Write Vulnerability | KEVCRITICAL 9.8EPSS 84.6% | 9 February 2024 |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | KEVHIGH 8.2EPSS 100.0% | 31 January 2024 |
| CVE-2024-1086 | Linux Kernel Use-After-Free Vulnerability | KEVHIGH 7.8EPSS 28.1% | 31 January 2024 |
| CVE-2024-23897 | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 24 January 2024 |
| CVE-2024-23222 | Apple Multiple Products WebKit Type Confusion Vulnerability | KEVHIGH 8.8EPSS 10.6% | 23 January 2024 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.