Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,562 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
1,766 results · page 16 of 36
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-21587 | Oracle E-Business Suite Unspecified Vulnerability | KEVCRITICAL 9.8EPSS 98.3% | 18 October 2022 |
| CVE-2022-40684 | Fortinet Multiple Products Authentication Bypass Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 100.0% | 18 October 2022 |
| CVE-2022-41033 | Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 1.89% | 11 October 2022 |
| CVE-2022-38028 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 14.9% | 11 October 2022 |
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | KEVHIGH 8.0EPSS 100.0% | 3 October 2022 |
| CVE-2022-41040 | Microsoft Exchange Server Server-Side Request Forgery Vulnerability | KEVHIGH 8.8EPSS 100.0% | 3 October 2022 |
| CVE-2022-20775 | Cisco SD-WAN Path Traversal Vulnerability | KEVHIGH 7.8EPSS 12.5% | 30 September 2022 |
| CVE-2022-3075 | Google Chromium Mojo Insufficient Data Validation Vulnerability | KEVCRITICAL 9.6EPSS 5.85% | 26 September 2022 |
| CVE-2022-3038 | Google Chromium Network Service Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 24.9% | 26 September 2022 |
| CVE-2022-2856 | Google Chromium Intents Insufficient Input Validation Vulnerability | KEVMEDIUM 6.5EPSS 4.56% | 26 September 2022 |
| CVE-2022-41352 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | KEVCRITICAL 9.8EPSS 95.5% | 26 September 2022 |
| CVE-2022-3236 | Sophos Firewall Code Injection Vulnerability | KEVCRITICAL 9.8EPSS 98.9% | 23 September 2022 |
| CVE-2022-39197 | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | KEVMEDIUM 6.1EPSS 44.1% | 22 September 2022 |
| CVE-2022-32917 | Apple iOS, iPadOS, and macOS Remote Code Execution Vulnerability | KEVHIGH 7.8EPSS 5.60% | 20 September 2022 |
| CVE-2022-40139 | Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability | KEVHIGH 7.2EPSS 3.44% | 19 September 2022 |
| CVE-2022-35914 | Teclib GLPI Remote Code Execution Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.9% | 19 September 2022 |
| CVE-2022-37969 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 28.5% | 13 September 2022 |
| CVE-2022-27593 | QNAP Photo Station Externally Controlled Reference Vulnerability | KEVCRITICAL 9.1EPSS 87.9% | 8 September 2022 |
| CVE-2022-37055 | D-Link Routers Buffer Overflow Vulnerability | KEVCRITICAL 9.8EPSS 55.5% | 28 August 2022 |
| CVE-2022-36537 | ZK Framework AuUploader Unspecified Vulnerability | KEVHIGH 7.5EPSS 95.4% | 26 August 2022 |
| CVE-2022-36804 | Atlassian Bitbucket Server and Data Center Command Injection Vulnerability | KEVEXPLOITHIGH 8.8EPSS 99.1% | 25 August 2022 |
| CVE-2022-32894 | Apple iOS and macOS Out-of-Bounds Write Vulnerability | KEVHIGH 7.8EPSS 3.29% | 24 August 2022 |
| CVE-2022-32893 | Apple iOS and macOS Out-of-Bounds Write Vulnerability | KEVHIGH 8.8EPSS 9.93% | 24 August 2022 |
| CVE-2022-37042 | Synacor Zimbra Collaboration Suite (ZCS) Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 92.1% | 12 August 2022 |
| CVE-2022-0028 | Palo Alto Networks PAN-OS Reflected Amplification Denial-of-Service Vulnerability | KEVHIGH 8.6EPSS 2.69% | 10 August 2022 |
| CVE-2022-34713 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | KEVHIGH 7.8EPSS 67.8% | 9 August 2022 |
| CVE-2022-2294 | WebRTC Heap Buffer Overflow Vulnerability | KEVHIGH 8.8EPSS 70.8% | 28 July 2022 |
| CVE-2022-1364 | Google Chromium V8 Type Confusion Vulnerability | KEVHIGH 8.8EPSS 13.9% | 26 July 2022 |
| CVE-2022-1096 | Google Chromium V8 Type Confusion Vulnerability | KEVHIGH 8.8EPSS 24.7% | 23 July 2022 |
| CVE-2022-26138 | Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability | KEVCRITICAL 9.8EPSS 98.2% | 20 July 2022 |
| CVE-2022-35405 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | KEVCRITICAL 9.8EPSS 99.9% | 19 July 2022 |
| CVE-2022-33891 | Apache Spark Command Injection Vulnerability | KEVHIGH 8.8EPSS 93.2% | 18 July 2022 |
| CVE-2022-26352 | dotCMS Unrestricted Upload of File Vulnerability | KEVCRITICAL 9.8EPSS 91.2% | 17 July 2022 |
| CVE-2022-22047 | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 18.8% | 12 July 2022 |
| CVE-2022-22071 | Qualcomm Multiple Chipsets Use-After-Free Vulnerability | KEVHIGH 7.8EPSS 0.41% | 14 June 2022 |
| CVE-2022-26134 | Atlassian Confluence Server and Data Center Remote Code Execution Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 3 June 2022 |
| CVE-2022-30190 | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | KEVHIGH 7.8EPSS 99.2% | 1 June 2022 |
| CVE-2022-22675 | Apple macOS Out-of-Bounds Write Vulnerability | KEVHIGH 7.8EPSS 12.5% | 26 May 2022 |
| CVE-2022-22674 | Apple macOS Out-of-Bounds Read Vulnerability | KEVMEDIUM 5.5EPSS 1.09% | 26 May 2022 |
| CVE-2022-20821 | Cisco IOS XR Open Port Vulnerability | KEVMEDIUM 6.5EPSS 11.5% | 26 May 2022 |
| CVE-2022-29303 | SolarView Compact Command Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 98.0% | 12 May 2022 |
| CVE-2022-30525 | Zyxel Multiple Firewalls OS Command Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.9% | 12 May 2022 |
| CVE-2022-26925 | Microsoft Windows LSA Spoofing Vulnerability | KEVMEDIUM 5.9EPSS 10.5% | 10 May 2022 |
| CVE-2022-26923 | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | KEVHIGH 8.8EPSS 83.5% | 10 May 2022 |
| CVE-2022-30333 | RARLAB UnRAR Directory Traversal Vulnerability | KEVHIGH 7.5EPSS 99.2% | 9 May 2022 |
| CVE-2022-1388 | F5 BIG-IP Missing Authentication Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 5 May 2022 |
| CVE-2022-24706 | Apache CouchDB Insecure Default Initialization of Resource Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 92.5% | 26 April 2022 |
| CVE-2022-29499 | Mitel MiVoice Connect Data Validation Vulnerability | KEVCRITICAL 9.8EPSS 55.2% | 26 April 2022 |
| CVE-2022-27926 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | KEVMEDIUM 6.1EPSS 17.6% | 21 April 2022 |
| CVE-2022-27925 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | KEVHIGH 7.2EPSS 98.7% | 21 April 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.