Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
393,006 CVEs1,710 in CISA KEV17,375 with EPSS ≥ 10%Updated 15 September 2026
17,375 results · page 10 of 348
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2025-21042 | Samsung Mobile Devices Out-of-Bounds Write Vulnerability | KEVCRITICAL 9.8EPSS 33.2% | 12 September 2025 |
| CVE-2025-58320 | Delta Electronics DIALink has an Directory Traversal Authentication Bypass Vulnerability. | HIGH 7.3EPSS 14.0% | 11 September 2025 |
| CVE-2025-54123 | In versions 1.11.3 and prior, the middleware functionality in Hoverfly is vulnerable to command injection vulnerability at `/api/v2/hoverfly/middleware` endpoint due to insufficient validation and sanitization in user input. | CRITICAL 9.8EPSS 10.5% | 10 September 2025 |
| CVE-2025-34176 | In pfSense CE /suricata/suricata_ip_reputation.php, the value of the iplist parameter is not sanitized of directory traversal-related strings/characters. | MEDIUM 5.3EPSS 15.0% | 9 September 2025 |
| CVE-2025-58180 | OctoPrint versions up until and including 1.11.2 contain a vulnerability that allows an authenticated attacker to upload a file under a specially crafted filename that will allow arbitrary command execution if said filename becomes included in a command… | HIGH 7.5EPSS 20.6% | 9 September 2025 |
| CVE-2025-34175 | This can result in reflected cross-site scripting if the victim is authenticated. | MEDIUM 5.1EPSS 15.9% | 9 September 2025 |
| CVE-2025-34174 | This value can be saved as the default value to be displayed to all users when visiting the Status Traffic Totals page, resulting in stored cross-site scripting. | MEDIUM 5.1EPSS 10.5% | 9 September 2025 |
| CVE-2025-55234 | An attacker who successfully exploited these vulnerabilities could perform relay attacks and make the users subject to elevation of privilege attacks. | CRITICAL 9.8EPSS 20.1% | 9 September 2025 |
| CVE-2025-54918 | Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network. | HIGH 8.8EPSS 19.4% | 9 September 2025 |
| CVE-2025-54897 | Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | HIGH 8.8EPSS 19.1% | 9 September 2025 |
| CVE-2025-54261 | ColdFusion versions 2025.3, 2023.15, 2021.21 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary code execution by an attacker. | CRITICAL 10.0EPSS 21.3% | 9 September 2025 |
| CVE-2025-9872 | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. | HIGH 8.8EPSS 13.5% | 9 September 2025 |
| CVE-2025-9712 | Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3 SR1 and 2022 SU8 SR2 allows a remote unauthenticated attacker to achieve remote code execution. | HIGH 8.8EPSS 20.5% | 9 September 2025 |
| CVE-2025-54236 | Adobe Commerce and Magento Improper Input Validation Vulnerability | KEVCRITICAL 9.1EPSS 94.5% | 9 September 2025 |
| CVE-2025-8085 | The Ditty WordPress plugin before 3.1.58 lacks authorization and authentication for requests to its displayItems endpoint, allowing unauthenticated visitors to make requests to arbitrary URLs. | HIGH 8.6EPSS 17.4% | 8 September 2025 |
| CVE-2025-58443 | Versions 1.5.10.1673 and below contain an authentication bypass vulnerability. | CRITICAL 9.9EPSS 18.7% | 6 September 2025 |
| CVE-2025-57833 | FilteredRelation is subject to SQL injection in column aliases, using a suitably crafted dictionary, with dictionary expansion, as the **kwargs passed QuerySet.annotate() or QuerySet.alias(). | HIGH 8.1EPSS 15.7% | 3 September 2025 |
| CVE-2025-53690 | Sitecore Multiple Products Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.0EPSS 51.1% | 3 September 2025 |
| CVE-2025-53693 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Sitecore Sitecore Experience Manager (XM), Sitecore Experience Platform (XP) allows Cache Poisoning.This issue affects Sitecore Experience Manager (XM):… | CRITICAL 9.8EPSS 14.1% | 3 September 2025 |
| CVE-2024-28988 | SolarWinds Web Help Desk was found to be susceptible to a Java Deserialization Remote Code Execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine. | CRITICAL 9.8EPSS 39.4% | 1 September 2025 |
| CVE-2025-9769 | The manipulation of the argument addr with the input `echo 12345 > poc.txt` results in command injection. | LOW 0.9EPSS 25.9% | 1 September 2025 |
| CVE-2025-6507 | A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. | CRITICAL 9.8EPSS 13.7% | 1 September 2025 |
| CVE-2025-9752 | A security vulnerability has been detected in D-Link DIR-852 1.00CN B09. | MEDIUM 5.5EPSS 15.8% | 1 September 2025 |
| CVE-2025-9377 | TP-Link Archer C7(EU) and TL-WR841N/ND(MS) OS Command Injection Vulnerability | KEVHIGH 8.6EPSS 33.5% | 29 August 2025 |
| CVE-2025-57819 | Sangoma FreePBX Authentication Bypass Vulnerability | KEVCRITICAL 10.0EPSS 85.5% | 28 August 2025 |
| CVE-2024-13985 | A command injection vulnerability in Dahua EIMS versions prior to 2240008 allows unauthenticated remote attackers to execute arbitrary system commands via the capture_handle.action interface. | CRITICAL 10.0EPSS 14.6% | 27 August 2025 |
| CVE-2025-9528 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. | LOW 2.0EPSS 54.2% | 27 August 2025 |
| CVE-2025-9491 | Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. | MEDIUM 4.6EPSS 68.9% | 26 August 2025 |
| CVE-2025-7775 | Citrix NetScaler Memory Overflow Vulnerability | KEVCRITICAL 9.2EPSS 19.6% | 26 August 2025 |
| CVE-2025-9424 | A vulnerability was identified in Ruijie WS7204-A 2017.06.15. | LOW 2.0EPSS 18.3% | 25 August 2025 |
| CVE-2025-53119 | An unauthenticated unrestricted file upload vulnerability allows an attacker to upload malicious binaries and scripts to the server. | HIGH 7.5EPSS 12.3% | 25 August 2025 |
| CVE-2025-53118 | An authentication bypass vulnerability exists which allows an unauthenticated attacker to control administrator backup functions, leading to compromise of passwords, secrets, and application session tokens stored by the Unified PAM. | CRITICAL 9.8EPSS 30.5% | 25 August 2025 |
| CVE-2025-43300 | Apple iOS, iPadOS, and macOS Out-of-Bounds Write Vulnerability | KEVCRITICAL 10.0EPSS 22.0% | 21 August 2025 |
| CVE-2025-54988 | Critical XXE in Apache Tika (tika-parser-pdf-module) in Apache Tika 1.13 through and including 3.2.1 on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. | HIGH 8.4EPSS 37.7% | 20 August 2025 |
| CVE-2025-48148 | Unrestricted Upload of File with Dangerous Type vulnerability in StoreKeeper B.V. | CRITICAL 10.0EPSS 16.7% | 20 August 2025 |
| CVE-2025-57791 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. | MEDIUM 6.9EPSS 22.4% | 20 August 2025 |
| CVE-2025-57790 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. | HIGH 8.7EPSS 18.0% | 20 August 2025 |
| CVE-2025-8723 | The Cloudflare Image Resizing plugin for WordPress is vulnerable to Remote Code Execution due to missing authentication and insufficient sanitization within its hook_rest_pre_dispatch() method in all versions up to, and including, 1.5.6. | CRITICAL 9.8EPSS 15.4% | 19 August 2025 |
| CVE-2025-55296 | A stored Cross-Site Scripting (XSS) vulnerability exists in LibreNMS (<= 25.6.0) in the Alert Template creation feature. | MEDIUM 5.4EPSS 12.5% | 18 August 2025 |
| CVE-2025-9090 | A vulnerability was identified in Tenda AC20 16.03.08.12. | LOW 2.1EPSS 14.1% | 17 August 2025 |
| CVE-2023-3866 | In the Linux kernel, the following vulnerability has been resolved: ksmbd: validate session id and tree id in the compound request This patch validate session id and tree id in compound request. | MEDIUM 5.5EPSS 10.5% | 16 August 2025 |
| CVE-2025-7441 | The StoryChief plugin for WordPress is vulnerable to arbitrary file uploads in all versions up to, and including, 1.0.42. | CRITICAL 9.8EPSS 39.5% | 16 August 2025 |
| CVE-2025-54466 | Improper Control of Generation of Code ('Code Injection') vulnerability leading to a possible RCE in Apache OFBiz scrum plugin. | CRITICAL 9.8EPSS 16.4% | 15 August 2025 |
| CVE-2025-20265 | A vulnerability in the RADIUS subsystem implementation of Cisco Secure Firewall Management Center (FMC) Software could allow an unauthenticated, remote attacker to inject arbitrary shell commands that are executed by the device. This vulnerability… | CRITICAL 10.0EPSS 14.7% | 14 August 2025 |
| CVE-2025-43984 | They are vulnerable to unauthenticated /goform/goform_set_cmd_process requests. | CRITICAL 9.8EPSS 20.2% | 14 August 2025 |
| CVE-2024-53945 | The KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atCmd. | HIGH 8.8EPSS 19.5% | 14 August 2025 |
| CVE-2025-8956 | A vulnerability was found in D-Link DIR‑818L up to 1.05B01. | LOW 2.1EPSS 19.0% | 14 August 2025 |
| CVE-2025-8943 | The Custom MCPs feature is designed to execute OS commands, for instance, using tools like `npx` to spin up local MCP Servers. | CRITICAL 9.8EPSS 66.3% | 14 August 2025 |
| CVE-2025-55346 | User-controlled input flows to an unsafe implementation of a dynamic Function constructor, allowing network attackers to run arbitrary unsandboxed JS code in the context of the host, by sending a simple POST request. | CRITICAL 9.8EPSS 19.3% | 14 August 2025 |
| CVE-2025-25256 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] vulnerability in Fortinet FortiSIEM 7.3.0 through 7.3.1, FortiSIEM 7.2.0 through 7.2.5, FortiSIEM 7.1.0 through 7.1.7, FortiSIEM 7.0.0… | CRITICAL 9.8EPSS 62.8% | 12 August 2025 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. Patch KEV entries first, then anything with an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS and the CISA KEV catalogue. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.