Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
418,508 CVEs1,766 in CISA KEV17,508 with EPSS ≥ 10%25,055 with a public exploitUpdated 3 November 2026
17,508 results · page 20 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2025-24071 | Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network. | EXPLOIT ×2MEDIUM 6.5EPSS 23.3% | 11 March 2025 |
| CVE-2025-24054 | Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability | KEVEXPLOIT ×3MEDIUM 5.4EPSS 62.3% | 11 March 2025 |
| CVE-2024-54018 | Multiple improper neutralization of special elements used in an OS Command vulnerabilities [CWE-78] in FortiSandbox before 4.4.5 allows a privileged attacker to execute unauthorized commands via crafted requests. | HIGH 7.2EPSS 10.0% | 11 March 2025 |
| CVE-2025-27363 | FreeType Out-of-Bounds Write Vulnerability | KEVHIGH 8.1EPSS 27.8% | 11 March 2025 |
| CVE-2024-54085 | AMI MegaRAC SPx Authentication Bypass by Spoofing Vulnerability | KEVCRITICAL 10.0EPSS 60.7% | 11 March 2025 |
| CVE-2025-1661 | The HUSKY – Products Filter Professional for WooCommerce plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.3.6.5 via the 'template' parameter of the woof_text_search AJAX action. | CRITICAL 9.8EPSS 56.4% | 11 March 2025 |
| CVE-2025-24813 | Apache Tomcat Path Equivalence Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.9% | 10 March 2025 |
| CVE-2025-2126 | A vulnerability was found in JoomlaUX JUX Real Estate 3.4.0 on Joomla and classified as critical. | EXPLOITMEDIUM 5.3EPSS 11.2% | 9 March 2025 |
| CVE-2025-27636 | Bypass/Injection vulnerability in Apache Camel components under particular conditions. | MEDIUM 5.6EPSS 97.1% | 9 March 2025 |
| CVE-2025-2094 | A vulnerability was found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. | MEDIUM 5.3EPSS 13.0% | 7 March 2025 |
| CVE-2025-1316 | Edimax IC-7100 IP Camera OS Command Injection Vulnerability | KEVCRITICAL 9.3EPSS 74.5% | 5 March 2025 |
| CVE-2025-26319 | FlowiseAI Flowise v2.2.6 was discovered to contain an arbitrary file upload vulnerability in /api/v1/attachments. | CRITICAL 9.8EPSS 55.9% | 4 March 2025 |
| CVE-2025-0370 | The WP Shortcodes Plugin — Shortcodes Ultimate plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘src’ parameter in all versions up to, and including, 7.3.3 due to insufficient input sanitization and output escaping. | MEDIUM 5.4EPSS 36.8% | 4 March 2025 |
| CVE-2024-48248 | NAKIVO Backup and Replication Absolute Path Traversal Vulnerability | KEVHIGH 8.6EPSS 94.4% | 4 March 2025 |
| CVE-2025-27423 | Vim is distributed with the tar.vim plugin, that allows easy editing and viewing of (compressed or uncompressed) tar files. | HIGH 7.1EPSS 22.5% | 3 March 2025 |
| CVE-2025-27590 | In oxidized-web (aka Oxidized Web) before 0.15.0, the RANCID migration page allows an unauthenticated user to gain control over the Linux user account that is running oxidized-web. | CRITICAL 9.8EPSS 27.6% | 3 March 2025 |
| CVE-2025-1829 | A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. | MEDIUM 5.3EPSS 12.4% | 2 March 2025 |
| CVE-2025-26466 | A malicious client may keep sending such packages, leading to an uncontrolled increase in memory consumption on the server side. | MEDIUM 5.9EPSS 38.7% | 28 February 2025 |
| CVE-2025-26264 | GeoVision GV-ASWeb with the version 6.1.2.0 or less (fixed in 6.2.0), contains a Remote Code Execution (RCE) vulnerability within its Notification Settings feature. | EXPLOITHIGH 8.8EPSS 23.8% | 27 February 2025 |
| CVE-2024-53944 | A unauthenticated remote attacker with network access can exploit a command injection vulnerability. | CRITICAL 9.8EPSS 39.7% | 27 February 2025 |
| CVE-2025-21760 | In the Linux kernel, the following vulnerability has been resolved: ndisc: extend RCU protection in ndisc_send_skb() ndisc_send_skb() can be called without RTNL or RCU held. | HIGH 8.1EPSS 38.0% | 27 February 2025 |
| CVE-2025-21758 | In the Linux kernel, the following vulnerability has been resolved: ipv6: mcast: add RCU protection to mld_newpack() mld_newpack() can be called without RTNL or RCU being held. | MEDIUM 5.5EPSS 16.9% | 27 February 2025 |
| CVE-2025-1128 | The Everest Forms – Contact Forms, Quiz, Survey, Newsletter & Payment Form Builder for WordPress plugin for WordPress is vulnerable to arbitrary file upload, read, and deletion due to missing file type and path validation in the 'format' method of the… | CRITICAL 9.8EPSS 42.4% | 25 February 2025 |
| CVE-2025-27364 | In MITRE Caldera through 4.2.0 and 5.0.0 before 35bc06e, a Remote Code Execution (RCE) vulnerability was found in the dynamic agent (implant) compilation functionality of the server. | CRITICAL 10.0EPSS 25.9% | 24 February 2025 |
| CVE-2025-25279 | Mattermost versions 10.4.x <= 10.4.1, 9.11.x <= 9.11.7, 10.3.x <= 10.3.2, 10.2.x <= 10.2.2 fail to properly validate board blocks when importing boards which allows an attacker could read any arbitrary file on the system via importing and exporting a… | HIGH 7.5EPSS 24.2% | 24 February 2025 |
| CVE-2025-1610 | A vulnerability was found in LB-LINK AC1900 Router 1.0.2 and classified as critical. | MEDIUM 5.3EPSS 13.2% | 24 February 2025 |
| CVE-2025-1609 | A vulnerability has been found in LB-LINK AC1900 Router 1.0.2 and classified as critical. | MEDIUM 5.3EPSS 10.2% | 24 February 2025 |
| CVE-2025-1608 | A vulnerability, which was classified as critical, was found in LB-LINK AC1900 Router 1.0.2. | MEDIUM 5.3EPSS 10.2% | 24 February 2025 |
| CVE-2019-8900 | A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devices. | MEDIUM 6.8EPSS 69.5% | 21 February 2025 |
| CVE-2025-26794 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. | CRITICAL 9.8EPSS 77.6% | 21 February 2025 |
| CVE-2025-24893 | XWiki Platform Eval Injection Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 100.0% | 20 February 2025 |
| CVE-2025-0868 | A vulnerability, that could result in Remote Code Execution (RCE), has been found in DocsGPT. | EXPLOIT ✓CRITICAL 9.3EPSS 17.1% | 20 February 2025 |
| CVE-2025-27218 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. | EXPLOITMEDIUM 5.3EPSS 65.0% | 20 February 2025 |
| CVE-2024-12284 | Authenticated privilege escalation in NetScaler Console and NetScaler Agent allows. | HIGH 8.8EPSS 13.3% | 20 February 2025 |
| CVE-2024-57045 | A vulnerability in the D-Link DIR-859 router with firmware version A3 1.05 and earlier permits unauthorized individuals to bypass the authentication. | CRITICAL 9.8EPSS 32.2% | 18 February 2025 |
| CVE-2025-1340 | A vulnerability classified as critical has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. | HIGH 8.7EPSS 16.7% | 16 February 2025 |
| CVE-2025-1338 | A vulnerability was found in NUUO Camera up to 20250203. | MEDIUM 6.9EPSS 51.1% | 16 February 2025 |
| CVE-2025-1302 | Versions of the package jsonpath-plus before 10.3.0 are vulnerable to Remote Code Execution (RCE) due to improper input sanitization. | HIGH 8.9EPSS 10.4% | 15 February 2025 |
| CVE-2025-1094 | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. | HIGH 8.1EPSS 90.0% | 13 February 2025 |
| CVE-2025-0108 | Palo Alto Networks PAN-OS Authentication Bypass Vulnerability | KEVHIGH 8.8EPSS 98.5% | 12 February 2025 |
| CVE-2025-1240 | WinZip 7Z File Parsing Out-Of-Bounds Write Remote Code Execution Vulnerability. | HIGH 8.8EPSS 10.3% | 11 February 2025 |
| CVE-2025-1044 | Logsign Unified SecOps Platform Authentication Bypass Vulnerability. | CRITICAL 9.8EPSS 75.3% | 11 February 2025 |
| CVE-2025-24434 | Adobe Commerce versions 2.4.8-beta1, 2.4.7-p3, 2.4.6-p8, 2.4.5-p10, 2.4.4-p11 and earlier are affected by an Incorrect Authorization vulnerability that could result in Privilege escalation. | CRITICAL 9.1EPSS 17.2% | 11 February 2025 |
| CVE-2025-21400 | Microsoft SharePoint Server Remote Code Execution Vulnerability | HIGH 8.0EPSS 34.2% | 11 February 2025 |
| CVE-2025-21377 | NTLM Hash Disclosure Spoofing Vulnerability | MEDIUM 6.5EPSS 39.9% | 11 February 2025 |
| CVE-2024-27781 | An improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet FortiSandbox 4.4.0 through 4.4.4, FortiSandbox 4.2.1 through 4.2.6, FortiSandbox 4.0.0 through 4.0.4, FortiSandbox 3.2 all versions,… | CRITICAL 9.0EPSS 28.2% | 11 February 2025 |
| CVE-2024-47908 | OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution. | HIGH 7.2EPSS 22.3% | 11 February 2025 |
| CVE-2025-24016 | Wazuh Server Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.9EPSS 93.8% | 10 February 2025 |
| CVE-2024-13059 | A vulnerability in mintplex-labs/anything-llm prior to version 1.3.1 allows for path traversal due to improper handling of non-ASCII filenames in the multer library. | HIGH 7.2EPSS 24.3% | 10 February 2025 |
| CVE-2025-1103 | A vulnerability, which was classified as problematic, was found in D-Link DIR-823X 240126/240802. | HIGH 7.1EPSS 14.1% | 7 February 2025 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.