Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
418,608 CVEs1,766 in CISA KEV17,508 with EPSS ≥ 10%25,055 with a public exploitUpdated 3 November 2026
17,508 results · page 22 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2024-13160 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | KEVHIGH 7.5EPSS 91.0% | 14 January 2025 |
| CVE-2024-13159 | Ivanti Endpoint Manager (EPM) Absolute Path Traversal Vulnerability | KEVHIGH 7.5EPSS 100.0% | 14 January 2025 |
| CVE-2024-13181 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. | CRITICAL 9.8EPSS 33.2% | 14 January 2025 |
| CVE-2024-13180 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to leak sensitive information. | HIGH 7.5EPSS 27.2% | 14 January 2025 |
| CVE-2024-13179 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. | CRITICAL 9.8EPSS 63.8% | 14 January 2025 |
| CVE-2024-39760 | Multiple OS command injection vulnerabilities exist in the login.cgi set_sys_init() functionality of Wavlink AC3000 M33A8.V5030.210505. | CRITICAL 9.8EPSS 17.8% | 14 January 2025 |
| CVE-2024-39363 | A cross-site scripting (xss) vulnerability exists in the login.cgi set_lang_CountryCode() functionality of Wavlink AC3000 M33A8.V5030.210505. | MEDIUM 6.1EPSS 49.0% | 14 January 2025 |
| CVE-2024-39360 | An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.210505. | HIGH 7.2EPSS 12.0% | 14 January 2025 |
| CVE-2024-39288 | A buffer overflow vulnerability exists in the internet.cgi set_add_routing() functionality of Wavlink AC3000 M33A8.V5030.210505. | HIGH 7.2EPSS 13.8% | 14 January 2025 |
| CVE-2024-39280 | An external config control vulnerability exists in the nas.cgi set_smb_cfg() functionality of Wavlink AC3000 M33A8.V5030.210505. | CRITICAL 9.1EPSS 35.0% | 14 January 2025 |
| CVE-2024-38666 | An external config control vulnerability exists in the openvpn.cgi openvpn_client_setup() functionality of Wavlink AC3000 M33A8.V5030.210505. | CRITICAL 9.1EPSS 19.4% | 14 January 2025 |
| CVE-2024-37186 | An os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. | HIGH 7.2EPSS 23.4% | 14 January 2025 |
| CVE-2024-36295 | A command execution vulnerability exists in the qos.cgi qos_sta() functionality of Wavlink AC3000 M33A8.V5030.210505. | HIGH 7.2EPSS 21.3% | 14 January 2025 |
| CVE-2024-36258 | A stack-based buffer overflow vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. | CRITICAL 9.8EPSS 12.8% | 14 January 2025 |
| CVE-2024-34166 | An os command injection vulnerability exists in the touchlist_sync.cgi touchlistsync() functionality of Wavlink AC3000 M33A8.V5030.210505. | CRITICAL 9.8EPSS 16.2% | 14 January 2025 |
| CVE-2024-21797 | A command execution vulnerability exists in the adm.cgi set_TR069() functionality of Wavlink AC3000 M33A8.V5030.210505. | HIGH 7.2EPSS 21.3% | 14 January 2025 |
| CVE-2024-55591 | Fortinet FortiOS and FortiProxy Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 94.3% | 14 January 2025 |
| CVE-2024-48884 | A improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiManager 7.6.0 through 7.6.1, FortiManager 7.4.1 through 7.4.3, FortiManager Cloud 7.4.1 through 7.4.3, FortiOS 7.6.0, FortiOS 7.4.0 through… | CRITICAL 9.1EPSS 15.2% | 14 January 2025 |
| CVE-2025-0107 | An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device… | HIGH 7.7EPSS 78.4% | 11 January 2025 |
| CVE-2025-0105 | An arbitrary file deletion vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to delete arbitrary files accessible to the www-data user on the host filesystem. | MEDIUM 6.9EPSS 13.2% | 11 January 2025 |
| CVE-2024-12847 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. | CRITICAL 9.8EPSS 30.4% | 10 January 2025 |
| CVE-2024-56511 | Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. | CRITICAL 9.3EPSS 50.3% | 10 January 2025 |
| CVE-2025-21385 | A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Purview allows an authorized attacker to disclose information over a network. | MEDIUM 6.5EPSS 28.1% | 9 January 2025 |
| CVE-2024-53704 | SonicWall SonicOS SSLVPN Improper Authentication Vulnerability | KEVCRITICAL 9.8EPSS 95.3% | 9 January 2025 |
| CVE-2025-0283 | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges. | HIGH 7.0EPSS 17.5% | 8 January 2025 |
| CVE-2025-0282 | Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability | KEVEXPLOITCRITICAL 9.0EPSS 100.0% | 8 January 2025 |
| CVE-2024-55656 | There is an integer overflow vulnerability in RedisBloom, which is a module used in Redis. | HIGH 8.8EPSS 17.1% | 8 January 2025 |
| CVE-2024-54676 | Vendor: The Apache Software Foundation Versions Affected: Apache OpenMeetings from 2.1.0 before 8.0.0 Description: Default clustering instructions at https://openmeetings.apache.org/Clustering.html doesn't specify white/black lists for OpenJPA this… | CRITICAL 9.8EPSS 68.8% | 8 January 2025 |
| CVE-2024-50603 | Aviatrix Controllers OS Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 98.5% | 8 January 2025 |
| CVE-2024-54819 | I, Librarian before and including 5.11.1 is vulnerable to Server-Side Request Forgery (SSRF) due to improper input validation in classes/security/validation.php | CRITICAL 9.1EPSS 21.0% | 7 January 2025 |
| CVE-2025-0247 | Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. | CRITICAL 9.8EPSS 10.6% | 7 January 2025 |
| CVE-2025-0242 | Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. | MEDIUM 6.5EPSS 14.7% | 7 January 2025 |
| CVE-2024-55556 | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted… | CRITICAL 9.8EPSS 43.9% | 7 January 2025 |
| CVE-2024-12849 | The Error Log Viewer By WP Guru plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 1.0.1.3 via the wp_ajax_nopriv_elvwp_log_download AJAX action. | HIGH 7.5EPSS 48.0% | 7 January 2025 |
| CVE-2024-48456 | An issue in Netis Wifi6 Router NX10 2.0.1.3643 and 2.0.1.3582 and Netis Wifi 11AC Router NC65 3.0.0.3749 and Netis Wifi 11AC Router NC63 3.0.0.3327 and 3.0.0.3503 and Netis Wifi 11AC Router NC21 3.0.0.3800, 3.0.0.3500 and 3.0.0.3329 and Netis Wifi… | HIGH 7.5EPSS 16.9% | 6 January 2025 |
| CVE-2024-13129 | A vulnerability was found in Roxy-WI up to 8.1.3. | HIGH 8.7EPSS 17.7% | 3 January 2025 |
| CVE-2024-11716 | While assignment of a user to a team (bracket) in CTFd should be possible only once, at the registration, a flaw in logic implementation allows an authenticated user to reset it's bracket and then pick a new one, joining another team while a competition… | MEDIUM 5.3EPSS 11.6% | 2 January 2025 |
| CVE-2024-13106 | A vulnerability was found in D-Link DIR-816 A2 1.10CNB05_R1B011D88210 and classified as critical. | MEDIUM 6.9EPSS 26.0% | 2 January 2025 |
| CVE-2024-56067 | Missing Authorization vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP SuperBackup: from n/a through <= 2.3.3. | HIGH 7.5EPSS 11.7% | 31 December 2024 |
| CVE-2024-56064 | Unrestricted Upload of File with Dangerous Type vulnerability in azzaroco WP SuperBackup indeed-wp-superbackup allows Upload a Web Shell to a Web Server.This issue affects WP SuperBackup: from n/a through <= 2.3.3. | CRITICAL 10.0EPSS 33.2% | 31 December 2024 |
| CVE-2024-12105 | In WhatsUp Gold versions released before 2024.0.2, an authenticated user can use a specially crafted HTTP request that can lead to information disclosure. | MEDIUM 6.5EPSS 41.7% | 31 December 2024 |
| CVE-2024-11972 | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo,… | EXPLOITCRITICAL 9.8EPSS 59.1% | 31 December 2024 |
| CVE-2024-12828 | Webmin CGI Command Injection Remote Code Execution Vulnerability. | HIGH 8.8EPSS 33.3% | 30 December 2024 |
| CVE-2024-12987 | DrayTek Vigor Routers OS Command Injection Vulnerability | KEVMEDIUM 6.9EPSS 98.2% | 27 December 2024 |
| CVE-2024-12986 | A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. | MEDIUM 6.9EPSS 35.3% | 27 December 2024 |
| CVE-2024-12856 | The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. | HIGH 7.2EPSS 84.1% | 27 December 2024 |
| CVE-2024-3393 | Palo Alto Networks PAN-OS Malicious DNS Packet Vulnerability | KEVHIGH 8.7EPSS 29.1% | 27 December 2024 |
| CVE-2024-52046 | The ObjectSerializationDecoder in Apache MINA uses Java’s native deserialization protocol to process incoming serialized data but lacks the necessary security checks and defenses. | CRITICAL 10.0EPSS 24.4% | 25 December 2024 |
| CVE-2024-43441 | Authentication Bypass by Assumed-Immutable Data vulnerability in Apache HugeGraph-Server. | CRITICAL 9.8EPSS 72.8% | 24 December 2024 |
| CVE-2024-53961 | ColdFusion versions 2023.11, 2021.17 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. | HIGH 8.1EPSS 14.1% | 23 December 2024 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.