Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,196 CVEs1,767 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 26 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2024-45216 | Improper Authentication vulnerability in Apache Solr. | CRITICAL 9.8EPSS 92.7% | 16 October 2024 |
| CVE-2022-4971 | The Sassy Social Share plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'urls' parameter called via the 'heateor_sss_sharing_count' AJAX action in versions up to, and including, 3.3.3 due to insufficient input sanitization… | MEDIUM 6.1EPSS 17.3% | 16 October 2024 |
| CVE-2024-48914 | Prior to versions 3.0.5 and 2.3.3, a vulnerability in Vendure's asset server plugin allows an attacker to craft a request which is able to traverse the server file system and retrieve the contents of arbitrary files, including sensitive data such as… | CRITICAL 9.1EPSS 60.4% | 15 October 2024 |
| CVE-2024-9977 | A vulnerability, which was classified as critical, was found in MitraStar GPT-2541GNAC BR_g5.6_1.11(WVK.0)b26. | MEDIUM 5.1EPSS 22.9% | 15 October 2024 |
| CVE-2024-45741 | In Splunk Enterprise versions below 9.2.3 and 9.1.6 and Splunk Cloud Platform versions below 9.2.2403.108 and 9.1.2312.205, a low-privileged user that does not hold the "admin" or "power" Splunk roles could create a malicious payload through a custom… | MEDIUM 5.4EPSS 14.8% | 14 October 2024 |
| CVE-2023-50780 | Apache ActiveMQ Artemis allows access to diagnostic information and controls through MBeans, which are also exposed through the authenticated Jolokia endpoint. | HIGH 8.8EPSS 17.5% | 14 October 2024 |
| CVE-2024-9916 | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. | MEDIUM 6.9EPSS 73.6% | 13 October 2024 |
| CVE-2024-9047 | The WordPress File Upload plugin for WordPress is vulnerable to Path Traversal in all versions up to, and including, 4.24.11 via wfu_file_downloader.php. | CRITICAL 9.8EPSS 93.3% | 12 October 2024 |
| CVE-2024-35517 | Netgear XR1000 v1.0.0.64 is vulnerable to command injection in usb_remote_smb_conf.cgi via the share_name parameter. | HIGH 7.2EPSS 15.0% | 11 October 2024 |
| CVE-2024-42640 | angular-base64-upload prior to v0.1.21 is vulnerable to unauthenticated remote code execution via demo/server.php. | EXPLOIT ×2CRITICAL 9.8EPSS 40.2% | 11 October 2024 |
| CVE-2024-9234 | The GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor plugin for WordPress is vulnerable to arbitrary file uploads due to a missing capability check on the install_and_activate_plugin_from_external() function… | CRITICAL 9.8EPSS 10.4% | 11 October 2024 |
| CVE-2024-9487 | An improper verification of cryptographic signature vulnerability was identified in GitHub Enterprise Server that allowed SAML SSO authentication to be bypassed resulting in unauthorized provisioning of users and access to the instance. | CRITICAL 9.5EPSS 25.6% | 10 October 2024 |
| CVE-2024-9793 | A vulnerability classified as critical was found in Tenda AC1206 up to 15.03.06.23. | MEDIUM 5.3EPSS 23.1% | 10 October 2024 |
| CVE-2024-9466 | A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials. | HIGH 8.2EPSS 13.6% | 9 October 2024 |
| CVE-2024-9465 | Palo Alto Networks Expedition SQL Injection Vulnerability | KEVCRITICAL 9.2EPSS 99.6% | 9 October 2024 |
| CVE-2024-9464 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API… | CRITICAL 9.3EPSS 82.6% | 9 October 2024 |
| CVE-2024-9463 | Palo Alto Networks Expedition OS Command Injection Vulnerability | KEVCRITICAL 9.9EPSS 98.5% | 9 October 2024 |
| CVE-2024-9680 | Mozilla Firefox Use-After-Free Vulnerability | KEVCRITICAL 9.8EPSS 23.2% | 9 October 2024 |
| CVE-2024-43573 | Microsoft Windows MSHTML Platform Spoofing Vulnerability | KEVHIGH 8.1EPSS 46.1% | 8 October 2024 |
| CVE-2024-43572 | Microsoft Windows Management Console Remote Code Execution Vulnerability | KEVHIGH 7.8EPSS 66.7% | 8 October 2024 |
| CVE-2024-43532 | Remote Registry Service Elevation of Privilege Vulnerability | HIGH 8.8EPSS 12.0% | 8 October 2024 |
| CVE-2024-43468 | Microsoft Configuration Manager SQL Injection Vulnerability | KEVCRITICAL 9.8EPSS 81.0% | 8 October 2024 |
| CVE-2024-9381 | Path traversal in Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to bypass restrictions. | HIGH 7.2EPSS 15.6% | 8 October 2024 |
| CVE-2024-9380 | Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability | KEVHIGH 7.2EPSS 58.3% | 8 October 2024 |
| CVE-2024-9379 | Ivanti Cloud Services Appliance (CSA) SQL Injection Vulnerability | KEVHIGH 7.2EPSS 44.3% | 8 October 2024 |
| CVE-2024-47011 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information | HIGH 7.5EPSS 56.3% | 8 October 2024 |
| CVE-2024-47010 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to bypass authentication. | CRITICAL 9.8EPSS 37.8% | 8 October 2024 |
| CVE-2024-47008 | Server-side request forgery in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information. | HIGH 7.5EPSS 47.1% | 8 October 2024 |
| CVE-2024-47949 | In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location | HIGH 7.5EPSS 23.5% | 8 October 2024 |
| CVE-2024-45230 | The urlize() and urlizetrunc() template filters are subject to a potential denial-of-service attack via very large inputs with a specific sequence of characters. | HIGH 7.5EPSS 25.8% | 8 October 2024 |
| CVE-2024-43365 | Morever, the said consolenewsection parameter is stored in the database and reflected back to user in `index.php`, finally leading to stored XSS. | HIGH 8.2EPSS 25.1% | 7 October 2024 |
| CVE-2024-43364 | Morever, the said title parameter is stored in the database and reflected back to user in index.php, finally leading to stored XSS. | HIGH 8.2EPSS 37.9% | 7 October 2024 |
| CVE-2024-43363 | An admin user can create a device with a malicious hostname containing php code and repeat the installation process (completing only step 5 of the installation process is enough, no need to complete the steps before or after it) to use a php file as the… | HIGH 7.2EPSS 35.6% | 7 October 2024 |
| CVE-2024-43362 | Morever, the said fileurl is placed in some html code which is passed to the `print` function in `link.php` and `index.php`, finally leading to stored XSS. | MEDIUM 5.4EPSS 38.6% | 7 October 2024 |
| CVE-2024-47841 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X… | MEDIUM 6.9EPSS 34.6% | 5 October 2024 |
| CVE-2024-9054 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'), Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Microchip TimeProvider 4100 (Configuration modules) allows Command Injection.This… | EXPLOITHIGH 8.5EPSS 15.6% | 4 October 2024 |
| CVE-2024-43686 | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Microchip TimeProvider 4100 (data plot modules) allows Reflected XSS.This issue affects TimeProvider 4100: from 1.0 before 2.4.7. | MEDIUM 5.4EPSS 13.0% | 4 October 2024 |
| CVE-2024-47855 | util/JSONTokener.java in JSON-lib before 3.1.0 mishandles an unbalanced comment string. | MEDIUM 5.3EPSS 17.6% | 4 October 2024 |
| CVE-2024-46658 | Syrotech SY-GOPON-8OLT-L3 v1.6.0_240629 was discovered to contain an authenticated command injection vulnerability. | HIGH 8.0EPSS 24.4% | 3 October 2024 |
| CVE-2024-41163 | A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. | HIGH 7.5EPSS 52.5% | 3 October 2024 |
| CVE-2024-45519 | Synacor Zimbra Collaboration Suite (ZCS) Command Execution Vulnerability | KEVCRITICAL 9.8EPSS 99.9% | 2 October 2024 |
| CVE-2024-9441 | The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. | CRITICAL 9.8EPSS 53.5% | 2 October 2024 |
| CVE-2024-24116 | An issue in Ruijie RG-NBS2009G-P RGOS v.10.4(1)P2 Release(9736) allows a remote attacker to gain privileges via the system/config_menu.htm. | CRITICAL 9.8EPSS 28.4% | 2 October 2024 |
| CVE-2024-7855 | The WP Hotel Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_review() function in all versions up to, and including, 2.1.2. | HIGH 8.8EPSS 17.7% | 2 October 2024 |
| CVE-2024-47525 | A Stored Cross-Site Scripting (XSS) vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. | MEDIUM 5.4EPSS 29.6% | 1 October 2024 |
| CVE-2024-8353 | The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.16.1 via deserialization of untrusted input via several parameters like 'give_title' and… | CRITICAL 9.8EPSS 32.4% | 28 September 2024 |
| CVE-2024-6931 | The The Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via RSVP name field in all versions up to, and including, 6.6.3 due to insufficient input sanitization and output escaping. | MEDIUM 6.1EPSS 16.7% | 27 September 2024 |
| CVE-2024-47176 | CUPS is a standards-based, open-source printing system, and `cups-browsed` contains network printing functionality including, but not limited to, auto-discovering print services and shared printers. `cups-browsed` binds to `INADDR_ANY:631`, causing it… | MEDIUM 5.3EPSS 50.6% | 26 September 2024 |
| CVE-2024-47175 | When used in combination with other functions such as `cfGetPrinterAttributes5`, can result in user controlled input and ultimately code execution via Foomatic. | CRITICAL 9.8EPSS 63.6% | 26 September 2024 |
| CVE-2024-47076 | When these IPP attributes are used, for instance, to generate a PPD file, this can lead to attacker controlled data to be provided to the rest of the CUPS system. | HIGH 8.6EPSS 79.9% | 26 September 2024 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.