Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,196 CVEs1,767 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 31 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2024-30081 | Windows NTLM Spoofing Vulnerability | HIGH 7.1EPSS 23.8% | 9 July 2024 |
| CVE-2024-3596 | RADIUS Protocol under RFC 2865 is susceptible to forgery attacks by a local attacker who can modify any valid Response (Access-Accept, Access-Reject, or Access-Challenge) to any other response using a chosen-prefix collision attack against MD5 Response… | CRITICAL 9.0EPSS 14.9% | 9 July 2024 |
| CVE-2024-6409 | A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). | HIGH 7.0EPSS 27.9% | 8 July 2024 |
| CVE-2024-1305 | tap-windows6 driver version 9.26 and earlier does not properly check the size data of incomming write operations which an attacker can use to overflow memory buffers, resulting in a bug check and potentially arbitrary code execution in kernel space | CRITICAL 9.8EPSS 15.4% | 8 July 2024 |
| CVE-2024-37389 | Apache NiFi 1.10.0 through 1.26.0 and 2.0.0-M1 through 2.0.0-M3 support a description field in the Parameter Context configuration that is vulnerable to cross-site scripting. | MEDIUM 5.4EPSS 24.0% | 8 July 2024 |
| CVE-2024-6298 | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to execute arbitrary code remotely | EXPLOITCRITICAL 9.4EPSS 19.0% | 5 July 2024 |
| CVE-2024-6209 | Unauthorized file access in WEB Server in ABB ASPECT - Enterprise v3.08.01; NEXUS Series v3.08.01 ; MATRIX Series v3.08.01 allows Attacker to access files unauthorized | EXPLOITCRITICAL 9.4EPSS 17.2% | 5 July 2024 |
| CVE-2024-39943 | rejetto HFS (aka HTTP File Server) 3 before 0.52.10 on Linux, UNIX, and macOS allows OS command execution by remote authenticated users (if they have Upload permissions). | HIGH 8.8EPSS 39.5% | 4 July 2024 |
| CVE-2024-39932 | Gogs through 0.13.0 allows argument injection during the previewing of changes. | CRITICAL 9.9EPSS 16.3% | 4 July 2024 |
| CVE-2024-39931 | Gogs through 0.13.0 allows deletion of internal files. | CRITICAL 9.9EPSS 52.7% | 4 July 2024 |
| CVE-2024-39929 | Exim through 4.97.1 misparses a multiline RFC 2231 header filename, and thus remote attackers can bypass a $mime_filename extension-blocking protection mechanism, and potentially deliver executable attachments to the mailboxes of end users. | MEDIUM 5.4EPSS 41.5% | 4 July 2024 |
| CVE-2024-29510 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. | MEDIUM 6.3EPSS 28.0% | 3 July 2024 |
| CVE-2024-32937 | An os command injection vulnerability exists in the CWMP SelfDefinedTimeZone functionality of Grandstream GXP2135 1.0.9.129, 1.0.11.74 and 1.0.11.79. | CRITICAL 9.8EPSS 27.0% | 3 July 2024 |
| CVE-2024-36404 | Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. | CRITICAL 9.8EPSS 76.1% | 2 July 2024 |
| CVE-2024-39309 | A vulnerability in versions prior to 6.5.7 and 7.1.0 allows SQL injection when Parse Server is configured to use the PostgreSQL database. | CRITICAL 9.8EPSS 20.2% | 1 July 2024 |
| CVE-2024-38368 | A vulnerability affected older pods which migrated from the pre-2014 pull request workflow to trunk. | CRITICAL 9.3EPSS 14.9% | 1 July 2024 |
| CVE-2024-38367 | trunk.cocoapods.org is the authentication server for the CoacoaPods dependency manager. | CRITICAL 9.6EPSS 11.1% | 1 July 2024 |
| CVE-2024-38366 | The part of trunk which verifies whether a user has a real email address on signup used a rfc-822 library which executes a shell command to validate the email domain MX records validity. | CRITICAL 10.0EPSS 17.8% | 1 July 2024 |
| CVE-2024-39573 | Potential SSRF in mod_rewrite in Apache HTTP Server 2.4.59 and earlier allows an attacker to cause unsafe RewriteRules to unexpectedly setup URL's to be handled by mod_proxy. | HIGH 7.5EPSS 35.4% | 1 July 2024 |
| CVE-2024-38476 | Vulnerability in core of Apache HTTP Server 2.4.59 and earlier are vulnerably to information disclosure, SSRF or local script execution via backend applications whose response headers are malicious or exploitable. | CRITICAL 9.8EPSS 41.6% | 1 July 2024 |
| CVE-2024-38475 | Apache HTTP Server Improper Escaping of Output Vulnerability | KEVCRITICAL 9.1EPSS 100.0% | 1 July 2024 |
| CVE-2024-38473 | Encoding problem in mod_proxy in Apache HTTP Server 2.4.59 and earlier allows request URLs with incorrect encoding to be sent to backend services, potentially bypassing authentication via crafted requests. | HIGH 8.1EPSS 25.9% | 1 July 2024 |
| CVE-2024-38472 | SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. | HIGH 7.5EPSS 69.5% | 1 July 2024 |
| CVE-2024-36991 | In Splunk Enterprise on Windows versions below 9.2.2, 9.1.5, and 9.0.10, an attacker could perform a path traversal on the /modules/messaging/ endpoint in Splunk Enterprise on Windows. | HIGH 7.5EPSS 13.0% | 1 July 2024 |
| CVE-2024-36401 | OSGeo GeoServer GeoTools Eval Injection Vulnerability | KEVCRITICAL 9.8EPSS 99.8% | 1 July 2024 |
| CVE-2024-6387 | There is a race condition which can lead sshd to handle some signals in an unsafe manner. | EXPLOITHIGH 8.1EPSS 99.5% | 1 July 2024 |
| CVE-2024-6127 | BC Security Empire before 5.9.3 is vulnerable to a path traversal issue that can lead to remote code execution. | CRITICAL 9.8EPSS 10.3% | 27 June 2024 |
| CVE-2024-5936 | An open redirect vulnerability exists in imartinez/privategpt version 0.5.0 due to improper handling of the 'file' parameter. | MEDIUM 6.1EPSS 30.1% | 27 June 2024 |
| CVE-2024-4901 | An issue was discovered in GitLab CE/EE affecting all versions starting from 16.9 prior to 16.11.5, starting from 17.0 prior to 17.0.3, and starting from 17.1 prior to 17.1.1, where a stored XSS vulnerability could be imported from a project with… | MEDIUM 5.4EPSS 33.0% | 27 June 2024 |
| CVE-2024-5016 | In WhatsUp Gold versions released before 2023.1.3, Distributed Edition installations can be exploited by using a deserialization tool to achieve a Remote Code Execution as SYSTEM. | HIGH 7.2EPSS 22.4% | 25 June 2024 |
| CVE-2024-37843 | Craft CMS up to v3.7.31 was discovered to contain a SQL injection vulnerability via the GraphQL API endpoint. | CRITICAL 9.8EPSS 53.2% | 25 June 2024 |
| CVE-2024-5276 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. | CRITICAL 9.1EPSS 90.1% | 25 June 2024 |
| CVE-2024-5011 | In WhatsUp Gold versions released before 2023.1.3, an uncontrolled resource consumption vulnerability exists. | HIGH 7.5EPSS 47.1% | 25 June 2024 |
| CVE-2024-5010 | In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. | HIGH 7.5EPSS 70.0% | 25 June 2024 |
| CVE-2024-5009 | In WhatsUp Gold versions released before 2023.1.3, an Improper Access Control vulnerability in Wug.UI.Controllers.InstallController.SetAdminPassword allows local attackers to modify admin's password. | HIGH 8.4EPSS 17.4% | 25 June 2024 |
| CVE-2024-5008 | In WhatsUp Gold versions released before 2023.1.3, an authenticated user with certain permissions can upload an arbitrary file and obtain RCE using Apm.UI.Areas.APM.Controllers.Api.Applications.AppProfileImportController. | HIGH 8.8EPSS 17.3% | 25 June 2024 |
| CVE-2024-4885 | Progress WhatsUp Gold Path Traversal Vulnerability | KEVCRITICAL 9.8EPSS 99.3% | 25 June 2024 |
| CVE-2024-4884 | In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. | CRITICAL 9.8EPSS 24.3% | 25 June 2024 |
| CVE-2024-4883 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. | CRITICAL 9.8EPSS 64.5% | 25 June 2024 |
| CVE-2024-5806 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2. | CRITICAL 9.8EPSS 81.5% | 25 June 2024 |
| CVE-2024-37085 | VMware ESXi Authentication Bypass Vulnerability | KEVHIGH 7.2EPSS 26.8% | 25 June 2024 |
| CVE-2024-6028 | The Quiz Maker plugin for WordPress is vulnerable to time-based SQL Injection via the 'ays_questions' parameter in all versions up to, and including, 6.5.8.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation… | CRITICAL 9.8EPSS 11.8% | 25 June 2024 |
| CVE-2024-37732 | Cross Site Scripting vulnerability in Anchor CMS v.0.12.7 allows a remote attacker to execute arbitrary code via a crafted .pdf file. | MEDIUM 6.1EPSS 16.6% | 24 June 2024 |
| CVE-2024-27136 | XSS in Upload page in Apache JSPWiki 2.12.1 and priors allows the attacker to execute javascript in the victim's browser and get some sensitive information about the victim. | MEDIUM 6.1EPSS 60.8% | 24 June 2024 |
| CVE-2024-6269 | A vulnerability has been found in Ruijie RG-UAC 1.0 and classified as critical. | MEDIUM 5.1EPSS 20.6% | 23 June 2024 |
| CVE-2024-21518 | A Zip Slip issue was identified via the marketplace installer due to improper sanitization of the target path, allowing files within a malicious archive to traverse the filesystem and be extracted to arbitrary locations. | HIGH 7.2EPSS 14.1% | 22 June 2024 |
| CVE-2024-21514 | An SQL Injection issue was identified in the Divido payment extension for OpenCart, which is included by default in version 3.0.3.9. | HIGH 8.1EPSS 19.1% | 22 June 2024 |
| CVE-2014-5470 | Actual Analyzer through 2014-08-29 allows code execution via shell metacharacters because untrusted input is used for part of the input data passed to an eval operation. | EXPLOIT ✓CRITICAL 9.8EPSS 10.0% | 21 June 2024 |
| CVE-2012-6664 | Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. | EXPLOIT ✓CRITICAL 9.1EPSS 29.5% | 21 June 2024 |
| CVE-2024-5182 | A path traversal vulnerability exists in mudler/localai version 2.14.0, where an attacker can exploit the `model` parameter during the model deletion process to delete arbitrary files. | CRITICAL 9.1EPSS 25.5% | 20 June 2024 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.