Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,196 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 36 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-39367 | An OS command injection vulnerability exists in the web interface mac2name functionality of Peplink Smart Reader v1.2.0 (in QEMU). | HIGH 7.2EPSS 37.7% | 17 April 2024 |
| CVE-2024-3833 | Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. | HIGH 8.8EPSS 17.6% | 17 April 2024 |
| CVE-2023-40000 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through 5.7. | MEDIUM 6.1EPSS 54.9% | 16 April 2024 |
| CVE-2024-2083 | A directory traversal vulnerability exists in the zenml-io/zenml repository, specifically within the /api/v1/steps endpoint. | CRITICAL 9.9EPSS 37.5% | 16 April 2024 |
| CVE-2024-1601 | An SQL injection vulnerability exists in the `delete_discussion()` function of the parisneo/lollms-webui application, allowing an attacker to delete all discussions and message data. | CRITICAL 9.8EPSS 40.4% | 16 April 2024 |
| CVE-2024-3721 | A vulnerability was found in TBK DVR-4104 and DVR-4216 up to 20240412 and classified as critical. | MEDIUM 6.3EPSS 86.5% | 13 April 2024 |
| CVE-2023-51409 | Unrestricted Upload of File with Dangerous Type vulnerability in Jordy Meow AI Engine: ChatGPT Chatbot.This issue affects AI Engine: ChatGPT Chatbot: from n/a through 1.9.98. | CRITICAL 9.8EPSS 63.1% | 12 April 2024 |
| CVE-2024-3054 | WPvivid Backup & Migration Plugin for WordPress is vulnerable to PHAR Deserialization in all versions up to, and including, 0.9.99 via deserialization of untrusted input at the wpvividstg_get_custom_exclude_path_free action. | HIGH 7.2EPSS 41.5% | 12 April 2024 |
| CVE-2024-3400 | Palo Alto Networks PAN-OS Command Injection Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 100.0% | 12 April 2024 |
| CVE-2024-25852 | Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. | HIGH 8.8EPSS 16.5% | 11 April 2024 |
| CVE-2024-0881 | The Post Grid, Form Maker, Popup Maker, WooCommerce Blocks, Post Blocks, Post Carousel WordPress plugin before 2.2.76 does not have proper authorization, resulting in password protected posts to be displayed in the result of some unauthenticated AJAX… | MEDIUM 5.4EPSS 16.9% | 11 April 2024 |
| CVE-2024-31997 | Prior to versions 4.10.19, 15.5.4, and 15.10-rc-1, parameters of UI extensions are always interpreted as Velocity code and executed with programming rights. | HIGH 8.8EPSS 73.9% | 10 April 2024 |
| CVE-2024-31984 | Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the (Solr-based) search in XWiki. | HIGH 8.8EPSS 83.0% | 10 April 2024 |
| CVE-2024-31982 | Starting in version 2.4-milestone-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, XWiki's database search allows remote code execution through the search text. | CRITICAL 9.8EPSS 34.5% | 10 April 2024 |
| CVE-2024-31819 | An issue in WWBN AVideo v.12.4 through v.14.2 allows a remote attacker to execute arbitrary code via the systemRootPath parameter of the submitIndex.php component. | CRITICAL 9.8EPSS 15.6% | 10 April 2024 |
| CVE-2024-31465 | Starting in version 5.0-rc-1 and prior to versions 14.10.20, 15.5.4, and 15.9-rc-1, any user with edit right on any page can execute any code on the server by adding an object of type `XWiki.SearchSuggestSourceClass` to their user profile or any other… | HIGH 8.8EPSS 75.6% | 10 April 2024 |
| CVE-2024-31214 | Traccar versions 5.1 through 5.12 allow arbitrary files to be uploaded through the device image upload API. | CRITICAL 9.6EPSS 17.6% | 10 April 2024 |
| CVE-2024-1728 | gradio-app/gradio is vulnerable to a local file inclusion vulnerability due to improper validation of user-supplied input in the UploadButton component. | HIGH 7.5EPSS 85.4% | 10 April 2024 |
| CVE-2024-1600 | A Local File Inclusion (LFI) vulnerability exists in the parisneo/lollms-webui application, specifically within the `/personalities` route. | CRITICAL 9.3EPSS 32.5% | 10 April 2024 |
| CVE-2024-1520 | An OS Command Injection vulnerability exists in the '/open_code_folder' endpoint of the parisneo/lollms-webui application, due to improper validation of user-supplied input in the 'discussion_id' parameter. | CRITICAL 9.8EPSS 48.2% | 10 April 2024 |
| CVE-2024-24809 | Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. | HIGH 8.5EPSS 54.4% | 10 April 2024 |
| CVE-2024-31309 | HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. | HIGH 7.5EPSS 94.6% | 10 April 2024 |
| CVE-2024-3097 | The WordPress Gallery Plugin – NextGEN Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_item function in versions up to, and including, 3.59. | MEDIUM 5.3EPSS 38.0% | 9 April 2024 |
| CVE-2024-2340 | The Avada theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 7.11.6 via the '/wp-content/uploads/fusion-forms/' directory. | MEDIUM 5.3EPSS 28.0% | 9 April 2024 |
| CVE-2024-24576 | An attacker able to control the arguments passed to the spawned process could execute arbitrary shell commands by bypassing the escaping. | CRITICAL 10.0EPSS 20.3% | 9 April 2024 |
| CVE-2024-29990 | Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability | CRITICAL 9.0EPSS 18.0% | 9 April 2024 |
| CVE-2024-29988 | Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability | KEVHIGH 8.8EPSS 45.2% | 9 April 2024 |
| CVE-2024-26256 | Libarchive Remote Code Execution Vulnerability | HIGH 7.8EPSS 87.9% | 9 April 2024 |
| CVE-2024-26230 | Windows Telephony Server Elevation of Privilege Vulnerability | HIGH 7.8EPSS 24.1% | 9 April 2024 |
| CVE-2024-26218 | Windows Kernel Elevation of Privilege Vulnerability | HIGH 7.8EPSS 12.9% | 9 April 2024 |
| CVE-2024-26212 | DHCP Server Service Denial of Service Vulnerability | HIGH 7.5EPSS 62.6% | 9 April 2024 |
| CVE-2024-26209 | Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability | MEDIUM 5.5EPSS 14.8% | 9 April 2024 |
| CVE-2024-26158 | Microsoft Install Service Elevation of Privilege Vulnerability | HIGH 7.8EPSS 12.3% | 9 April 2024 |
| CVE-2023-49074 | A denial of service vulnerability exists in the TDDP functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926. | HIGH 7.5EPSS 13.5% | 9 April 2024 |
| CVE-2024-27983 | An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. | HIGH 8.2EPSS 87.2% | 9 April 2024 |
| CVE-2024-30269 | DataEase, an open source data visualization and analysis tool, has a database configuration information exposure vulnerability prior to version 2.5.0. | EXPLOITMEDIUM 5.3EPSS 15.9% | 8 April 2024 |
| CVE-2024-2511 | Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that would lead to a… | MEDIUM 5.9EPSS 52.4% | 8 April 2024 |
| CVE-2024-31817 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg. | HIGH 7.5EPSS 55.3% | 8 April 2024 |
| CVE-2024-28741 | Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component. | HIGH 8.8EPSS 78.2% | 6 April 2024 |
| CVE-2024-3156 | Inappropriate implementation in V8 in Google Chrome prior to 123.0.6312.105 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. | HIGH 8.8EPSS 12.9% | 6 April 2024 |
| CVE-2024-3378 | A vulnerability has been found in iboss Secure Web Gateway up to 10.1 and classified as problematic. | MEDIUM 6.1EPSS 23.1% | 6 April 2024 |
| CVE-2024-3346 | A vulnerability was found in Byzoro Smart S80 up to 20240328. | MEDIUM 6.3EPSS 49.3% | 5 April 2024 |
| CVE-2024-21894 | A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. | CRITICAL 9.8EPSS 19.0% | 4 April 2024 |
| CVE-2024-30270 | A security vulnerability has been identified in mailcow affecting versions prior to 2024-04. | MEDIUM 6.2EPSS 27.3% | 4 April 2024 |
| CVE-2023-45288 | An attacker may cause an HTTP/2 endpoint to read arbitrary amounts of header data by sending an excessive number of CONTINUATION frames. | HIGH 7.5EPSS 92.0% | 4 April 2024 |
| CVE-2024-30255 | The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. | HIGH 7.5EPSS 87.8% | 4 April 2024 |
| CVE-2024-27316 | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. | HIGH 7.5EPSS 91.3% | 4 April 2024 |
| CVE-2024-3116 | pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. | CRITICAL 9.8EPSS 65.8% | 4 April 2024 |
| CVE-2024-28182 | This causes excessive CPU usage to decode HPACK stream. nghttp2 v1.61.0 mitigates this vulnerability by limiting the number of CONTINUATION frames it accepts per stream. | MEDIUM 5.3EPSS 85.0% | 4 April 2024 |
| CVE-2024-27919 | In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. | HIGH 7.5EPSS 86.7% | 4 April 2024 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.