Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,196 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 37 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2024-3274 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability has been found in D-Link DNS-320L, DNS-320LW and DNS-327L up to 20240403 and classified as problematic. | MEDIUM 5.3EPSS 33.5% | 4 April 2024 |
| CVE-2024-3273 | D-Link Multiple NAS Devices Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 4 April 2024 |
| CVE-2024-3272 | D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability | KEVCRITICAL 9.8EPSS 98.1% | 4 April 2024 |
| CVE-2024-2758 | Tempesta FW rate limits are not enabled by default. | MEDIUM 6.3EPSS 67.7% | 3 April 2024 |
| CVE-2024-2653 | amphp/http will collect CONTINUATION frames in an unbounded buffer and will not check a limit until it has received the set END_HEADERS flag, resulting in an OOM crash. | HIGH 8.2EPSS 80.3% | 3 April 2024 |
| CVE-2024-30571 | An information leak in the BRS_top.html component of Netgear R6850 v1.1.0.88 allows attackers to obtain sensitive information without any authentication required. | HIGH 7.5EPSS 13.8% | 3 April 2024 |
| CVE-2024-30568 | Netgear R6850 1.1.0.88 was discovered to contain a command injection vulnerability via the c4-IPAddr parameter. | CRITICAL 9.8EPSS 46.9% | 3 April 2024 |
| CVE-2024-2879 | The LayerSlider plugin for WordPress is vulnerable to SQL Injection via the ls_get_popup_markup action in versions 7.9.11 and 7.10.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. | HIGH 7.5EPSS 18.4% | 3 April 2024 |
| CVE-2024-24724 | Gibbon through 26.0.00 allows /modules/School%20Admin/messengerSettings.php Server Side Template Injection leading to Remote Code Execution because input is passed to the Twig template engine (messengerSettings.php) without sanitization. | EXPLOITCRITICAL 9.8EPSS 26.1% | 3 April 2024 |
| CVE-2024-2389 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. | CRITICAL 9.8EPSS 93.0% | 2 April 2024 |
| CVE-2024-29276 | An issue was discovered in seeyonOA version 8, allows remote attackers to execute arbitrary code via the importProcess method in WorkFlowDesignerController.class component. | CRITICAL 9.8EPSS 32.8% | 2 April 2024 |
| CVE-2024-23118 | Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability. | HIGH 7.2EPSS 53.4% | 1 April 2024 |
| CVE-2024-23117 | Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability. | HIGH 7.2EPSS 53.4% | 1 April 2024 |
| CVE-2024-23116 | Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability. | HIGH 7.2EPSS 53.4% | 1 April 2024 |
| CVE-2024-23115 | Centreon updateGroups SQL Injection Remote Code Execution Vulnerability. | HIGH 7.2EPSS 67.5% | 1 April 2024 |
| CVE-2024-0637 | Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability. | HIGH 8.8EPSS 72.3% | 1 April 2024 |
| CVE-2023-51573 | Voltronic Power ViewPower Pro updateManagerPassword Exposed Dangerous Function Authentication Bypass Vulnerability. | CRITICAL 9.8EPSS 45.7% | 1 April 2024 |
| CVE-2023-51572 | Voltronic Power ViewPower Pro getMacAddressByIp Command Injection Remote Code Execution Vulnerability. | CRITICAL 9.8EPSS 38.4% | 1 April 2024 |
| CVE-2023-41724 | A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network. | HIGH 8.8EPSS 12.8% | 31 March 2024 |
| CVE-2024-3094 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. | CRITICAL 10.0EPSS 90.9% | 29 March 2024 |
| CVE-2023-49231 | An authentication bypass vulnerability was found in Stilog Visual Planning 8. | CRITICAL 9.8EPSS 42.9% | 29 March 2024 |
| CVE-2024-30491 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Metagauss ProfileGrid.This issue affects ProfileGrid : from n/a through 5.7.8. | HIGH 8.8EPSS 32.0% | 29 March 2024 |
| CVE-2024-31138 | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings | MEDIUM 5.4EPSS 74.7% | 28 March 2024 |
| CVE-2024-3013 | Executing manipulation can lead to improper authorization. | LOW 2.1EPSS 23.0% | 28 March 2024 |
| CVE-2024-2398 | When an application tells libcurl it wants to allow HTTP/2 server push, and the amount of received headers for the push surpasses the maximum allowed limit (1000), libcurl aborts the server push. | HIGH 8.6EPSS 36.1% | 27 March 2024 |
| CVE-2023-40289 | A command injection issue was discovered on Supermicro X11SSM-F, X11SAE-F, and X11SSE-F 1.66 devices. | HIGH 7.2EPSS 18.4% | 27 March 2024 |
| CVE-2024-25735 | Remote attackers can discover cleartext passwords via a SoftAP /device/config GET request. | EXPLOITCRITICAL 9.1EPSS 50.6% | 27 March 2024 |
| CVE-2024-2887 | Type Confusion in WebAssembly in Google Chrome prior to 123.0.6312.86 allowed a remote attacker to execute arbitrary code via a crafted HTML page. | HIGH 7.7EPSS 17.9% | 26 March 2024 |
| CVE-2024-2863 | This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. | CRITICAL 9.8EPSS 64.0% | 25 March 2024 |
| CVE-2024-2862 | This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. | CRITICAL 9.8EPSS 51.0% | 25 March 2024 |
| CVE-2024-24725 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI. | HIGH 8.8EPSS 51.6% | 23 March 2024 |
| CVE-2024-29059 | Microsoft .NET Framework Information Disclosure Vulnerability | KEVHIGH 7.5EPSS 98.6% | 23 March 2024 |
| CVE-2024-2449 | A cross-site request forgery vulnerability has been identified in LoadMaster. | HIGH 7.5EPSS 12.9% | 22 March 2024 |
| CVE-2024-2448 | An OS command injection vulnerability has been identified in LoadMaster. | HIGH 8.8EPSS 55.4% | 22 March 2024 |
| CVE-2024-29943 | An attacker was able to perform an out-of-bounds read or write on a JavaScript object by fooling range-based bounds check elimination. | CRITICAL 9.8EPSS 22.9% | 22 March 2024 |
| CVE-2024-27921 | A file upload path traversal vulnerability has been identified in the application prior to version 1.7.45, enabling attackers to replace or create files with extensions like .json, .zip, .css, .gif, etc. | HIGH 8.8EPSS 60.6% | 21 March 2024 |
| CVE-2024-27956 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in ValvePress Automatic allows SQL Injection.This issue affects Automatic: from n/a through 3.92.0. | CRITICAL 9.8EPSS 94.1% | 21 March 2024 |
| CVE-2024-1538 | The File Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 7.2.4. | HIGH 8.8EPSS 10.7% | 21 March 2024 |
| CVE-2024-2054 | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. | EXPLOITCRITICAL 9.8EPSS 81.3% | 21 March 2024 |
| CVE-2024-2053 | The Artica Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. | HIGH 7.5EPSS 44.6% | 21 March 2024 |
| CVE-2024-27292 | The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. | HIGH 7.5EPSS 69.5% | 21 March 2024 |
| CVE-2024-2625 | Object lifecycle issue in V8 in Google Chrome prior to 123.0.6312.58 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. | HIGH 8.8EPSS 21.4% | 20 March 2024 |
| CVE-2024-1800 | In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability. | HIGH 8.8EPSS 34.2% | 20 March 2024 |
| CVE-2024-23333 | LAM's log configuration allows to specify arbitrary paths for log files. | MEDIUM 6.6EPSS 17.8% | 18 March 2024 |
| CVE-2024-27098 | An authenticated user can execute a SSRF based attack using Arbitrary Object Instantiation. | CRITICAL 9.6EPSS 35.7% | 18 March 2024 |
| CVE-2024-27096 | An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. | MEDIUM 6.5EPSS 58.8% | 18 March 2024 |
| CVE-2024-27937 | GLPI is a Free Asset and IT Management Software package, Data center management, ITIL Service Desk, licenses tracking and software auditing. | MEDIUM 4.3EPSS 27.1% | 18 March 2024 |
| CVE-2024-20767 | Adobe ColdFusion Improper Access Control Vulnerability | KEVEXPLOITHIGH 7.4EPSS 98.5% | 18 March 2024 |
| CVE-2024-28640 | Buffer Overflow vulnerability in TOTOLink X5000R V9.1.0u.6118-B20201102 and A7000R V9.1.0u.6115-B20201022 allows a remote attacker to cause a denial of service (D0S) via the command field. | HIGH 7.5EPSS 14.2% | 16 March 2024 |
| CVE-2024-28255 | Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. | CRITICAL 9.8EPSS 73.3% | 15 March 2024 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.