Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,196 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 40 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-6989 | The Shield Security – Smart Bot Blocking & Intrusion Prevention Security plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 18.5.9 via the render_action_template parameter. | CRITICAL 9.8EPSS 56.6% | 5 February 2024 |
| CVE-2023-6933 | The Better Search Replace plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 1.4.4 via deserialization of untrusted input. | HIGH 8.8EPSS 68.0% | 5 February 2024 |
| CVE-2023-6846 | The File Manager Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 8.3.4 via the mk_check_filemanager_php_syntax AJAX function. | HIGH 8.8EPSS 15.9% | 5 February 2024 |
| CVE-2024-22567 | File Upload vulnerability in MCMS 5.3.5 allows attackers to upload arbitrary files via crafted POST request to /ms/file/upload.do. | HIGH 8.8EPSS 17.8% | 5 February 2024 |
| CVE-2024-23108 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests. | CRITICAL 9.8EPSS 80.3% | 5 February 2024 |
| CVE-2024-22320 | IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. | HIGH 8.8EPSS 73.4% | 2 February 2024 |
| CVE-2024-22319 | IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. | CRITICAL 9.8EPSS 76.4% | 2 February 2024 |
| CVE-2024-24747 | The vulnerability is fixed in RELEASE.2024-01-31T20-20-33Z. | EXPLOITHIGH 8.8EPSS 34.1% | 31 January 2024 |
| CVE-2024-21626 | In runc 1.1.11 and earlier, due to an internal file descriptor leak, an attacker could cause a newly-spawned container process (from runc exec) to have a working directory in the host filesystem namespace, allowing for a container escape by giving… | HIGH 8.6EPSS 18.9% | 31 January 2024 |
| CVE-2024-21893 | Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability | KEVHIGH 8.2EPSS 100.0% | 31 January 2024 |
| CVE-2024-21888 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator. | HIGH 8.8EPSS 85.4% | 31 January 2024 |
| CVE-2024-1086 | Linux Kernel Use-After-Free Vulnerability | KEVHIGH 7.8EPSS 28.1% | 31 January 2024 |
| CVE-2024-21388 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | MEDIUM 6.5EPSS 32.0% | 30 January 2024 |
| CVE-2024-1061 | The 'HTML5 Video Player' WordPress Plugin, version < 2.5.25 is affected by an unauthenticated SQL injection vulnerability in the 'id' parameter in the 'get_view' function. | CRITICAL 9.8EPSS 11.1% | 30 January 2024 |
| CVE-2023-5372 | The post-authentication command injection vulnerability in Zyxel NAS326 firmware versions through V5.21(AAZF.15)C0 and NAS542 firmware versions through V5.21(ABAG.12)C0 could allow an authenticated attacker with administrator privileges to execute some… | HIGH 7.2EPSS 28.5% | 30 January 2024 |
| CVE-2024-23334 | This can lead to directory traversal vulnerabilities, resulting in unauthorized access to arbitrary files on the system, even when symlinks are not present. | EXPLOITHIGH 7.5EPSS 76.9% | 29 January 2024 |
| CVE-2024-1021 | A vulnerability, which was classified as critical, has been found in Rebuild up to 3.5.5. | CRITICAL 9.8EPSS 34.7% | 29 January 2024 |
| CVE-2023-6389 | This makes it possible for unauthenticated attackers to redirect users to potentially malicious sites if they can successfully trick them into performing an action. | MEDIUM 6.1EPSS 26.8% | 29 January 2024 |
| CVE-2024-0986 | A vulnerability was found in Issabel PBX 4.0.0. | CRITICAL 9.8EPSS 58.2% | 29 January 2024 |
| CVE-2024-0939 | A vulnerability has been found in Byzoro Smart S210 Management Platform up to 20240117 and classified as critical. | CRITICAL 9.8EPSS 43.8% | 26 January 2024 |
| CVE-2024-0930 | A vulnerability classified as critical has been found in Tenda AC10U 15.03.06.49_multi_TDE01. | CRITICAL 9.8EPSS 15.2% | 26 January 2024 |
| CVE-2024-0921 | A vulnerability has been found in D-Link DIR-816 A2 1.10CNB04 and classified as critical. | CRITICAL 9.8EPSS 37.6% | 26 January 2024 |
| CVE-2024-0919 | A vulnerability was found in TRENDnet TEW-815DAP 1.0.2.0. | HIGH 7.2EPSS 22.5% | 26 January 2024 |
| CVE-2024-0918 | A vulnerability was found in TRENDnet TEW-800MB 1.0.1.0 and classified as critical. | HIGH 7.2EPSS 25.4% | 26 January 2024 |
| CVE-2024-24399 | An arbitrary file upload vulnerability in LEPTON v7.0.0 allows authenticated attackers to execute arbitrary PHP code by uploading this code to the backend/languages/index.php languages area. | HIGH 7.2EPSS 15.6% | 25 January 2024 |
| CVE-2023-52251 | An issue discovered in provectus kafka-ui 0.4.0 through 0.7.2 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. | HIGH 8.8EPSS 86.8% | 25 January 2024 |
| CVE-2023-41474 | Directory Traversal vulnerability in Ivanti Avalanche 6.3.4.153 allows a remote authenticated attacker to obtain sensitive information via the javax.faces.resource component. | MEDIUM 6.5EPSS 37.6% | 25 January 2024 |
| CVE-2024-22729 | NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. | CRITICAL 9.8EPSS 70.8% | 25 January 2024 |
| CVE-2024-23898 | Jenkins 2.217 through 2.441 (both inclusive), LTS 2.222.1 through 2.426.2 (both inclusive) does not perform origin validation of requests made through the CLI WebSocket endpoint, resulting in a cross-site WebSocket hijacking (CSWSH) vulnerability,… | HIGH 8.8EPSS 67.2% | 24 January 2024 |
| CVE-2024-23897 | Jenkins Command Line Interface (CLI) Path Traversal Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 24 January 2024 |
| CVE-2024-22651 | There is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04. | CRITICAL 9.8EPSS 20.2% | 24 January 2024 |
| CVE-2024-23638 | Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. | MEDIUM 6.5EPSS 60.1% | 24 January 2024 |
| CVE-2023-36177 | An issue was discovered in badaix Snapcast version 0.27.0, allows remote attackers to execute arbitrary code and gain sensitive information via crafted request in JSON-RPC-API. | CRITICAL 9.8EPSS 27.5% | 23 January 2024 |
| CVE-2024-23222 | Apple Multiple Products WebKit Type Confusion Vulnerability | KEVHIGH 8.8EPSS 10.6% | 23 January 2024 |
| CVE-2024-0204 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. | EXPLOITCRITICAL 9.8EPSS 95.1% | 22 January 2024 |
| CVE-2024-0778 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, has been found in Uniview ISC 2500-S up to 20210930. | CRITICAL 9.8EPSS 32.1% | 22 January 2024 |
| CVE-2024-0769 | D-Link DIR-859 Router Path Traversal Vulnerability | KEVCRITICAL 9.8EPSS 82.7% | 21 January 2024 |
| CVE-2024-0717 | A vulnerability classified as critical was found in D-Link DAP-1360, DIR-300, DIR-615, DIR-615GF, DIR-615S, DIR-615T, DIR-620, DIR-620S, DIR-806A, DIR-815, DIR-815AC, DIR-815S, DIR-816, DIR-820, DIR-822, DIR-825, DIR-825AC, DIR-825ACF, DIR-825ACG1,… | MEDIUM 5.3EPSS 18.2% | 19 January 2024 |
| CVE-2024-21733 | Generation of Error Message Containing Sensitive Information vulnerability in Apache Tomcat.This issue affects Apache Tomcat: from 8.5.7 through 8.5.63, from 9.0.0-M11 through 9.0.43. | MEDIUM 5.3EPSS 14.3% | 19 January 2024 |
| CVE-2023-6184 | Cross SiteScripting vulnerability in Citrix Session Recording allows attacker to perform Cross Site Scripting | HIGH 7.2EPSS 46.9% | 18 January 2024 |
| CVE-2023-6549 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | KEVHIGH 7.5EPSS 57.6% | 17 January 2024 |
| CVE-2023-5914 | Cross-site scripting (XSS) | MEDIUM 6.1EPSS 75.5% | 17 January 2024 |
| CVE-2024-0517 | Out of bounds write in V8 in Google Chrome prior to 120.0.6099.224 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 21.7% | 16 January 2024 |
| CVE-2024-0507 | An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. | HIGH 8.8EPSS 65.8% | 16 January 2024 |
| CVE-2024-0200 | An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. | CRITICAL 9.8EPSS 71.7% | 16 January 2024 |
| CVE-2023-22512 | This High severity DoS (Denial of Service) vulnerability was introduced in version 5.6.0 of Confluence Data Center and Server. | HIGH 7.5EPSS 15.1% | 16 January 2024 |
| CVE-2024-0235 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog | MEDIUM 5.3EPSS 38.0% | 16 January 2024 |
| CVE-2022-1609 | The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site. | CRITICAL 9.8EPSS 64.1% | 16 January 2024 |
| CVE-2024-0582 | A memory leak flaw was found in the Linux kernel’s io_uring functionality in how a user registers a buffer ring with IORING_REGISTER_PBUF_RING, mmap() it, and then frees it. | HIGH 7.8EPSS 12.8% | 16 January 2024 |
| CVE-2023-22527 | Atlassian Confluence Data Center and Server Template Injection Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 16 January 2024 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.