Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,196 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 41 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-6623 | The Essential Blocks WordPress plugin before 4.4.3 does not prevent unauthenticated attackers from overwriting local variables when rendering templates over the REST API, which may lead to Local File Inclusion attacks. | CRITICAL 9.8EPSS 50.7% | 15 January 2024 |
| CVE-2023-6620 | The POST SMTP Mailer WordPress plugin before 2.8.7 does not properly sanitise and escape several parameters before using them in SQL statements, leading to a SQL injection exploitable by high privilege users such as admin. | HIGH 7.2EPSS 14.1% | 15 January 2024 |
| CVE-2023-50290 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Solr. | MEDIUM 6.5EPSS 68.4% | 15 January 2024 |
| CVE-2024-21887 | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability | KEVCRITICAL 9.1EPSS 100.0% | 12 January 2024 |
| CVE-2023-46805 | Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability | KEVHIGH 8.2EPSS 100.0% | 12 January 2024 |
| CVE-2023-7028 | GitLab Community and Enterprise Editions Improper Access Control Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 94.5% | 12 January 2024 |
| CVE-2023-50919 | There is an NGINX authentication bypass via Lua string pattern matching. | CRITICAL 9.8EPSS 47.8% | 12 January 2024 |
| CVE-2024-21591 | An Out-of-bounds Write vulnerability in J-Web of Juniper Networks Junos OS on SRX Series and EX Series allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS), or Remote Code Execution (RCE) and obtain root privileges on the… | CRITICAL 9.8EPSS 17.7% | 12 January 2024 |
| CVE-2023-46474 | File Upload vulnerability PMB v.7.4.8 allows a remote attacker to execute arbitrary code and escalate privileges via a crafted PHP file uploaded to the start_import.php file. | HIGH 7.2EPSS 21.2% | 11 January 2024 |
| CVE-2023-6875 | The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a type juggling issue on the connect-app REST endpoint in… | CRITICAL 9.8EPSS 90.3% | 11 January 2024 |
| CVE-2023-6567 | The LearnPress plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order_by’ parameter in all versions up to, and including, 4.2.5.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on… | HIGH 7.5EPSS 51.4% | 11 January 2024 |
| CVE-2023-4372 | The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'esi' shortcode in versions up to, and including, 5.6 due to insufficient input sanitization and output escaping on user supplied attributes. | MEDIUM 5.4EPSS 19.5% | 11 January 2024 |
| CVE-2023-51123 | An issue discovered in D-Link dir815 v.1.01SSb08.bin allows a remote attacker to execute arbitrary code via a crafted POST request to the service parameter in the soapcgi_main function of the cgibin binary component. | CRITICAL 9.8EPSS 24.4% | 10 January 2024 |
| CVE-2023-51126 | Command injection vulnerability in /usr/www/res.php in FLIR AX8 up to 1.46.16 allows attackers to run arbitrary commands via the value parameter. | CRITICAL 9.8EPSS 31.1% | 10 January 2024 |
| CVE-2023-48783 | An Authorization Bypass Through User-Controlled Key vulnerability [CWE-639] affecting PortiPortal version 7.2.1 and below, version 7.0.6 and below, version 6.0.14 and below, version 5.3.8 and below may allow a remote authenticated user with at least… | MEDIUM 5.4EPSS 22.2% | 10 January 2024 |
| CVE-2023-31446 | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. | CRITICAL 9.8EPSS 61.1% | 10 January 2024 |
| CVE-2024-0352 | A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. | CRITICAL 9.8EPSS 72.9% | 9 January 2024 |
| CVE-2024-21320 | Windows Themes Spoofing Vulnerability | EXPLOITMEDIUM 6.5EPSS 22.6% | 9 January 2024 |
| CVE-2024-21318 | Microsoft SharePoint Server Remote Code Execution Vulnerability | HIGH 8.8EPSS 30.8% | 9 January 2024 |
| CVE-2024-21310 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | HIGH 7.8EPSS 11.6% | 9 January 2024 |
| CVE-2024-20697 | Windows libarchive Remote Code Execution Vulnerability | HIGH 7.3EPSS 72.2% | 9 January 2024 |
| CVE-2024-20674 | Windows Kerberos Security Feature Bypass Vulnerability | HIGH 8.8EPSS 17.2% | 9 January 2024 |
| CVE-2023-49237 | Command injection can occur because the system function is used by davinci to unpack language packs without strict filtering of URL strings. | CRITICAL 9.8EPSS 18.6% | 9 January 2024 |
| CVE-2022-45354 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WPChill Download Monitor.This issue affects Download Monitor: from n/a through 4.7.60. | HIGH 7.5EPSS 38.1% | 8 January 2024 |
| CVE-2023-6505 | The Migrate WordPress Website & Backups WordPress plugin before 1.9.3 does not prevent directory listing in sensitive directories containing export files. | HIGH 7.5EPSS 39.9% | 8 January 2024 |
| CVE-2022-2586 | Linux Kernel Use-After-Free Vulnerability | KEVHIGH 7.8EPSS 10.2% | 8 January 2024 |
| CVE-2024-21650 | XWiki is vulnerable to a remote code execution (RCE) attack through its user registration feature. | CRITICAL 9.8EPSS 93.5% | 8 January 2024 |
| CVE-2023-47211 | A directory traversal vulnerability exists in the uploadMib functionality of ManageEngine OpManager 12.7.258. | HIGH 8.6EPSS 47.0% | 8 January 2024 |
| CVE-2024-21645 | A log injection vulnerability was identified in `pyload` allowing any unauthenticated actor to inject arbitrary messages into the logs gathered by `pyload`. | MEDIUM 5.3EPSS 24.7% | 8 January 2024 |
| CVE-2024-21644 | Any unauthenticated user can browse to a specific URL to expose the Flask config, including the `SECRET_KEY` variable. | HIGH 7.5EPSS 42.4% | 8 January 2024 |
| CVE-2024-0305 | A vulnerability was found in Guangzhou Yingke Electronic Technology Ncast up to 2017 and classified as problematic. | HIGH 7.5EPSS 66.9% | 8 January 2024 |
| CVE-2024-0265 | A vulnerability was found in SourceCodester Clinic Queuing System 1.0. | HIGH 8.8EPSS 20.9% | 7 January 2024 |
| CVE-2024-0264 | A vulnerability was found in SourceCodester Clinic Queuing System 1.0. | CRITICAL 9.8EPSS 18.2% | 7 January 2024 |
| CVE-2024-0223 | Heap buffer overflow in ANGLE in Google Chrome prior to 120.0.6099.199 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 10.2% | 4 January 2024 |
| CVE-2023-49442 | Deserialization of Untrusted Data in jeecgFormDemoController in JEECG 4.0 and earlier allows attackers to run arbitrary code via crafted POST request. | CRITICAL 9.8EPSS 38.5% | 3 January 2024 |
| CVE-2024-21907 | Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. | HIGH 7.5EPSS 32.9% | 3 January 2024 |
| CVE-2024-0195 | A vulnerability, which was classified as critical, was found in spider-flow 0.4.3. | CRITICAL 9.8EPSS 19.3% | 2 January 2024 |
| CVE-2023-50094 | reNgine before 2.1.2 allows OS Command Injection if an adversary has a valid session ID. | HIGH 8.8EPSS 13.5% | 1 January 2024 |
| CVE-2023-50071 | Sourcecodester Customer Support System 1.0 has multiple SQL injection vulnerabilities in /customer_support/ajax.php?action=save_department via id or name. | HIGH 8.8EPSS 13.8% | 29 December 2023 |
| CVE-2023-52085 | This had the potential to lead to a Local File Inclusion vulnerability. | MEDIUM 5.4EPSS 30.2% | 29 December 2023 |
| CVE-2023-7137 | A vulnerability, which was classified as critical, has been found in code-projects Client Details System 1.0. | HIGH 8.8EPSS 17.0% | 28 December 2023 |
| CVE-2023-6114 | The Duplicator WordPress plugin before 1.5.7.1, Duplicator Pro WordPress plugin before 4.5.14.2 does not disallow listing the `backups-dup-lite/tmp` directory (or the `backups-dup-pro/tmp` directory in the Pro version), which temporarily stores files… | HIGH 7.5EPSS 30.9% | 26 December 2023 |
| CVE-2023-5674 | The WP Mail Log WordPress plugin before 1.1.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Contributor. | HIGH 8.8EPSS 10.8% | 26 December 2023 |
| CVE-2023-51092 | Tenda M3 V1.0.0.12(4856) was discovered to contain a stack overflow via the function upgrade. | CRITICAL 9.8EPSS 12.9% | 26 December 2023 |
| CVE-2023-51467 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code | CRITICAL 9.8EPSS 96.0% | 26 December 2023 |
| CVE-2023-50968 | Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. | HIGH 7.5EPSS 63.4% | 26 December 2023 |
| CVE-2022-34267 | Adding a token parameter with the value of 02 bypasses all authentication requirements. | CRITICAL 9.8EPSS 42.2% | 25 December 2023 |
| CVE-2023-7095 | A vulnerability, which was classified as critical, has been found in Totolink A7100RU 7.4cu.2313_B20191024. | CRITICAL 9.8EPSS 13.7% | 25 December 2023 |
| CVE-2023-7102 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. | CRITICAL 9.8EPSS 44.6% | 24 December 2023 |
| CVE-2023-7101 | Spreadsheet::ParseExcel Remote Code Execution Vulnerability | KEVHIGH 7.8EPSS 19.0% | 24 December 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.