Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 45 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-46865 | /api/v1/company/upload-logo in CompanyController.php in crater through 6.0.6 allows a superadmin to execute arbitrary PHP code by placing this code into an image/png IDAT chunk of a Company Logo image. | HIGH 7.2EPSS 23.8% | 30 October 2023 |
| CVE-2023-5830 | A vulnerability classified as critical has been found in ColumbiaSoft Document Locator. | CRITICAL 9.8EPSS 61.9% | 27 October 2023 |
| CVE-2023-46604 | Apache ActiveMQ Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 27 October 2023 |
| CVE-2023-46818 | PHP code injection can be achieved in the language file editor by an admin if admin_allow_langedit is enabled. | HIGH 7.2EPSS 19.2% | 27 October 2023 |
| CVE-2023-45498 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability. | CRITICAL 9.8EPSS 22.0% | 27 October 2023 |
| CVE-2018-17879 | The CGI scripts allow remote attackers to execute code via system() as root. | CRITICAL 9.8EPSS 23.2% | 26 October 2023 |
| CVE-2023-46747 | F5 BIG-IP Configuration Utility Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 96.7% | 26 October 2023 |
| CVE-2023-31419 | A flaw was discovered in Elasticsearch, affecting the _search API that allowed a specially crafted query string to cause a Stack Overflow and ultimately a Denial of Service. | HIGH 7.5EPSS 61.1% | 26 October 2023 |
| CVE-2023-43208 | NextGen Healthcare Mirth Connect Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 85.9% | 26 October 2023 |
| CVE-2023-5044 | Code injection via nginx.ingress.kubernetes.io/permanent-redirect annotation. | HIGH 8.8EPSS 59.6% | 25 October 2023 |
| CVE-2023-46574 | An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. | CRITICAL 9.8EPSS 65.3% | 25 October 2023 |
| CVE-2023-46370 | Tenda W18E V16.01.0.8(1576) has a command injection vulnerability via the hostName parameter in the formSetNetCheckTools function. | CRITICAL 9.8EPSS 18.4% | 25 October 2023 |
| CVE-2023-46347 | In the module "Step by Step products Pack" (ndk_steppingpack) version 1.5.6 and before from NDK Design for PrestaShop, a guest can perform SQL injection. | CRITICAL 9.8EPSS 50.3% | 25 October 2023 |
| CVE-2023-43795 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. | CRITICAL 9.8EPSS 69.0% | 25 October 2023 |
| CVE-2023-34048 | VMware vCenter Server Out-of-Bounds Write Vulnerability | KEVCRITICAL 9.8EPSS 99.2% | 25 October 2023 |
| CVE-2023-20273 | Cisco IOS XE Web UI Command Injection Vulnerability | KEVHIGH 7.2EPSS 92.9% | 25 October 2023 |
| CVE-2023-46127 | A malicious Frappe user with desk access could create documents containing HTML payloads allowing HTML Injection. | MEDIUM 5.4EPSS 41.3% | 23 October 2023 |
| CVE-2023-43622 | An attacker, opening a HTTP/2 connection with an initial window size of 0, was able to block handling of that connection indefinitely in Apache HTTP Server. | HIGH 7.5EPSS 68.8% | 23 October 2023 |
| CVE-2023-5702 | A vulnerability was found in Viessmann Vitogate 300 up to 2.1.3.0 and classified as problematic. | EXPLOITMEDIUM 6.5EPSS 18.7% | 23 October 2023 |
| CVE-2023-5684 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20231012. | CRITICAL 9.8EPSS 26.6% | 21 October 2023 |
| CVE-2023-34051 | VMware Aria Operations for Logs contains an authentication bypass vulnerability. | CRITICAL 9.8EPSS 48.1% | 20 October 2023 |
| CVE-2023-46042 | An issue in GetSimpleCMS v.3.4.0a allows a remote attacker to execute arbitrary code via a crafted payload to the phpinfo(). | CRITICAL 9.8EPSS 25.3% | 19 October 2023 |
| CVE-2023-35180 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. | HIGH 8.8EPSS 28.8% | 19 October 2023 |
| CVE-2023-46229 | LangChain before 0.0.317 allows SSRF via document_loaders/recursive_url_loader.py because crawling can proceed from an external server to an internal server. | HIGH 8.8EPSS 47.6% | 19 October 2023 |
| CVE-2023-5642 | Advantech R-SeeNet v2.4.23 allows an unauthenticated remote attacker to read from and write to the snmpmon.ini file, which contains sensitive information. | CRITICAL 9.8EPSS 18.0% | 18 October 2023 |
| CVE-2023-5631 | Roundcube Webmail Persistent Cross-Site Scripting (XSS) Vulnerability | KEVMEDIUM 5.4EPSS 76.3% | 18 October 2023 |
| CVE-2023-38545 | This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. | CRITICAL 9.8EPSS 78.7% | 18 October 2023 |
| CVE-2023-39456 | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. | HIGH 7.5EPSS 58.3% | 17 October 2023 |
| CVE-2023-44693 | D-Link Online behavior audit gateway DAR-7000 V31R02B1413C is vulnerable to SQL Injection via /importexport.php. | CRITICAL 9.8EPSS 14.4% | 17 October 2023 |
| CVE-2023-45375 | In the module "PireosPay" (pireospay) before version 1.7.10 from 01generator.com for PrestaShop, a guest can perform SQL injection via `PireosPayValidationModuleFrontController::postProcess().` | HIGH 8.8EPSS 41.0% | 17 October 2023 |
| CVE-2023-5003 | The Active Directory Integration / LDAP Integration WordPress plugin before 4.1.10 stores sensitive LDAP logs in a buffer file when an administrator wants to export said logs. | HIGH 7.5EPSS 26.6% | 16 October 2023 |
| CVE-2023-20198 | Cisco IOS XE Web UI Privilege Escalation Vulnerability | KEVCRITICAL 10.0EPSS 99.6% | 16 October 2023 |
| CVE-2023-5591 | SQL Injection in GitHub repository librenms/librenms prior to 23.10.0. | MEDIUM 6.5EPSS 23.8% | 16 October 2023 |
| CVE-2023-45852 | In Vitogate 300 2.1.3.0, /cgi-bin/vitogate.cgi allows an unauthenticated attacker to bypass authentication and execute arbitrary commands via shell metacharacters in the ipaddr params JSON data for the put method. | CRITICAL 9.8EPSS 15.2% | 14 October 2023 |
| CVE-2023-29464 | FactoryTalk Linx, in the Rockwell Automation PanelView Plus, allows an unauthenticated threat actor to read data from memory via crafted malicious packets. | CRITICAL 9.1EPSS 15.0% | 13 October 2023 |
| CVE-2023-45138 | Change Request is an pplication allowing users to request changes on a wiki without publishing the changes directly. | CRITICAL 9.6EPSS 71.7% | 12 October 2023 |
| CVE-2023-43661 | Prior to the 2.4 branch, a template functionality which allows users to create templates allows them to execute any code on the server during the bad filtration and old twig version. | HIGH 8.8EPSS 51.9% | 11 October 2023 |
| CVE-2023-32645 | A leftover debug code vulnerability exists in the httpd debug credentials functionality of Yifan YF325 v1.0_20221108. | CRITICAL 9.8EPSS 55.2% | 11 October 2023 |
| CVE-2023-41772 | Win32k Elevation of Privilege Vulnerability | HIGH 7.8EPSS 13.3% | 10 October 2023 |
| CVE-2023-41763 | Microsoft Skype for Business Privilege Escalation Vulnerability | KEVMEDIUM 5.3EPSS 90.3% | 10 October 2023 |
| CVE-2023-38171 | Microsoft QUIC Denial of Service Vulnerability | HIGH 7.5EPSS 71.0% | 10 October 2023 |
| CVE-2023-36606 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability | HIGH 7.5EPSS 69.4% | 10 October 2023 |
| CVE-2023-36563 | Microsoft WordPad Information Disclosure Vulnerability | KEVMEDIUM 5.5EPSS 20.3% | 10 October 2023 |
| CVE-2023-34993 | A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWLM version 8.6.0 through 8.6.5 and 8.5.0 through 8.5.4 allows attacker to execute unauthorized code or commands via specifically crafted http… | CRITICAL 9.8EPSS 21.3% | 10 October 2023 |
| CVE-2023-34992 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests. | CRITICAL 9.8EPSS 81.7% | 10 October 2023 |
| CVE-2023-30806 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. | CRITICAL 9.8EPSS 65.0% | 10 October 2023 |
| CVE-2023-30805 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an operating system command injection vulnerability. | CRITICAL 9.8EPSS 65.0% | 10 October 2023 |
| CVE-2023-30804 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authenticated file disclosure vulnerability. | MEDIUM 6.9EPSS 38.9% | 10 October 2023 |
| CVE-2023-30803 | The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. | CRITICAL 9.8EPSS 20.9% | 10 October 2023 |
| CVE-2023-4966 | Citrix NetScaler ADC and NetScaler Gateway Buffer Overflow Vulnerability | KEVHIGH 7.5EPSS 100.0% | 10 October 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.