Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 47 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-41599 | An issue in the component /common/DownController.java of JFinalCMS v5.0.0 allows attackers to execute a directory traversal. | MEDIUM 5.3EPSS 12.4% | 19 September 2023 |
| CVE-2023-33831 | A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request. | CRITICAL 9.8EPSS 26.0% | 18 September 2023 |
| CVE-2023-42442 | SessionViewSet permission classes set to `[RBACPermission | IsSessionAssignee]`, relation is or, so any permission matched will be allowed. | MEDIUM 5.3EPSS 63.0% | 15 September 2023 |
| CVE-2023-41887 | Prior to version 3.7.5, a remote code execution vulnerability allows any unauthenticated user to execute code on the server. | CRITICAL 9.8EPSS 42.5% | 15 September 2023 |
| CVE-2023-38039 | However, curl did not have a limit in how many or how large headers it would accept in a response, allowing a malicious server to stream an endless series of headers and eventually cause curl to run out of heap memory. | HIGH 7.5EPSS 56.2% | 15 September 2023 |
| CVE-2023-38205 | Adobe ColdFusion Improper Access Control Vulnerability | KEVHIGH 7.5EPSS 99.8% | 14 September 2023 |
| CVE-2023-38204 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. | CRITICAL 9.8EPSS 66.9% | 14 September 2023 |
| CVE-2023-41892 | Craft CMS is a platform for creating digital experiences. | CRITICAL 9.8EPSS 94.2% | 13 September 2023 |
| CVE-2023-3710 | Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. | EXPLOITCRITICAL 9.8EPSS 49.0% | 12 September 2023 |
| CVE-2023-38162 | DHCP Server Service Denial of Service Vulnerability | HIGH 7.5EPSS 10.7% | 12 September 2023 |
| CVE-2023-38152 | DHCP Server Service Information Disclosure Vulnerability | MEDIUM 5.3EPSS 24.0% | 12 September 2023 |
| CVE-2023-38146 | Windows Themes Remote Code Execution Vulnerability | HIGH 8.8EPSS 37.4% | 12 September 2023 |
| CVE-2023-36802 | Microsoft Streaming Service Proxy Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 27.9% | 12 September 2023 |
| CVE-2023-36777 | Microsoft Exchange Server Information Disclosure Vulnerability | MEDIUM 5.7EPSS 52.0% | 12 September 2023 |
| CVE-2023-36761 | Microsoft Word Information Disclosure Vulnerability | KEVMEDIUM 6.5EPSS 19.6% | 12 September 2023 |
| CVE-2023-36757 | Microsoft Exchange Server Spoofing Vulnerability | HIGH 8.0EPSS 36.9% | 12 September 2023 |
| CVE-2023-36756 | Microsoft Exchange Server Remote Code Execution Vulnerability | HIGH 8.0EPSS 49.2% | 12 September 2023 |
| CVE-2023-36745 | Microsoft Exchange Server Remote Code Execution Vulnerability | HIGH 8.0EPSS 76.2% | 12 September 2023 |
| CVE-2023-36744 | Microsoft Exchange Server Remote Code Execution Vulnerability | HIGH 8.0EPSS 57.1% | 12 September 2023 |
| CVE-2023-4863 | Google Chromium WebP Heap-Based Buffer Overflow Vulnerability | KEVHIGH 8.8EPSS 100.0% | 12 September 2023 |
| CVE-2023-2071 | Rockwell Automation FactoryTalk View Machine Edition on the PanelView Plus, improperly verifies user’s input, which allows unauthenticated attacker to achieve remote code executed via crafted malicious packets. | CRITICAL 9.8EPSS 17.3% | 12 September 2023 |
| CVE-2023-39780 | ASUS RT-AX55 Routers OS Command Injection Vulnerability | KEVHIGH 8.8EPSS 39.5% | 11 September 2023 |
| CVE-2023-38743 | Zoho ManageEngine ADManager Plus before Build 7200 allows admin users to execute commands on the host machine. | HIGH 7.2EPSS 11.1% | 11 September 2023 |
| CVE-2023-4873 | A vulnerability, which was classified as critical, was found in Byzoro Smart S45F Multi-Service Secure Gateway Intelligent Management Platform up to 20230906. | CRITICAL 9.8EPSS 22.1% | 10 September 2023 |
| CVE-2023-39584 | Hexo up to v7.0.0 (RC2) was discovered to contain an arbitrary file read vulnerability. | HIGH 7.5EPSS 34.5% | 8 September 2023 |
| CVE-2023-4528 | Unsafe deserialization in JSCAPE MFT Server versions prior to 2023.1.9 (Windows, Linux, and MacOS) permits an attacker to run arbitrary Java code (including OS commands) via its management interface | HIGH 7.2EPSS 31.9% | 7 September 2023 |
| CVE-2023-41064 | Apple iOS, iPadOS, and macOS ImageIO Buffer Overflow Vulnerability | KEVHIGH 7.8EPSS 53.4% | 7 September 2023 |
| CVE-2023-20269 | Cisco Adaptive Security Appliance and Firepower Threat Defense Unauthorized Access Vulnerability | KEVCRITICAL 9.1EPSS 26.6% | 6 September 2023 |
| CVE-2023-20238 | A vulnerability in the single sign-on (SSO) implementation of Cisco BroadWorks Application Delivery Platform and Cisco BroadWorks Xtended Services Platform could allow an unauthenticated, remote attacker to forge the credentials required to access an… | CRITICAL 9.8EPSS 15.1% | 6 September 2023 |
| CVE-2023-39265 | Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. | MEDIUM 6.5EPSS 86.0% | 6 September 2023 |
| CVE-2023-37941 | If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. | MEDIUM 6.6EPSS 35.5% | 6 September 2023 |
| CVE-2023-4634 | The Media Library Assistant plugin for WordPress is vulnerable to Local File Inclusion and Remote Code Execution in versions up to, and including, 3.09. | EXPLOITCRITICAL 9.8EPSS 85.6% | 6 September 2023 |
| CVE-2023-35719 | ManageEngine ADSelfService Plus GINA Client Insufficient Verification of Data Authenticity Authentication Bypass Vulnerability. | MEDIUM 6.8EPSS 24.6% | 6 September 2023 |
| CVE-2023-4762 | Google Chromium V8 Type Confusion Vulnerability | KEVHIGH 8.8EPSS 41.4% | 5 September 2023 |
| CVE-2023-39362 | In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. | EXPLOITHIGH 7.2EPSS 85.4% | 5 September 2023 |
| CVE-2023-39361 | Affected versions are subject to a SQL injection discovered in graph_view.php. | CRITICAL 9.8EPSS 88.8% | 5 September 2023 |
| CVE-2023-4708 | A vulnerability was found in Infosoftbd Clcknshop 1.0.0. | EXPLOITCRITICAL 9.8EPSS 31.2% | 1 September 2023 |
| CVE-2023-4481 | An Improper Input Validation vulnerability in the Routing Protocol Daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an unauthenticated, network-based attacker to cause a Denial of Service (DoS). | HIGH 7.5EPSS 18.4% | 1 September 2023 |
| CVE-2023-4596 | The Forminator plugin for WordPress is vulnerable to arbitrary file uploads due to file type validation occurring after a file has been uploaded to the server in the upload_post_image() function in versions up to, and including, 1.24.6. | CRITICAL 9.8EPSS 14.3% | 30 August 2023 |
| CVE-2023-41266 | Qlik Sense Path Traversal Vulnerability | KEVMEDIUM 6.5EPSS 84.8% | 29 August 2023 |
| CVE-2023-41265 | Qlik Sense HTTP Tunneling Vulnerability | KEVCRITICAL 9.9EPSS 88.2% | 29 August 2023 |
| CVE-2023-34039 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. | CRITICAL 9.8EPSS 67.2% | 29 August 2023 |
| CVE-2023-20890 | Aria Operations for Networks contains an arbitrary file write vulnerability. | HIGH 7.2EPSS 20.2% | 29 August 2023 |
| CVE-2023-40787 | In SpringBlade V3.6.0 when executing SQL query, the parameters submitted by the user are not wrapped in quotation marks, which leads to SQL injection. | CRITICAL 9.8EPSS 18.2% | 29 August 2023 |
| CVE-2023-41109 | SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection. | CRITICAL 9.8EPSS 64.5% | 28 August 2023 |
| CVE-2023-4548 | A vulnerability has been found in SPA-Cart eCommerce CMS 1.9.0.3. | EXPLOITLOW 2.1EPSS 30.7% | 26 August 2023 |
| CVE-2023-4547 | This manipulation of the argument filter[brandid]/filter[price] causes cross site scripting. | EXPLOITLOW 2.0EPSS 60.3% | 26 August 2023 |
| CVE-2023-4542 | A vulnerability was found in D-Link DAR-8000-10 up to 20230809. | CRITICAL 9.8EPSS 84.7% | 25 August 2023 |
| CVE-2023-41249 | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step | MEDIUM 6.1EPSS 55.5% | 25 August 2023 |
| CVE-2023-40176 | Any registered user can exploit a stored XSS through their user profile by setting the payload as the value of the time zone user preference. | MEDIUM 5.4EPSS 80.0% | 23 August 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.