Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 48 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-38831 | RARLAB WinRAR Code Execution Vulnerability | KEVHIGH 7.8EPSS 99.8% | 23 August 2023 |
| CVE-2023-4428 | Out of bounds memory access in CSS in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | HIGH 8.1EPSS 11.3% | 23 August 2023 |
| CVE-2023-4427 | Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.110 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. | HIGH 8.1EPSS 48.5% | 23 August 2023 |
| CVE-2023-39026 | Directory Traversal vulnerability in FileMage Gateway Windows Deployments v.1.10.8 and before allows a remote attacker to obtain sensitive information via a crafted request to the /mgmt/ component. | EXPLOITHIGH 7.5EPSS 17.9% | 22 August 2023 |
| CVE-2023-38836 | File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks. | EXPLOITHIGH 8.8EPSS 76.0% | 21 August 2023 |
| CVE-2023-38035 | Ivanti Sentry Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 21 August 2023 |
| CVE-2023-4450 | A vulnerability was found in jeecgboot JimuReport up to 1.6.0. | CRITICAL 9.8EPSS 11.6% | 21 August 2023 |
| CVE-2023-39750 | D-Link DAP-2660 v1.13 was discovered to contain a buffer overflow via the f_ipv6_enable parameter at /bsc_ipv6. | CRITICAL 9.8EPSS 14.1% | 21 August 2023 |
| CVE-2022-24989 | TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. | CRITICAL 9.8EPSS 31.9% | 20 August 2023 |
| CVE-2023-4415 | A vulnerability was found in Ruijie RG-EW1200G 07161417 r483. | HIGH 8.8EPSS 58.3% | 18 August 2023 |
| CVE-2023-36847 | Juniper Junos OS EX Series Missing Authentication for Critical Function Vulnerability | KEVMEDIUM 5.3EPSS 83.5% | 17 August 2023 |
| CVE-2023-36846 | Juniper Junos OS SRX Series Missing Authentication for Critical Function Vulnerability | KEVMEDIUM 5.3EPSS 93.5% | 17 August 2023 |
| CVE-2023-36845 | Juniper Junos OS EX Series and SRX Series PHP External Variable Modification Vulnerability | KEVCRITICAL 9.8EPSS 95.1% | 17 August 2023 |
| CVE-2023-36844 | Juniper Junos OS EX Series PHP External Variable Modification Vulnerability | KEVMEDIUM 5.3EPSS 90.0% | 17 August 2023 |
| CVE-2023-26469 | In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. | CRITICAL 9.8EPSS 82.9% | 17 August 2023 |
| CVE-2023-2917 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. | CRITICAL 9.8EPSS 72.2% | 17 August 2023 |
| CVE-2023-2915 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. | CRITICAL 9.1EPSS 81.8% | 17 August 2023 |
| CVE-2023-2914 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, an integer overflow condition exists in the affected products. | HIGH 7.5EPSS 39.9% | 17 August 2023 |
| CVE-2023-20209 | A vulnerability in the web-based management interface of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an authenticated, remote attacker with read-write privileges on the application to perform a command… | HIGH 7.2EPSS 39.5% | 16 August 2023 |
| CVE-2023-4362 | Heap buffer overflow in Mojom IDL in Google Chrome prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process and gained control of a WebUI process to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 19.1% | 15 August 2023 |
| CVE-2023-4357 | Insufficient validation of untrusted input in XML in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to bypass file access restrictions via a crafted HTML page. | HIGH 8.8EPSS 47.1% | 15 August 2023 |
| CVE-2023-4355 | Out of bounds memory access in V8 in Google Chrome prior to 116.0.5845.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 27.7% | 15 August 2023 |
| CVE-2023-40028 | Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users to upload files that are symlinks. | EXPLOITMEDIUM 6.5EPSS 69.0% | 15 August 2023 |
| CVE-2023-35082 | Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 15 August 2023 |
| CVE-2023-2916 | The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.11.1 via the 'admin_notice' function. | MEDIUM 5.3EPSS 24.0% | 15 August 2023 |
| CVE-2023-4347 | Cross-site Scripting (XSS) - Reflected in GitHub repository librenms/librenms prior to 23.8.0. | MEDIUM 5.4EPSS 69.7% | 15 August 2023 |
| CVE-2023-29468 | Using a specially crafted frame, a buffer overflow can be triggered that can potentially lead to remote code execution. | CRITICAL 9.8EPSS 10.1% | 14 August 2023 |
| CVE-2023-3824 | In PHP version 8.0.* before 8.0.30, 8.1.* before 8.1.22, and 8.2.* before 8.2.8, when loading phar file, while reading PHAR directory entries, insufficient length checking may lead to a stack buffer overflow, leading potentially to memory corruption or… | CRITICAL 9.8EPSS 21.8% | 11 August 2023 |
| CVE-2023-32564 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. | CRITICAL 9.8EPSS 44.4% | 10 August 2023 |
| CVE-2023-32563 | An unauthenticated attacker could achieve the code execution through a RemoteControl server. | CRITICAL 9.8EPSS 89.1% | 10 August 2023 |
| CVE-2023-32562 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. | CRITICAL 9.8EPSS 45.6% | 10 August 2023 |
| CVE-2023-32560 | An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. | EXPLOITCRITICAL 9.8EPSS 99.4% | 10 August 2023 |
| CVE-2023-32782 | A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the… | HIGH 7.2EPSS 56.2% | 9 August 2023 |
| CVE-2023-32781 | A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the… | HIGH 7.2EPSS 14.3% | 9 August 2023 |
| CVE-2023-38180 | Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability | KEVHIGH 7.5EPSS 14.1% | 8 August 2023 |
| CVE-2023-36899 | ASP.NET Elevation of Privilege Vulnerability | HIGH 8.8EPSS 76.7% | 8 August 2023 |
| CVE-2023-38181 | Microsoft Exchange Server Spoofing Vulnerability | HIGH 8.8EPSS 10.8% | 8 August 2023 |
| CVE-2023-36900 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | HIGH 7.8EPSS 10.2% | 8 August 2023 |
| CVE-2023-20588 | A division-by-zero error on some AMD processors can potentially return speculative data resulting in loss of confidentiality. | MEDIUM 5.5EPSS 11.2% | 8 August 2023 |
| CVE-2023-37569 | This vulnerability exists in ESDS Emagic Data Center Management Suit due to lack of input sanitization in its Ping component. | EXPLOITHIGH 8.8EPSS 33.9% | 8 August 2023 |
| CVE-2023-38925 | Netgear DC112A 1.0.0.64, EX6200 1.0.3.94 and R6300v2 1.0.4.8 were discovered to contain a buffer overflow via the http_passwd parameter in password.cgi. | HIGH 8.8EPSS 15.2% | 7 August 2023 |
| CVE-2023-4169 | A vulnerability was found in Ruijie RG-EW1200G 1.0(1)B1P5. | HIGH 8.8EPSS 49.2% | 5 August 2023 |
| CVE-2023-4168 | A vulnerability was found in Templatecookie Adlisting 2.14.0. | EXPLOITHIGH 7.5EPSS 46.0% | 5 August 2023 |
| CVE-2023-4166 | A vulnerability has been found in Tongda OA and classified as critical. | CRITICAL 9.8EPSS 12.3% | 5 August 2023 |
| CVE-2023-4165 | A vulnerability, which was classified as critical, was found in Tongda OA. | CRITICAL 9.8EPSS 12.4% | 5 August 2023 |
| CVE-2023-39143 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. | CRITICAL 9.8EPSS 80.1% | 4 August 2023 |
| CVE-2023-29689 | PyroCMS 3.9 contains a remote code execution (RCE) vulnerability that can be exploited through a server-side template injection (SSTI) flaw. | EXPLOITCRITICAL 9.8EPSS 53.5% | 4 August 2023 |
| CVE-2023-38950 | ZKTeco BioTime Path Traversal Vulnerability | KEVHIGH 7.5EPSS 92.5% | 3 August 2023 |
| CVE-2023-35081 | Ivanti Endpoint Manager Mobile (EPMM) Path Traversal Vulnerability | KEVHIGH 7.2EPSS 63.6% | 3 August 2023 |
| CVE-2023-4120 | A vulnerability was found in Byzoro Smart S85F Management Platform up to 20230722 and classified as critical. | CRITICAL 9.8EPSS 62.3% | 3 August 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.