Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 50 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-29298 | Adobe ColdFusion Improper Access Control Vulnerability | KEVHIGH 7.5EPSS 99.8% | 12 July 2023 |
| CVE-2023-37582 | The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1. | CRITICAL 9.8EPSS 90.4% | 12 July 2023 |
| CVE-2023-36884 | Microsoft Windows Search Remote Code Execution Vulnerability | KEVHIGH 7.5EPSS 99.4% | 11 July 2023 |
| CVE-2023-36874 | Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 42.6% | 11 July 2023 |
| CVE-2023-35311 | Microsoft Outlook Security Feature Bypass Vulnerability | KEVHIGH 8.8EPSS 15.5% | 11 July 2023 |
| CVE-2023-33157 | Microsoft SharePoint Remote Code Execution Vulnerability | HIGH 8.8EPSS 38.2% | 11 July 2023 |
| CVE-2023-36824 | In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. | HIGH 8.8EPSS 77.4% | 11 July 2023 |
| CVE-2023-3608 | A vulnerability was found in Ruijie BCR810W 2.5.10. | HIGH 8.8EPSS 12.3% | 10 July 2023 |
| CVE-2023-24489 | Citrix Content Collaboration ShareFile Improper Access Control Vulnerability | KEVCRITICAL 9.8EPSS 97.3% | 10 July 2023 |
| CVE-2023-24488 | Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting | MEDIUM 6.1EPSS 81.2% | 10 July 2023 |
| CVE-2023-2796 | The EventON WordPress plugin before 2.1.2 lacks authentication and authorization in its eventon_ics_download ajax action, allowing unauthenticated visitors to access private and password protected Events by guessing their numeric id. | EXPLOITMEDIUM 5.3EPSS 42.7% | 10 July 2023 |
| CVE-2023-1183 | An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker. | MEDIUM 5.5EPSS 64.9% | 10 July 2023 |
| CVE-2023-36460 | Starting in version 3.5.0 and prior to versions 3.5.9, 4.0.5, and 4.1.3, attackers using carefully crafted media files can cause Mastodon's media processing code to create arbitrary files at any location. | CRITICAL 9.9EPSS 40.1% | 6 July 2023 |
| CVE-2023-34192 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | KEVCRITICAL 9.0EPSS 77.3% | 6 July 2023 |
| CVE-2023-36969 | CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. | HIGH 8.8EPSS 49.3% | 6 July 2023 |
| CVE-2023-36808 | Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. | CRITICAL 9.8EPSS 51.7% | 5 July 2023 |
| CVE-2023-35924 | Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. | CRITICAL 9.8EPSS 52.4% | 5 July 2023 |
| CVE-2023-36934 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that… | CRITICAL 9.1EPSS 95.2% | 5 July 2023 |
| CVE-2023-36933 | In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. | HIGH 7.5EPSS 72.2% | 5 July 2023 |
| CVE-2023-36932 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application… | HIGH 8.1EPSS 81.1% | 5 July 2023 |
| CVE-2023-3460 | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. | EXPLOITCRITICAL 9.8EPSS 72.3% | 4 July 2023 |
| CVE-2023-26258 | Arcserve UDP through 9.0.6034 allows authentication bypass. | CRITICAL 9.8EPSS 40.0% | 3 July 2023 |
| CVE-2023-28324 | A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege escalation or remote code execution. | CRITICAL 9.8EPSS 12.9% | 1 July 2023 |
| CVE-2023-36812 | OpenTSDB is vulnerable to Remote Code Execution vulnerability by writing user-controlled input to Gnuplot configuration file and running Gnuplot with the generated configuration. | CRITICAL 9.8EPSS 16.5% | 30 June 2023 |
| CVE-2023-36144 | An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration. | HIGH 7.5EPSS 36.5% | 30 June 2023 |
| CVE-2023-36347 | A broken authentication mechanism in the endpoint excel.php of POS Codekop v2.0 allows unauthenticated attackers to download selling data. | HIGH 7.5EPSS 34.1% | 30 June 2023 |
| CVE-2023-36469 | Any user who can edit their own user profile and notification settings can execute arbitrary script macros including Groovy and Python macros that allow remote code execution including unrestricted read and write access to all wiki contents. | HIGH 8.8EPSS 82.0% | 29 June 2023 |
| CVE-2023-31222 | Deserialization of untrusted data in Microsoft Messaging Queuing Service in Medtronic's Paceart Optima versions 1.11 and earlier on Windows allows an unauthorized user to impact a healthcare delivery organization’s Paceart Optima system cardiac device… | HIGH 8.8EPSS 28.5% | 29 June 2023 |
| CVE-2023-26613 | An OS command injection vulnerability in D-Link DIR-823G firmware version 1.02B05 allows unauthorized attackers to execute arbitrary operating system commands via a crafted GET request to EXCU_SHELL. | CRITICAL 9.8EPSS 30.4% | 29 June 2023 |
| CVE-2023-34598 | Gibbon v25.0.0 is vulnerable to a Local File Inclusion (LFI) where it's possible to include the content of several files present in the installation folder in the server's response. | CRITICAL 9.8EPSS 47.2% | 29 June 2023 |
| CVE-2023-2982 | The WordPress Social Login and Register (Discord, Google, Twitter, LinkedIn) plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 7.6.4. | CRITICAL 9.8EPSS 46.2% | 29 June 2023 |
| CVE-2023-3450 | A vulnerability was found in Ruijie RG-BCR860 2.5.13 and classified as critical. | HIGH 7.2EPSS 51.1% | 28 June 2023 |
| CVE-2023-2877 | This allows a user with a role as low as Subscriber to install and activate arbitrary plugins of arbitrary versions from the WordPress.org plugin repository onto the site, leading to Remote Code Execution. | HIGH 8.8EPSS 22.5% | 27 June 2023 |
| CVE-2023-2068 | The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. | EXPLOITCRITICAL 9.8EPSS 39.6% | 27 June 2023 |
| CVE-2023-32521 | A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files. | CRITICAL 9.1EPSS 66.8% | 26 June 2023 |
| CVE-2023-3420 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 56.2% | 26 June 2023 |
| CVE-2023-33404 | An Unrestricted Upload vulnerability, due to insufficient validation on UploadControlled.cs file, in BlogEngine.Net version 3.3.8.0 and earlier allows remote attackers to execute remote code. | CRITICAL 9.8EPSS 25.8% | 26 June 2023 |
| CVE-2023-30261 | Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request. | CRITICAL 9.8EPSS 31.7% | 26 June 2023 |
| CVE-2023-3388 | The Beautiful Cookie Consent Banner for WordPress is vulnerable to Stored Cross-Site Scripting via the 'nsc_bar_content_href' parameter in versions up to, and including, 2.10.1 due to insufficient input sanitization and output escaping. | MEDIUM 6.1EPSS 84.3% | 24 June 2023 |
| CVE-2023-32439 | Apple Multiple Products WebKit Type Confusion Vulnerability | KEVHIGH 8.8EPSS 24.0% | 23 June 2023 |
| CVE-2023-32435 | Apple Multiple Products WebKit Memory Corruption Vulnerability | KEVHIGH 8.8EPSS 23.0% | 23 June 2023 |
| CVE-2023-32434 | Apple Multiple Products Integer Overflow Vulnerability | KEVHIGH 7.8EPSS 51.5% | 23 June 2023 |
| CVE-2023-32409 | Apple Multiple Products WebKit Sandbox Escape Vulnerability | KEVHIGH 8.6EPSS 16.5% | 23 June 2023 |
| CVE-2023-32373 | Apple Multiple Products WebKit Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 12.2% | 23 June 2023 |
| CVE-2023-28204 | Apple Multiple Products WebKit Out-of-Bounds Read Vulnerability | KEVMEDIUM 6.5EPSS 14.3% | 23 June 2023 |
| CVE-2023-35150 | Starting in version 2.40m-2 and prior to versions 14.4.8, 14.10.4, and 15.0, any user with view rights on any document can execute code with programming rights, leading to remote code execution by crafting an url with a dangerous payload. | HIGH 8.0EPSS 77.7% | 23 June 2023 |
| CVE-2023-30258 | Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. | EXPLOITCRITICAL 9.8EPSS 94.3% | 23 June 2023 |
| CVE-2023-33299 | A deserialization of untrusted data in Fortinet FortiNAC below 7.2.1, below 9.4.3, below 9.2.8 and all earlier versions of 8.x allows attacker to execute unauthorized code or commands via specifically crafted request on inter-server communication port. | CRITICAL 9.8EPSS 24.3% | 23 June 2023 |
| CVE-2023-36355 | TP-Link TL-WR940N V4 was discovered to contain a buffer overflow via the ipStart parameter at /userRpm/WanDynamicIpV6CfgRpm. | EXPLOITCRITICAL 9.9EPSS 31.7% | 22 June 2023 |
| CVE-2023-32571 | Dynamic Linq 1.0.7.10 through 1.2.25 before 1.3.0 allows attackers to execute arbitrary code and commands when untrusted input to methods including Where, Select, OrderBy is parsed. | CRITICAL 9.8EPSS 34.9% | 22 June 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.