Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 51 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-29711 | An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. | CRITICAL 9.8EPSS 70.3% | 22 June 2023 |
| CVE-2023-20894 | The VMware vCenter Server contains an out-of-bounds write vulnerability in the implementation of the DCERPC protocol. | CRITICAL 9.8EPSS 33.9% | 22 June 2023 |
| CVE-2023-29708 | An issue was discovered in /cgi-bin/adm.cgi in WavLink WavRouter version RPT70HA1.x, allows attackers to force a factory reset via crafted payload. | HIGH 7.5EPSS 14.2% | 22 June 2023 |
| CVE-2023-33405 | Blogengine.net 3.3.8.0 and earlier is vulnerable to Open Redirect. | MEDIUM 6.1EPSS 31.3% | 21 June 2023 |
| CVE-2023-24261 | A vulnerability in GL.iNET GL-E750 Mudi before firmware v3.216 allows authenticated attackers to execute arbitrary code via a crafted POST request. | HIGH 7.2EPSS 18.8% | 21 June 2023 |
| CVE-2023-33584 | Sourcecodester Enrollment System Project V1.0 is vulnerable to SQL Injection (SQLI) attacks, which allow an attacker to manipulate the SQL queries executed by the application. | EXPLOIT ✓CRITICAL 9.8EPSS 14.2% | 21 June 2023 |
| CVE-2023-34563 | netgear R6250 Firmware Version 1.0.4.48 is vulnerable to Buffer Overflow after authentication. | CRITICAL 9.8EPSS 13.7% | 20 June 2023 |
| CVE-2023-35885 | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. | CRITICAL 9.8EPSS 73.5% | 20 June 2023 |
| CVE-2023-35166 | It's possible to execute any wiki content with the right of the TipsPanel author by creating a tip UI extension. | HIGH 8.8EPSS 62.2% | 20 June 2023 |
| CVE-2023-34600 | Adiscon LogAnalyzer v4.1.13 and before is vulnerable to SQL Injection. | CRITICAL 9.8EPSS 24.2% | 20 June 2023 |
| CVE-2023-2533 | PaperCut NG/MF Cross-Site Request Forgery (CSRF) Vulnerability | KEVHIGH 8.8EPSS 28.8% | 20 June 2023 |
| CVE-2023-27992 | Zyxel Multiple NAS Devices Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 82.3% | 19 June 2023 |
| CVE-2023-3306 | A vulnerability was found in Ruijie RG-EW1200G EW_3.0(1)B11P204. | CRITICAL 9.8EPSS 23.1% | 18 June 2023 |
| CVE-2023-35813 | Multiple Sitecore products allow remote code execution. | CRITICAL 9.8EPSS 86.7% | 17 June 2023 |
| CVE-2023-34659 | jeecg-boot 3.5.0 and 3.5.1 have a SQL injection vulnerability the id parameter of the /jeecg-boot/jmreport/show interface. | CRITICAL 9.8EPSS 12.5% | 16 June 2023 |
| CVE-2023-30625 | Versions of rudder-server prior to 1.3.0-rc.1 are vulnerable to SQL injection. | HIGH 8.8EPSS 85.8% | 16 June 2023 |
| CVE-2023-35708 | In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an… | CRITICAL 9.8EPSS 96.7% | 16 June 2023 |
| CVE-2023-28810 | Some access control/intercom products have unauthorized modification of device network configuration vulnerabilities. | MEDIUM 4.3EPSS 10.4% | 15 June 2023 |
| CVE-2023-34800 | D-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at genacgi_main. | CRITICAL 9.8EPSS 28.4% | 15 June 2023 |
| CVE-2023-32031 | Microsoft Exchange Server Remote Code Execution Vulnerability | HIGH 8.8EPSS 81.5% | 14 June 2023 |
| CVE-2023-28310 | Microsoft Exchange Server Remote Code Execution Vulnerability | HIGH 8.0EPSS 25.0% | 14 June 2023 |
| CVE-2023-34747 | File upload vulnerability in ujcms 6.0.2 via /api/backend/core/web-file-upload/upload. | CRITICAL 9.8EPSS 20.0% | 14 June 2023 |
| CVE-2023-3001 | A CWE-502: Deserialization of Untrusted Data vulnerability exists in the Dashboard module that could cause an interpretation of malicious payload data, potentially leading to remote code execution when an attacker gets the user to open a malicious file. | HIGH 7.8EPSS 31.9% | 14 June 2023 |
| CVE-2023-33133 | Microsoft Excel Remote Code Execution Vulnerability | HIGH 7.8EPSS 44.0% | 14 June 2023 |
| CVE-2023-32029 | Microsoft Excel Remote Code Execution Vulnerability | HIGH 7.8EPSS 53.5% | 14 June 2023 |
| CVE-2023-29360 | Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability | KEVHIGH 8.4EPSS 21.6% | 14 June 2023 |
| CVE-2023-29357 | Microsoft SharePoint Server Privilege Escalation Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 14 June 2023 |
| CVE-2023-3224 | Code Injection in GitHub repository nuxt/nuxt prior to 3.5.3. | CRITICAL 9.8EPSS 58.6% | 13 June 2023 |
| CVE-2023-3217 | Use after free in WebXR in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 13.3% | 13 June 2023 |
| CVE-2023-3215 | Use after free in WebRTC in Google Chrome prior to 114.0.5735.133 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 13.8% | 13 June 2023 |
| CVE-2023-20867 | VMware Tools Authentication Bypass Vulnerability | KEVLOW 3.9EPSS 13.6% | 13 June 2023 |
| CVE-2023-33568 | An issue in Dolibarr 16 before 16.0.5 allows unauthenticated attackers to perform a database dump and access a company's entire customer file, prospects, suppliers, and employee information if a contact file exists. | HIGH 7.5EPSS 14.9% | 13 June 2023 |
| CVE-2023-33919 | A vulnerability has been identified in CP-8031 MASTER MODULE (All versions < CPCI85 V05), CP-8050 MASTER MODULE (All versions < CPCI85 V05). | HIGH 7.2EPSS 47.7% | 13 June 2023 |
| CVE-2023-27997 | Fortinet FortiOS and FortiProxy SSL-VPN Heap-Based Buffer Overflow Vulnerability | KEVCRITICAL 9.8EPSS 85.7% | 13 June 2023 |
| CVE-2023-34941 | A stored cross-site scripting (XSS) vulnerability in the urlFilterList function of Asus RT-N10LX Router v2.0.0.39 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the URL Keyword List text field. | MEDIUM 5.4EPSS 23.8% | 12 June 2023 |
| CVE-2023-33625 | D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function. | CRITICAL 9.8EPSS 33.2% | 12 June 2023 |
| CVE-2023-34468 | The DBCPConnectionPool and HikariCPConnectionPool Controller Services in Apache NiFi 0.0.2 through 1.21.0 allow an authenticated and authorized user to configure a Database URL with the H2 driver that enables custom code execution. | HIGH 8.8EPSS 61.9% | 12 June 2023 |
| CVE-2023-35042 | GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. | CRITICAL 9.8EPSS 44.8% | 12 June 2023 |
| CVE-2023-3206 | A vulnerability classified as problematic was found in Chengdu VEC40G 3.0. | HIGH 7.5EPSS 18.7% | 12 June 2023 |
| CVE-2023-35036 | In Progress MOVEit Transfer before 2021.0.7 (13.0.7), 2021.1.5 (13.1.5), 2022.0.5 (14.0.5), 2022.1.6 (14.1.6), and 2023.0.2 (15.0.2), SQL injection vulnerabilities have been found in the MOVEit Transfer web application that could allow an… | CRITICAL 9.1EPSS 12.8% | 12 June 2023 |
| CVE-2023-2249 | The wpForo Forum plugin for WordPress is vulnerable to Local File Include, Server-Side Request Forgery, and PHAR Deserialization in versions up to, and including, 2.1.7. | HIGH 8.8EPSS 60.8% | 9 June 2023 |
| CVE-2023-0992 | The Shield Security plugin for WordPress is vulnerable to stored Cross-Site Scripting in versions up to, and including, 17.0.17 via the 'User-Agent' header. | MEDIUM 6.1EPSS 93.0% | 9 June 2023 |
| CVE-2023-32749 | Pydio Cells allows users by default to create so-called external users in order to share files with them. | EXPLOITHIGH 8.8EPSS 14.1% | 8 June 2023 |
| CVE-2023-34096 | In versions 3.06 and prior, the file `panorama.pm` is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. | EXPLOITHIGH 8.8EPSS 62.7% | 8 June 2023 |
| CVE-2023-2986 | The Abandoned Cart Lite for WooCommerce plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.14.2. | CRITICAL 9.8EPSS 42.5% | 8 June 2023 |
| CVE-2023-2442 | A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. | MEDIUM 5.4EPSS 96.1% | 7 June 2023 |
| CVE-2023-20889 | Aria Operations for Networks contains an information disclosure vulnerability. | HIGH 7.5EPSS 79.1% | 7 June 2023 |
| CVE-2023-20888 | Aria Operations for Networks contains an authenticated deserialization vulnerability. | HIGH 8.8EPSS 82.3% | 7 June 2023 |
| CVE-2023-20887 | Vmware Aria Operations for Networks Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 98.3% | 7 June 2023 |
| CVE-2023-33538 | TP-Link Multiple Routers Command Injection Vulnerability | KEVHIGH 8.8EPSS 41.6% | 7 June 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.