Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 52 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-3124 | The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. | HIGH 8.8EPSS 22.7% | 7 June 2023 |
| CVE-2021-4374 | The WordPress Automatic Plugin for WordPress is vulnerable to arbitrary options updates in versions up to, and including, 3.53.2. | CRITICAL 9.8EPSS 16.4% | 7 June 2023 |
| CVE-2020-36708 | The following themes for WordPress are vulnerable to Function Injections in versions up to and including Shapely <= 1.2.7, NewsMag <= 2.4.1, Activello <= 1.4.0, Illdy <= 2.1.4, Allegiant <= 1.2.2, Newspaper X <= 1.3.1, Pixova Lite <= 2.0.5, Brilliance… | CRITICAL 9.8EPSS 65.3% | 7 June 2023 |
| CVE-2023-33782 | D-Link DIR-842V2 v1.0.3 was discovered to contain a command injection vulnerability via the iperf3 diagnostics function. | HIGH 8.8EPSS 35.6% | 7 June 2023 |
| CVE-2023-33781 | An issue in D-Link DIR-842V2 v1.0.3 allows attackers to execute arbitrary commands via importing a crafted file. | HIGH 8.8EPSS 31.0% | 7 June 2023 |
| CVE-2023-0921 | A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested,… | MEDIUM 4.3EPSS 84.4% | 6 June 2023 |
| CVE-2023-33532 | There is a command injection vulnerability in the Netgear R6250 router with Firmware Version 1.0.4.48. | CRITICAL 9.8EPSS 16.2% | 6 June 2023 |
| CVE-2023-33381 | A command injection vulnerability was found in the ping functionality of the MitraStar GPT-2741GNAC router (firmware version AR_g5.8_110WVN0b7_2). | HIGH 7.2EPSS 22.2% | 6 June 2023 |
| CVE-2023-2833 | The ReviewX plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.13 due to insufficient restriction on the 'rx_set_screen_options' function. | HIGH 8.8EPSS 17.5% | 6 June 2023 |
| CVE-2023-3079 | Google Chromium V8 Type Confusion Vulnerability | KEVHIGH 8.8EPSS 37.9% | 5 June 2023 |
| CVE-2023-30149 | SQL injection vulnerability in the City Autocomplete (cityautocomplete) module from ebewe.net for PrestaShop, prior to version 1.8.12 (for PrestaShop version 1.5/1.6) or prior to 2.0.3 (for PrestaShop version 1.7), allows remote attackers to execute… | CRITICAL 9.8EPSS 16.9% | 2 June 2023 |
| CVE-2023-34362 | Progress MOVEit Transfer SQL Injection Vulnerability | KEVCRITICAL 9.8EPSS 99.9% | 2 June 2023 |
| CVE-2022-45938 | An attacker can inject a stored XSS payload in the Device ID field under Inventory Management to achieve Remote Code Execution and privilege escalation.. | CRITICAL 9.0EPSS 45.1% | 2 June 2023 |
| CVE-2023-32714 | In the Splunk App for Lookup File Editing versions below 4.0.1, a low-privileged user can, with a specially crafted web request, trigger a path traversal exploit that can then be used to read and write to restricted areas of the Splunk installation… | HIGH 8.1EPSS 42.8% | 1 June 2023 |
| CVE-2023-32707 | In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of… | EXPLOITHIGH 8.8EPSS 78.7% | 1 June 2023 |
| CVE-2023-29154 | SQL injection vulnerability exists in the CONPROSYS HMI System (CHS) versions prior to 3.5.3. | HIGH 7.2EPSS 41.4% | 1 June 2023 |
| CVE-2023-28651 | Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. | MEDIUM 4.8EPSS 62.4% | 1 June 2023 |
| CVE-2022-35742 | Microsoft Outlook Denial of Service Vulnerability | HIGH 7.5EPSS 22.3% | 1 June 2023 |
| CVE-2023-33735 | D-Link DIR-846 v1.00A52 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parameter in the /HNAP1 interface. | CRITICAL 9.8EPSS 31.6% | 31 May 2023 |
| CVE-2022-35756 | Windows Kerberos Elevation of Privilege Vulnerability | HIGH 7.8EPSS 11.3% | 31 May 2023 |
| CVE-2022-35748 | HTTP.sys Denial of Service Vulnerability | HIGH 7.5EPSS 47.2% | 31 May 2023 |
| CVE-2023-34225 | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible | MEDIUM 5.4EPSS 60.7% | 31 May 2023 |
| CVE-2023-34220 | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible | MEDIUM 5.4EPSS 61.4% | 31 May 2023 |
| CVE-2023-2936 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 23.0% | 30 May 2023 |
| CVE-2023-2935 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.90 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 23.9% | 30 May 2023 |
| CVE-2023-31185 | ROZCOM server framework - Misconfiguration may allow information disclosure via an unspecified request. | HIGH 7.5EPSS 12.8% | 30 May 2023 |
| CVE-2023-2650 | Impact summary: Applications that use OBJ_obj2txt() directly, or use any of the OpenSSL subsystems OCSP, PKCS7/SMIME, CMS, CMP/CRMF or TS with no message size limit may experience notable to very long delays when processing those messages, which may… | MEDIUM 6.5EPSS 73.7% | 30 May 2023 |
| CVE-2023-2288 | This leads to a PHAR deserialization vulnerability on PHP < 8.0 using the phar:// stream wrapper. | HIGH 8.8EPSS 18.0% | 30 May 2023 |
| CVE-2023-0329 | The Elementor Website Builder WordPress plugin before 3.12.2 does not properly sanitize and escape the Replace URL parameter in the Tools module before using it in a SQL statement, leading to a SQL injection exploitable by users with the Administrator… | HIGH 7.2EPSS 19.7% | 30 May 2023 |
| CVE-2023-30253 | Dolibarr before 17.0.1 allows remote code execution by an authenticated user via an uppercase manipulation: <?PHP instead of <?php in injected data. | HIGH 8.8EPSS 82.1% | 29 May 2023 |
| CVE-2022-24632 | It is directory traversal during file download via the BrowseFiles.php view parameter. | EXPLOITMEDIUM 5.3EPSS 27.2% | 29 May 2023 |
| CVE-2022-24631 | It is stored XSS via the ajaxTenants.php desc parameter. | MEDIUM 5.4EPSS 41.4% | 29 May 2023 |
| CVE-2022-24630 | BrowseFiles.php allows a ?cmd=ssh POST request with an ssh_command field that is executed. | EXPLOITHIGH 7.2EPSS 23.9% | 29 May 2023 |
| CVE-2022-24629 | Remote code execution can be achieved via directory traversal in the dir parameter of the file upload functionality of BrowseFiles.php. | EXPLOITCRITICAL 9.8EPSS 37.2% | 29 May 2023 |
| CVE-2022-24627 | It is an unauthenticated SQL injection in the p parameter of the process_login.php login form. | EXPLOITCRITICAL 9.8EPSS 26.4% | 29 May 2023 |
| CVE-2023-2948 | Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1. | MEDIUM 6.1EPSS 96.7% | 28 May 2023 |
| CVE-2023-2947 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. | MEDIUM 4.8EPSS 90.4% | 27 May 2023 |
| CVE-2023-2928 | A vulnerability was found in DedeCMS up to 5.7.106. | HIGH 8.8EPSS 51.4% | 27 May 2023 |
| CVE-2023-2924 | A vulnerability, which was classified as critical, has been found in Supcon SimField up to 1.80.00.00. | CRITICAL 9.8EPSS 24.3% | 27 May 2023 |
| CVE-2023-32315 | Ignite Realtime Openfire Path Traversal Vulnerability | KEVHIGH 7.5EPSS 100.0% | 26 May 2023 |
| CVE-2023-2825 | An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups. | HIGH 7.5EPSS 71.6% | 26 May 2023 |
| CVE-2023-33440 | Sourcecodester Faculty Evaluation System v1.0 is vulnerable to arbitrary code execution via /eval/ajax.php?action=save_user. | EXPLOIT ✓HIGH 7.2EPSS 14.5% | 26 May 2023 |
| CVE-2023-30145 | Camaleon CMS v2.7.0 was discovered to contain a Server-Side Template Injection (SSTI) vulnerability via the formats parameter. | EXPLOIT ✓CRITICAL 9.8EPSS 45.9% | 26 May 2023 |
| CVE-2023-2732 | The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. | CRITICAL 9.8EPSS 67.3% | 25 May 2023 |
| CVE-2023-2868 | Barracuda Networks ESG Appliance Improper Input Validation Vulnerability | KEVCRITICAL 9.8EPSS 86.8% | 24 May 2023 |
| CVE-2023-33246 | Apache RocketMQ Command Execution Vulnerability | KEVCRITICAL 9.8EPSS 96.6% | 24 May 2023 |
| CVE-2023-33010 | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | KEVCRITICAL 9.8EPSS 29.0% | 24 May 2023 |
| CVE-2023-33009 | Zyxel Multiple Firewalls Buffer Overflow Vulnerability | KEVCRITICAL 9.8EPSS 28.1% | 24 May 2023 |
| CVE-2023-29919 | SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. | CRITICAL 9.1EPSS 60.2% | 23 May 2023 |
| CVE-2023-31689 | In Wcms 0.3.2, an attacker can send a crafted request from a vulnerable web application backend server /wcms/wex/html.php via the finish parameter and the textAreaCode parameter. | CRITICAL 9.8EPSS 20.2% | 22 May 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.