Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 56 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-2560 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. | CRITICAL 9.1EPSS 77.7% | 29 March 2023 |
| CVE-2022-27643 | This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700v3 1.0.4.120_10.0.91 routers. | HIGH 8.8EPSS 25.2% | 29 March 2023 |
| CVE-2023-27394 | Osprey Pump Controller version 1.01 is vulnerable an unauthenticated OS command injection vulnerability. | CRITICAL 9.8EPSS 17.6% | 28 March 2023 |
| CVE-2023-0210 | A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems. | HIGH 7.5EPSS 71.7% | 27 March 2023 |
| CVE-2023-22249 | Adobe Commerce versions 2.4.4-p2 (and earlier) and 2.4.5-p1 (and earlier) are affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by a high-privileged attacker to inject malicious scripts into vulnerable form fields. | MEDIUM 4.8EPSS 58.5% | 27 March 2023 |
| CVE-2023-1380 | This issue could occur when assoc_info->req_len data is bigger than the size of the buffer, defined as WL_EXTRA_BUF_MAX, leading to a denial of service. | HIGH 7.1EPSS 16.2% | 27 March 2023 |
| CVE-2022-48428 | In JetBrains TeamCity before 2022.10.3 stored XSS on the SSH keys page was possible | MEDIUM 5.4EPSS 68.0% | 27 March 2023 |
| CVE-2023-1133 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. | CRITICAL 9.8EPSS 50.0% | 27 March 2023 |
| CVE-2023-26802 | An issue in the component /network_config/nsg_masq.cgi of DCN (Digital China Networks) DCBI-Netlog-LAB v1.0 allows attackers to bypass authentication and execute arbitrary commands via a crafted request. | CRITICAL 9.8EPSS 48.7% | 26 March 2023 |
| CVE-2023-26801 | LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg. | CRITICAL 9.8EPSS 77.7% | 26 March 2023 |
| CVE-2023-1177 | Path Traversal: '\..\filename' in GitHub repository mlflow/mlflow prior to 2.2.1. | CRITICAL 9.8EPSS 69.7% | 24 March 2023 |
| CVE-2023-27034 | PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability. | CRITICAL 9.8EPSS 58.7% | 23 March 2023 |
| CVE-2023-26361 | Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in Arbitrary file system read. | MEDIUM 4.9EPSS 58.7% | 23 March 2023 |
| CVE-2023-26360 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | KEVHIGH 8.6EPSS 97.3% | 23 March 2023 |
| CVE-2023-26359 | Adobe ColdFusion Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 17.0% | 23 March 2023 |
| CVE-2023-26496 | Memory corruption can occur due to improper checking of the parameter length while parsing the fmtp attribute in the SDP (Session Description Protocol) module. | CRITICAL 9.8EPSS 21.4% | 23 March 2023 |
| CVE-2023-26498 | Memory corruption can occur due to improper checking of the number of properties while parsing the chatroom attribute in the SDP (Session Description Protocol) module. | CRITICAL 9.8EPSS 21.4% | 23 March 2023 |
| CVE-2023-28662 | The Gift Cards (Gift Vouchers and Packages) WordPress Plugin, version <= 4.3.1, is affected by an unauthenticated SQL injection vulnerability in the template parameter in the wpgv_doajax_voucher_pdf_save_func action. | CRITICAL 9.8EPSS 42.2% | 22 March 2023 |
| CVE-2023-28432 | MinIO Information Disclosure Vulnerability | KEVHIGH 7.5EPSS 84.0% | 22 March 2023 |
| CVE-2023-1578 | SQL Injection in GitHub repository pimcore/pimcore prior to 10.5.19. | HIGH 8.8EPSS 62.8% | 22 March 2023 |
| CVE-2023-27857 | An unauthenticated remote attacker can exploit this vulnerability to crash ThinServer.exe due to a read access violation. | HIGH 7.5EPSS 18.3% | 22 March 2023 |
| CVE-2023-28725 | General Bytes Crypto Application Server (CAS) 20230120, as distributed with General Bytes BATM devices, allows remote attackers to execute arbitrary Java code by uploading a Java application to the /batm/app/admin/standalone/deployments directory, aka… | CRITICAL 9.1EPSS 20.6% | 22 March 2023 |
| CVE-2023-27856 | In affected versions, path traversal exists when processing a message of type 8 in Rockwell Automation's ThinManager ThinServer. | HIGH 7.5EPSS 77.2% | 22 March 2023 |
| CVE-2023-27855 | In affected versions, a path traversal exists when processing a message in Rockwell Automation's ThinManager ThinServer. | CRITICAL 9.8EPSS 13.5% | 22 March 2023 |
| CVE-2023-24709 | An issue found in Paradox Security Systems IPR512 allows attackers to cause a denial of service via the login.html and login.xml parameters. | EXPLOITHIGH 7.5EPSS 44.2% | 21 March 2023 |
| CVE-2023-26497 | Memory corruption can occur when processing Session Description Negotiation for Video Configuration Attribute. | CRITICAL 9.8EPSS 21.4% | 21 March 2023 |
| CVE-2022-45124 | An information disclosure vulnerability exists in the User authentication functionality of WellinTech KingHistorian 35.01.00.05. | HIGH 7.5EPSS 13.4% | 20 March 2023 |
| CVE-2022-43663 | An integer conversion vulnerability exists in the SORBAx64.dll RecvPacket functionality of WellinTech KingHistorian 35.01.00.05. | CRITICAL 9.8EPSS 14.0% | 20 March 2023 |
| CVE-2023-28425 | Redis is an in-memory database that persists on disk. | MEDIUM 5.5EPSS 58.5% | 20 March 2023 |
| CVE-2023-0631 | The Paid Memberships Pro WordPress plugin before 2.9.12 does not prevent subscribers from rendering shortcodes that concatenate attributes directly into an SQL query. | HIGH 8.8EPSS 60.5% | 20 March 2023 |
| CVE-2023-27253 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml. | EXPLOITHIGH 8.8EPSS 89.5% | 17 March 2023 |
| CVE-2023-1454 | A vulnerability classified as critical has been found in jeecg-boot 3.5.0. | CRITICAL 9.8EPSS 36.1% | 17 March 2023 |
| CVE-2022-43605 | An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. | CRITICAL 9.8EPSS 14.4% | 16 March 2023 |
| CVE-2022-43604 | An out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. | CRITICAL 9.8EPSS 14.4% | 16 March 2023 |
| CVE-2023-25280 | D-Link DIR-820 Router OS Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 97.9% | 16 March 2023 |
| CVE-2023-28461 | Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.8EPSS 68.1% | 15 March 2023 |
| CVE-2023-1389 | TP-Link Archer AX-21 Command Injection Vulnerability | KEVEXPLOITHIGH 8.8EPSS 100.0% | 15 March 2023 |
| CVE-2023-28343 | OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php. | EXPLOITCRITICAL 9.8EPSS 84.8% | 14 March 2023 |
| CVE-2023-24880 | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | KEVMEDIUM 4.4EPSS 78.0% | 14 March 2023 |
| CVE-2023-23397 | Microsoft Office Outlook Privilege Escalation Vulnerability | KEVCRITICAL 9.8EPSS 97.2% | 14 March 2023 |
| CVE-2023-23383 | Service Fabric Explorer Spoofing Vulnerability | MEDIUM 4.7EPSS 11.7% | 14 March 2023 |
| CVE-2022-39214 | Combodo iTop is an open source, web-based IT service management platform. | HIGH 7.5EPSS 25.6% | 14 March 2023 |
| CVE-2023-25279 | OS Command injection vulnerability in D-Link DIR820LA1_FW105B03 allows attackers to escalate privileges to root via a crafted payload. | CRITICAL 9.8EPSS 31.0% | 13 March 2023 |
| CVE-2022-31474 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in iThemes BackupBuddy allows Path Traversal.This issue affects BackupBuddy: from 8.5.8.0 through 8.7.4.1. | HIGH 7.5EPSS 63.8% | 13 March 2023 |
| CVE-2023-24033 | The Samsung Exynos Modem 5123, Exynos Modem 5300, Exynos 980, Exynos 1080, and Exynos Auto T512 baseband modem chipsets do not properly check format types specified by the Session Description Protocol (SDP) module, which can lead to a denial of service. | CRITICAL 9.8EPSS 32.9% | 13 March 2023 |
| CVE-2023-27532 | Veeam Backup & Replication Cloud Connect Missing Authentication for Critical Function Vulnerability | KEVHIGH 7.5EPSS 80.6% | 10 March 2023 |
| CVE-2022-44574 | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port. | HIGH 7.5EPSS 64.3% | 10 March 2023 |
| CVE-2023-27853 | NETGEAR Nighthawk WiFi6 Router prior to V1.0.10.94 contains a format string vulnerability in a SOAP service that could allow an attacker to execute arbitrary code on the device. | CRITICAL 9.8EPSS 19.7% | 10 March 2023 |
| CVE-2023-0050 | A specially crafted Kroki diagram could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. | MEDIUM 5.4EPSS 92.4% | 9 March 2023 |
| CVE-2023-25573 | In affected versions an improper access control vulnerability exists in `/api/jmeter/download/files`, which allows any user to download any file without authentication. | HIGH 7.5EPSS 51.6% | 9 March 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.