Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 57 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-27482 | A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. | CRITICAL 10.0EPSS 72.2% | 8 March 2023 |
| CVE-2023-24775 | Funadmin v3.2.0 was discovered to contain a SQL injection vulnerability via the selectFields parameter at \member\Member.php. | CRITICAL 9.8EPSS 19.8% | 7 March 2023 |
| CVE-2022-41328 | Fortinet FortiOS Path Traversal Vulnerability | KEVHIGH 7.1EPSS 10.7% | 7 March 2023 |
| CVE-2023-25690 | Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. | CRITICAL 9.8EPSS 84.5% | 7 March 2023 |
| CVE-2023-26601 | Zoho ManageEngine ServiceDesk Plus through 14104, Asset Explorer through 6987, ServiceDesk Plus MSP before 14000, and Support Center Plus before 14000 allow Denial-of-Service (DoS). | HIGH 7.5EPSS 34.1% | 6 March 2023 |
| CVE-2023-24734 | An arbitrary file upload vulnerability in the camera_upload.php component of PMB v7.4.6 allows attackers to execute arbitrary code via a crafted image file. | CRITICAL 9.8EPSS 20.7% | 6 March 2023 |
| CVE-2021-36393 | In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses. | CRITICAL 9.8EPSS 52.3% | 6 March 2023 |
| CVE-2023-20079 | Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. | HIGH 7.5EPSS 10.3% | 3 March 2023 |
| CVE-2023-20078 | Multiple vulnerabilities in the web-based management interface of certain Cisco IP Phones could allow an unauthenticated, remote attacker to execute arbitrary code or cause a denial of service (DoS) condition. | CRITICAL 9.8EPSS 10.4% | 3 March 2023 |
| CVE-2022-45551 | An issue discovered in Shenzhen Zhiboton Electronics ZBT WE1626 Router v 21.06.18 allows attackers to escalate privileges via WGET command to the Network Diagnosis endpoint. | CRITICAL 9.8EPSS 23.6% | 3 March 2023 |
| CVE-2023-1162 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. | HIGH 8.8EPSS 26.0% | 3 March 2023 |
| CVE-2023-0656 | A Stack-based buffer overflow vulnerability in the SonicOS allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted firewall to crash. | HIGH 7.5EPSS 41.3% | 2 March 2023 |
| CVE-2023-26475 | Starting in version 2.3-milestone-1, the annotation displayer does not execute the content in a restricted context. | HIGH 8.8EPSS 63.6% | 2 March 2023 |
| CVE-2023-0084 | The Metform Elementor Contact Form Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via text areas on forms in versions up to, and including, 3.1.2 due to insufficient input sanitization and output escaping. | EXPLOITMEDIUM 6.1EPSS 28.6% | 2 March 2023 |
| CVE-2023-26477 | Starting in versions 6.3-rc-1 and 6.2.4, it's possible to inject arbitrary wiki syntax including Groovy, Python and Velocity script macros via the `newThemeName` request parameter (URL parameter), in combination with additional parameters. | CRITICAL 9.8EPSS 74.8% | 2 March 2023 |
| CVE-2023-0507 | Starting with the 8.1 branch, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. | MEDIUM 5.4EPSS 15.5% | 1 March 2023 |
| CVE-2022-36021 | Authenticated users can use string matching commands (like `SCAN` or `KEYS`) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. | MEDIUM 5.5EPSS 59.8% | 1 March 2023 |
| CVE-2023-20032 | On Feb 15, 2023, the following vulnerability in the ClamAV scanning library was disclosed: A vulnerability in the HFS+ partition file parser of ClamAV versions 1.0.0 and earlier, 0.105.1 and earlier, and 0.103.7 and earlier could allow an… | CRITICAL 9.8EPSS 30.1% | 1 March 2023 |
| CVE-2022-47075 | An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx. | EXPLOITHIGH 7.5EPSS 59.4% | 28 February 2023 |
| CVE-2023-27372 | SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. | EXPLOIT ✓CRITICAL 9.8EPSS 99.7% | 28 February 2023 |
| CVE-2023-27293 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. | MEDIUM 6.1EPSS 57.0% | 28 February 2023 |
| CVE-2023-26256 | An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. | HIGH 7.5EPSS 11.7% | 28 February 2023 |
| CVE-2023-26255 | An unauthenticated path traversal vulnerability affects the "STAGIL Navigation for Jira - Menu & Themes" plugin before 2.0.52 for Jira. | HIGH 7.5EPSS 47.2% | 28 February 2023 |
| CVE-2022-22582 | A local user may be able to write arbitrary files. | MEDIUM 5.5EPSS 17.6% | 27 February 2023 |
| CVE-2023-25235 | Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function formOneSsidCfgSet via parameter ssid. | HIGH 7.5EPSS 11.1% | 27 February 2023 |
| CVE-2023-25234 | Tenda AC500 V2.0.1.9(1307) is vulnerable to Buffer Overflow in function fromAddressNat via parameters entrys and mitInterface. | CRITICAL 9.8EPSS 16.6% | 27 February 2023 |
| CVE-2023-0552 | The Registration Forms WordPress plugin before 3.8.2.3 does not properly validate the redirection URL when logging in and login out, leading to an Open Redirect vulnerability | MEDIUM 5.4EPSS 24.3% | 27 February 2023 |
| CVE-2023-26609 | ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin/mft/wireless_mft ap field. | EXPLOITHIGH 7.2EPSS 38.7% | 27 February 2023 |
| CVE-2023-26602 | ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution. | EXPLOITCRITICAL 9.8EPSS 17.4% | 26 February 2023 |
| CVE-2022-2024 | OS Command Injection in GitHub repository gogs/gogs prior to 0.12.11. | CRITICAL 9.8EPSS 97.8% | 25 February 2023 |
| CVE-2023-26035 | Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. | CRITICAL 9.8EPSS 80.5% | 25 February 2023 |
| CVE-2023-1034 | Path Traversal: '\..\filename' in GitHub repository salesagility/suitecrm prior to 7.12.9. | HIGH 8.8EPSS 26.2% | 25 February 2023 |
| CVE-2023-1009 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability classified as critical has been found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. | MEDIUM 5.5EPSS 15.7% | 24 February 2023 |
| CVE-2023-0755 | The affected products are vulnerable to an improper validation of array index, which could allow an attacker to crash the server and remotely execute arbitrary code. | CRITICAL 9.8EPSS 11.8% | 23 February 2023 |
| CVE-2022-48343 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. | MEDIUM 6.1EPSS 59.5% | 23 February 2023 |
| CVE-2023-0104 | The listed versions for Weintek EasyBuilder Pro are vulnerable to a ZipSlip attack caused by decompiling a malicious project file. | HIGH 7.8EPSS 21.8% | 22 February 2023 |
| CVE-2022-29273 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. | MEDIUM 6.1EPSS 59.6% | 22 February 2023 |
| CVE-2023-20858 | VMware Carbon Black App Control 8.7.x prior to 8.7.8, 8.8.x prior to 8.8.6, and 8.9.x.prior to 8.9.4 contain an injection vulnerability. | HIGH 7.2EPSS 16.9% | 22 February 2023 |
| CVE-2023-25157 | GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. | CRITICAL 9.8EPSS 85.2% | 21 February 2023 |
| CVE-2023-24998 | Apache Commons FileUpload before 1.5 does not limit the number of request parts to be processed resulting in the possibility of an attacker triggering a DoS with a malicious upload or series of uploads. | HIGH 7.5EPSS 48.8% | 20 February 2023 |
| CVE-2023-22232 | Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. | EXPLOIT ×2MEDIUM 5.3EPSS 83.4% | 17 February 2023 |
| CVE-2022-47986 | IBM Aspera Faspex Code Execution Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 17 February 2023 |
| CVE-2023-24329 | An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. | HIGH 7.5EPSS 20.5% | 17 February 2023 |
| CVE-2022-45701 | Arris TG2482A firmware through 9.1.103GEM9 allow Remote Code Execution (RCE) via the ping utility feature. | EXPLOITHIGH 8.8EPSS 42.6% | 17 February 2023 |
| CVE-2022-40032 | SQL Injection vulnerability in Simple Task Managing System version 1.0 in login.php in 'username' and 'password' parameters, allows attackers to execute arbitrary code and gain sensitive information. | EXPLOIT ✓CRITICAL 9.8EPSS 20.7% | 17 February 2023 |
| CVE-2023-24078 | Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/. | EXPLOITHIGH 8.8EPSS 53.0% | 17 February 2023 |
| CVE-2022-39952 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to… | CRITICAL 9.8EPSS 99.8% | 16 February 2023 |
| CVE-2021-42756 | Multiple stack-based buffer overflow vulnerabilities [CWE-121] in the proxy daemon of FortiWeb 5.x all versions, 6.0.7 and below, 6.1.2 and below, 6.2.6 and below, 6.3.16 and below, 6.4 all versions may allow an unauthenticated remote attacker to… | CRITICAL 9.8EPSS 35.2% | 16 February 2023 |
| CVE-2023-23752 | Joomla! Improper Access Control Vulnerability | KEVEXPLOIT ✓MEDIUM 5.3EPSS 99.8% | 16 February 2023 |
| CVE-2023-0861 | NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. | HIGH 8.8EPSS 28.7% | 16 February 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.