Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 58 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-22855 | Kardex Mlog MCC 5.7.12+0-a203c2a213-master allows remote code execution. | EXPLOITCRITICAL 9.8EPSS 14.8% | 15 February 2023 |
| CVE-2023-23836 | SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. | HIGH 7.2EPSS 80.3% | 15 February 2023 |
| CVE-2022-47507 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. | HIGH 7.2EPSS 12.9% | 15 February 2023 |
| CVE-2022-47504 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. | HIGH 7.2EPSS 41.9% | 15 February 2023 |
| CVE-2022-47503 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. | HIGH 7.2EPSS 41.0% | 15 February 2023 |
| CVE-2022-38111 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. | HIGH 7.2EPSS 84.8% | 15 February 2023 |
| CVE-2023-25762 | Jenkins Pipeline: Build Step Plugin 2.18 and earlier does not escape job names in a JavaScript expression used in the Pipeline Snippet Generator, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers able to control job… | MEDIUM 5.4EPSS 82.1% | 15 February 2023 |
| CVE-2023-24580 | Passing certain inputs (e.g., an excessive number of parts) to multipart forms could result in too many open files or memory exhaustion, and provided a potential vector for a denial-of-service attack. | HIGH 7.5EPSS 62.6% | 15 February 2023 |
| CVE-2023-23376 | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 10.9% | 14 February 2023 |
| CVE-2023-22629 | The move-file function has a path traversal vulnerability in the newPath parameter. | EXPLOITHIGH 8.8EPSS 12.3% | 14 February 2023 |
| CVE-2023-21819 | Windows Secure Channel Denial of Service Vulnerability | HIGH 7.5EPSS 30.8% | 14 February 2023 |
| CVE-2023-21818 | Windows Secure Channel Denial of Service Vulnerability | HIGH 7.5EPSS 43.2% | 14 February 2023 |
| CVE-2023-21716 | Microsoft Word Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 84.8% | 14 February 2023 |
| CVE-2023-21715 | Microsoft Office Publisher Security Feature Bypass Vulnerability | KEVHIGH 7.3EPSS 12.0% | 14 February 2023 |
| CVE-2023-21707 | Microsoft Exchange Server Remote Code Execution Vulnerability | HIGH 8.8EPSS 79.6% | 14 February 2023 |
| CVE-2023-21692 | Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 21.4% | 14 February 2023 |
| CVE-2023-21690 | Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 27.7% | 14 February 2023 |
| CVE-2023-21689 | Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 26.7% | 14 February 2023 |
| CVE-2023-21529 | Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability | KEVHIGH 8.8EPSS 59.3% | 14 February 2023 |
| CVE-2023-0830 | A vulnerability classified as critical has been found in EasyNAS 1.1.0. | EXPLOITMEDIUM 5.3EPSS 20.9% | 14 February 2023 |
| CVE-2023-25717 | Multiple Ruckus Wireless Products CSRF and RCE Vulnerability | KEVCRITICAL 9.8EPSS 98.1% | 13 February 2023 |
| CVE-2023-0159 | The Extensive VC Addons for WPBakery page builder WordPress plugin before 1.9.1 does not validate a parameter passed to the php extract function when loading templates, allowing an unauthenticated attacker to override the template path to read arbitrary… | EXPLOITHIGH 7.5EPSS 55.5% | 13 February 2023 |
| CVE-2022-4830 | The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site… | MEDIUM 5.4EPSS 65.0% | 13 February 2023 |
| CVE-2022-40022 | Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. | CRITICAL 9.8EPSS 92.5% | 13 February 2023 |
| CVE-2022-48323 | Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. | CRITICAL 9.8EPSS 56.8% | 13 February 2023 |
| CVE-2023-0777 | Authentication Bypass by Primary Weakness in GitHub repository modoboa/modoboa prior to 2.0.4. | EXPLOITCRITICAL 9.8EPSS 15.2% | 10 February 2023 |
| CVE-2022-46650 | Acemanager in ALEOS before version 4.16 allows a user with valid credentials to reconfigure the device to expose the ACEManager credentials on the pre-login status page. | MEDIUM 4.9EPSS 12.3% | 10 February 2023 |
| CVE-2022-45699 | Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter. | CRITICAL 9.8EPSS 76.6% | 10 February 2023 |
| CVE-2023-24322 | A reflected cross-site scripting (XSS) vulnerability in the FileDialog.aspx component of mojoPortal v2.7.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the ed and tbi parameters. | MEDIUM 6.1EPSS 31.7% | 9 February 2023 |
| CVE-2023-21434 | Improper input validation vulnerability in Galaxy Store prior to version 4.5.49.8 allows local attackers to execute JavaScript by launching a web page. | MEDIUM 6.1EPSS 12.9% | 9 February 2023 |
| CVE-2023-0286 | There is a type confusion vulnerability relating to X.400 address processing inside an X.509 GeneralName. | HIGH 7.4EPSS 69.3% | 8 February 2023 |
| CVE-2022-4450 | This will most likely lead to a crash. | HIGH 7.5EPSS 28.6% | 8 February 2023 |
| CVE-2022-4304 | To achieve a successful decryption an attacker would have to be able to send a very large number of trial messages for decryption. | MEDIUM 5.9EPSS 23.5% | 8 February 2023 |
| CVE-2022-45768 | Command Injection vulnerability in Edimax Technology Co., Ltd. | HIGH 8.8EPSS 28.7% | 7 February 2023 |
| CVE-2023-25194 | A possible security vulnerability has been identified in Apache Kafka Connect API. | HIGH 8.8EPSS 95.8% | 7 February 2023 |
| CVE-2022-24990 | TerraMaster OS Remote Command Execution Vulnerability | KEVHIGH 7.5EPSS 83.2% | 7 February 2023 |
| CVE-2022-40224 | A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. | HIGH 7.5EPSS 64.7% | 7 February 2023 |
| CVE-2022-3229 | Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage… | CRITICAL 9.8EPSS 66.4% | 6 February 2023 |
| CVE-2023-23333 | There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. | EXPLOITCRITICAL 9.8EPSS 99.3% | 6 February 2023 |
| CVE-2022-44268 | ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. | EXPLOITMEDIUM 6.5EPSS 89.9% | 6 February 2023 |
| CVE-2022-44267 | ImageMagick 7.1.0-49 is vulnerable to Denial of Service. | EXPLOITMEDIUM 6.5EPSS 76.6% | 6 February 2023 |
| CVE-2023-0669 | Fortra GoAnywhere MFT Remote Code Execution Vulnerability | KEVEXPLOITHIGH 7.2EPSS 100.0% | 6 February 2023 |
| CVE-2023-0234 | The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue. | HIGH 8.8EPSS 18.0% | 6 February 2023 |
| CVE-2022-47071 | In NVS365 V01, the background network test function can trigger command execution. | CRITICAL 9.8EPSS 43.1% | 6 February 2023 |
| CVE-2023-0678 | Missing Authorization in GitHub repository phpipam/phpipam prior to v1.5.1. | MEDIUM 5.3EPSS 37.3% | 4 February 2023 |
| CVE-2023-25136 | OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. | MEDIUM 6.5EPSS 89.8% | 3 February 2023 |
| CVE-2023-25135 | vBulletin before 5.6.9 PL1 allows an unauthenticated remote attacker to execute arbitrary code via a crafted HTTP request that triggers deserialization. | CRITICAL 9.8EPSS 23.9% | 3 February 2023 |
| CVE-2022-46552 | D-Link DIR-846 Firmware FW100A53DBR was discovered to contain a remote command execution (RCE) vulnerability via the lan(0)_dhcps_staticlist parameter. | EXPLOITHIGH 8.8EPSS 10.5% | 2 February 2023 |
| CVE-2023-23076 | OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules. | CRITICAL 9.8EPSS 74.3% | 1 February 2023 |
| CVE-2023-23074 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. | MEDIUM 6.1EPSS 83.6% | 1 February 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.