Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 59 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2023-23969 | This leads to a potential denial-of-service vector via excessive memory usage if the raw value of Accept-Language headers is very large. | HIGH 7.5EPSS 47.4% | 1 February 2023 |
| CVE-2023-22501 | An authentication vulnerability was discovered in Jira Service Management Server and Data Center which allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances_._ With write access… | CRITICAL 9.1EPSS 15.5% | 1 February 2023 |
| CVE-2023-22374 | A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. | HIGH 8.5EPSS 70.8% | 1 February 2023 |
| CVE-2023-0587 | A file upload vulnerability in exists in Trend Micro Apex One server build 11110. | CRITICAL 9.1EPSS 59.6% | 1 February 2023 |
| CVE-2022-4395 | The Membership For WooCommerce WordPress plugin before 2.1.7 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as malicious PHP code, and achieve RCE. | EXPLOITCRITICAL 9.8EPSS 17.6% | 30 January 2023 |
| CVE-2023-0563 | A vulnerability classified as problematic has been found in PHPGurukul Bank Locker Management System 1.0. | MEDIUM 4.8EPSS 37.6% | 28 January 2023 |
| CVE-2023-0562 | A vulnerability was found in PHPGurukul Bank Locker Management System 1.0. | CRITICAL 9.8EPSS 44.3% | 28 January 2023 |
| CVE-2023-0448 | The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability. | MEDIUM 6.1EPSS 42.9% | 26 January 2023 |
| CVE-2022-4510 | A path traversal vulnerability was identified in ReFirm Labs binwalk from version 2.1.2b through 2.3.3 included. | EXPLOITHIGH 7.8EPSS 22.0% | 26 January 2023 |
| CVE-2022-3924 | This issue can affect BIND 9 resolvers with `stale-answer-enable yes;` that also make use of the option `stale-answer-client-timeout`, configured with a value greater than zero. | HIGH 7.5EPSS 16.0% | 26 January 2023 |
| CVE-2022-3736 | BIND 9 resolver can crash when stale cache and stale answers are enabled, option `stale-answer-client-timeout` is set to a positive integer, and the resolver receives an RRSIG query. | HIGH 7.5EPSS 48.4% | 26 January 2023 |
| CVE-2022-3488 | Processing of repeated responses to the same query, where both responses contain ECS pseudo-options, but where the first is broken in some way, can cause BIND to exit with an assertion failure. 'Broken' in this context is anything that would cause the… | HIGH 7.5EPSS 19.0% | 26 January 2023 |
| CVE-2022-3094 | The scope of this vulnerability is limited therefore to trusted clients who are permitted to make dynamic zone changes. | HIGH 7.5EPSS 13.2% | 26 January 2023 |
| CVE-2022-31711 | VMware vRealize Log Insight contains an Information Disclosure Vulnerability. | MEDIUM 5.3EPSS 22.3% | 26 January 2023 |
| CVE-2022-31706 | The vRealize Log Insight contains a Directory Traversal Vulnerability. | CRITICAL 9.8EPSS 87.1% | 26 January 2023 |
| CVE-2022-31704 | The vRealize Log Insight contains a broken access control vulnerability. | CRITICAL 9.8EPSS 81.0% | 26 January 2023 |
| CVE-2022-29844 | A vulnerability in the FTP service of Western Digital My Cloud OS 5 devices running firmware versions prior to 5.26.119 allows an attacker to read and write arbitrary files. | CRITICAL 9.8EPSS 36.4% | 26 January 2023 |
| CVE-2022-41142 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. | HIGH 8.8EPSS 85.0% | 26 January 2023 |
| CVE-2023-23560 | In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation. | CRITICAL 9.8EPSS 13.9% | 23 January 2023 |
| CVE-2023-22960 | Lexmark products through 2023-01-10 have Improper Control of Interaction Frequency. | HIGH 7.5EPSS 28.0% | 23 January 2023 |
| CVE-2022-4305 | The Login as User or Customer WordPress plugin before 3.3 lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. | CRITICAL 9.8EPSS 38.6% | 23 January 2023 |
| CVE-2022-4230 | The WP Statistics WordPress plugin before 13.2.9 does not escape a parameter, which could allow authenticated users to perform SQL Injection attacks. | HIGH 8.8EPSS 35.7% | 23 January 2023 |
| CVE-2023-22884 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1;… | CRITICAL 9.8EPSS 11.9% | 21 January 2023 |
| CVE-2023-23492 | The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action. | HIGH 8.8EPSS 57.1% | 20 January 2023 |
| CVE-2023-22458 | Authenticated users can issue a `HRANDFIELD` or `ZRANDMEMBER` command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. | MEDIUM 5.5EPSS 72.0% | 20 January 2023 |
| CVE-2022-35977 | Authenticated users issuing specially crafted `SETRANGE` and `SORT(_RO)` commands can trigger an integer overflow, resulting with Redis attempting to allocate impossible amounts of memory and abort with an out-of-memory (OOM) panic. | MEDIUM 5.5EPSS 14.0% | 20 January 2023 |
| CVE-2023-23489 | The Easy Digital Downloads WordPress Plugin, versions 3.1.0.2 & 3.1.0.3, is affected by an unauthenticated SQL injection vulnerability in the 's' parameter of its 'edd_download_search' action. | CRITICAL 9.8EPSS 11.3% | 20 January 2023 |
| CVE-2023-23488 | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route. | EXPLOIT ✓CRITICAL 9.8EPSS 92.5% | 20 January 2023 |
| CVE-2023-23596 | jc21 NGINX Proxy Manager through 2.9.19 allows OS command injection. | HIGH 8.8EPSS 15.6% | 20 January 2023 |
| CVE-2022-20966 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to conduct cross-site scripting attacks against other users of the application web-based management interface. | MEDIUM 5.4EPSS 27.6% | 20 January 2023 |
| CVE-2022-20964 | A vulnerability in the web-based management interface of Cisco Identity Services Engine could allow an authenticated, remote attacker to inject arbitrary commands on the underlying operating system. | HIGH 8.8EPSS 30.6% | 20 January 2023 |
| CVE-2022-46476 | D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function. | CRITICAL 9.8EPSS 41.1% | 19 January 2023 |
| CVE-2023-0126 | Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory. | HIGH 7.5EPSS 72.7% | 19 January 2023 |
| CVE-2022-46889 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php. | MEDIUM 5.4EPSS 60.1% | 19 January 2023 |
| CVE-2022-46887 | Multiple SQL injection vulnerabilities in NexusPHP before 1.7.33 allow remote attackers to execute arbitrary SQL commands via the conuser[] parameter in takeconfirm.php; the delcheater parameter in cheaterbox.php; or the usernw parameter in nowarn.php. | CRITICAL 9.8EPSS 19.4% | 19 January 2023 |
| CVE-2022-47745 | ZenTao 16.4 to 18.0.beta1 is vulnerable to SQL injection. | HIGH 8.8EPSS 15.4% | 19 January 2023 |
| CVE-2022-45926 | The endpoint notify.localizeEmailTemplate allows a low-privilege user to evaluate webreports. | HIGH 8.8EPSS 17.0% | 18 January 2023 |
| CVE-2022-45925 | If this parameter is present, the response includes most of the HTTP headers sent to the server and some of the CGI variables like remote_adde and server_name, which is an information disclosure. | HIGH 7.5EPSS 16.9% | 18 January 2023 |
| CVE-2023-21608 | Adobe Acrobat and Reader Use-After-Free Vulnerability | KEVHIGH 7.8EPSS 59.4% | 18 January 2023 |
| CVE-2020-35326 | SQL Injection vulnerability in file /inxedu/demo_inxedu_open/src/main/resources/mybatis/inxedu/website/WebsiteImagesMapper.xml in inxedu 2.0.6 via the id value. | CRITICAL 9.8EPSS 13.6% | 18 January 2023 |
| CVE-2022-47966 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | KEVCRITICAL 9.8EPSS 99.8% | 18 January 2023 |
| CVE-2023-22809 | In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. | EXPLOITHIGH 7.8EPSS 55.4% | 18 January 2023 |
| CVE-2021-33959 | Plex media server 1.21 and before is vulnerable to ddos reflection attack via plex service. | HIGH 7.5EPSS 15.0% | 18 January 2023 |
| CVE-2023-21887 | Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: GIS). | MEDIUM 4.9EPSS 43.4% | 18 January 2023 |
| CVE-2023-21839 | Oracle WebLogic Server Unspecified Vulnerability | KEVHIGH 7.5EPSS 99.9% | 18 January 2023 |
| CVE-2022-41903 | Git is distributed revision control system. `git log` can display commits in an arbitrary format using its `--format` specifiers. | CRITICAL 9.8EPSS 44.3% | 17 January 2023 |
| CVE-2022-23521 | Git is distributed revision control system. gitattributes are a mechanism to allow defining attributes for paths. | CRITICAL 9.8EPSS 56.3% | 17 January 2023 |
| CVE-2021-32837 | mechanize, a library for automatically interacting with HTTP web servers, contains a regular expression that is vulnerable to regular expression denial of service (ReDoS) prior to version 0.4.6. | HIGH 7.5EPSS 28.9% | 17 January 2023 |
| CVE-2022-37436 | Prior to Apache HTTP Server 2.4.55, a malicious backend can cause the response headers to be truncated early, resulting in some headers being incorporated into the response body. | MEDIUM 5.3EPSS 55.9% | 17 January 2023 |
| CVE-2022-4101 | The Images Optimize and Upload CF7 WordPress plugin through 2.1.4 does not validate the file to be deleted via an AJAX action available to unauthenticated users, which could allow them to delete arbitrary files on the server via path traversal attack. | CRITICAL 9.1EPSS 29.4% | 16 January 2023 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.