Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 61 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-40005 | Intelbras WiFiber 120AC inMesh before 1-1-220826 allows command injection by authenticated users, as demonstrated by the /boaform/formPing6 and /boaform/formTracert URIs for ping and traceroute. | HIGH 8.8EPSS 35.0% | 25 December 2022 |
| CVE-2022-47949 | The Nintendo NetworkBuffer class, as used in Animal Crossing: New Horizons before 2.0.6 and other products, allows remote attackers to execute arbitrary code via a large UDP packet that causes a buffer overflow, aka ENLBufferPwn. | CRITICAL 9.8EPSS 23.1% | 24 December 2022 |
| CVE-2022-47945 | ThinkPHP Framework before 6.0.14 allows local file inclusion via the lang parameter when the language pack feature is enabled (lang_switch_on=true). | CRITICAL 9.8EPSS 30.2% | 23 December 2022 |
| CVE-2022-23854 | AVEVA InTouch Access Anywhere versions 2020 R2 and older are vulnerable to a path traversal exploit that could allow an unauthenticated user with network access to read files on the system outside of the secure gateway web server. | EXPLOITHIGH 7.5EPSS 49.7% | 23 December 2022 |
| CVE-2022-45711 | IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the hostname parameter in the formSetNetCheckTools function. | CRITICAL 9.8EPSS 20.2% | 23 December 2022 |
| CVE-2022-47939 | An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2pdu.c has a use-after-free and OOPS for SMB2_TREE_DISCONNECT. | CRITICAL 9.8EPSS 49.3% | 23 December 2022 |
| CVE-2022-47938 | An issue was discovered in ksmbd in the Linux kernel 5.15 through 5.19 before 5.19.2. fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT. | MEDIUM 6.5EPSS 60.0% | 23 December 2022 |
| CVE-2022-43551 | A vulnerability exists in curl <7.87.0 HSTS check that could be bypassed to trick it to keep using HTTP. | HIGH 7.5EPSS 16.6% | 23 December 2022 |
| CVE-2022-23513 | In case of an attack, the threat actor will obtain the ability to perform an unauthorized query for blocked domains on `queryads` endpoint. | EXPLOITMEDIUM 5.3EPSS 42.3% | 23 December 2022 |
| CVE-2022-2200 | If an object prototype was corrupted by an attacker, they would have been able to set undesired attributes on a JavaScript object, leading to privileged code execution. | HIGH 8.8EPSS 23.9% | 22 December 2022 |
| CVE-2022-26485 | Mozilla Firefox Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 14.3% | 22 December 2022 |
| CVE-2022-1802 | If an attacker was able to corrupt the methods of an Array object in JavaScript via prototype pollution, they could have achieved execution of attacker-controlled JavaScript code in a privileged context. | HIGH 8.8EPSS 28.5% | 22 December 2022 |
| CVE-2022-1529 | An attacker could have sent a message to the parent process where the contents were used to double-index into a JavaScript object, leading to prototype pollution and ultimately attacker-controlled JavaScript executing in the privileged parent process. | HIGH 8.8EPSS 17.6% | 22 December 2022 |
| CVE-2022-41697 | A user enumeration vulnerability exists in the login functionality of Ghost Foundation Ghost 5.9.4. | MEDIUM 5.3EPSS 20.0% | 22 December 2022 |
| CVE-2022-41654 | An authentication bypass vulnerability exists in the newsletter subscription functionality of Ghost Foundation Ghost 5.9.4. | MEDIUM 4.3EPSS 18.9% | 22 December 2022 |
| CVE-2022-3184 | Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where the device’s existing firmware allows unauthenticated users to access an old PHP page vulnerable to directory traversal, which may allow a user to write a file to the… | CRITICAL 9.8EPSS 11.6% | 21 December 2022 |
| CVE-2022-46020 | WBCE CMS v1.5.4 can implement getshell by modifying the upload file type. | CRITICAL 9.8EPSS 39.0% | 20 December 2022 |
| CVE-2022-40624 | pfSense pfBlockerNG through 2.1.4_27 allows remote attackers to execute arbitrary OS commands as root via the HTTP Host header, a different vulnerability than CVE-2022-31814. | CRITICAL 9.8EPSS 18.3% | 20 December 2022 |
| CVE-2022-45942 | A Remote Code Execution (RCE) vulnerability was found in includes/baijiacms/common.inc.php in baijiacms v4. | HIGH 8.8EPSS 22.0% | 20 December 2022 |
| CVE-2022-4063 | The InPost Gallery WordPress plugin before 2.1.4.1 insecurely uses PHP's extract() function when rendering HTML views, allowing attackers to force the inclusion of malicious files & URLs, which may enable them to run code on servers. | CRITICAL 9.8EPSS 10.2% | 19 December 2022 |
| CVE-2022-44456 | CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request. | CRITICAL 9.8EPSS 69.9% | 19 December 2022 |
| CVE-2022-4606 | PHP Remote File Inclusion in GitHub repository flatpressblog/flatpress prior to 1.3. | CRITICAL 9.8EPSS 35.4% | 18 December 2022 |
| CVE-2022-46689 | A race condition was addressed with additional validation. | HIGH 7.0EPSS 48.2% | 15 December 2022 |
| CVE-2022-42867 | A use after free issue was addressed with improved memory management. | HIGH 8.8EPSS 34.8% | 15 December 2022 |
| CVE-2022-29517 | A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. | HIGH 8.8EPSS 57.6% | 15 December 2022 |
| CVE-2022-27498 | A directory traversal vulnerability exists in the TicketTemplateActions.aspx GetTemplateAttachment functionality of Lansweeper lansweeper 10.1.1.0. | MEDIUM 6.5EPSS 38.3% | 15 December 2022 |
| CVE-2022-46768 | Arbitrary file read vulnerability exists in Zabbix Web Service Report Generation, which listens on the port 10053. | MEDIUM 5.9EPSS 47.8% | 15 December 2022 |
| CVE-2022-38488 | logrocket-oauth2-example through 2020-05-27 allows SQL injection via the /auth/register username parameter. | CRITICAL 9.8EPSS 14.2% | 14 December 2022 |
| CVE-2022-46443 | mesinkasir Bangresto 1.0 is vulnberable to SQL Injection via the itemqty%5B%5D parameter. | HIGH 8.8EPSS 37.7% | 14 December 2022 |
| CVE-2022-42139 | Delta Electronics DVW-W02W2-E2 1.5.0.10 is vulnerable to Command Injection via Crafted URL. | HIGH 8.8EPSS 18.2% | 14 December 2022 |
| CVE-2022-37155 | RCE in SPIP 3.1.13 through 4.1.2 allows remote authenticated users to execute arbitrary code via the _oups parameter. | HIGH 8.8EPSS 40.0% | 14 December 2022 |
| CVE-2022-44698 | Microsoft Defender SmartScreen Security Feature Bypass Vulnerability | KEVMEDIUM 5.4EPSS 74.8% | 13 December 2022 |
| CVE-2022-44690 | Microsoft SharePoint Server Remote Code Execution Vulnerability | HIGH 8.8EPSS 82.1% | 13 December 2022 |
| CVE-2022-44666 | Windows Contacts Remote Code Execution Vulnerability | HIGH 7.8EPSS 41.4% | 13 December 2022 |
| CVE-2022-41076 | PowerShell Remote Code Execution Vulnerability | HIGH 8.5EPSS 60.8% | 13 December 2022 |
| CVE-2022-4223 | The utility is executed by the server to determine what PostgreSQL version it is from. | HIGH 8.8EPSS 80.1% | 13 December 2022 |
| CVE-2022-31698 | The vCenter Server contains a denial-of-service vulnerability in the content library service. | MEDIUM 5.3EPSS 47.8% | 13 December 2022 |
| CVE-2022-45275 | An arbitrary file upload vulnerability in /queuing/admin/ajax.php?action=save_settings of Dynamic Transaction Queuing System v1.0 allows attackers to execute arbitrary code via a crafted PHP file. | HIGH 7.2EPSS 15.3% | 12 December 2022 |
| CVE-2022-3921 | The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE | CRITICAL 9.8EPSS 21.2% | 12 December 2022 |
| CVE-2022-3900 | The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability. | CRITICAL 9.8EPSS 19.0% | 12 December 2022 |
| CVE-2022-45957 | ZTE ZXHN-H108NS router with firmware version H108NSV1.0.7u_ZRD_GR2_A68 is vulnerable to remote stack buffer overflow. | HIGH 7.5EPSS 10.6% | 12 December 2022 |
| CVE-2021-3437 | Potential security vulnerabilities have been identified in an OMEN Gaming Hub SDK package which may allow escalation of privilege and/or denial of service. | CRITICAL 9.8EPSS 15.6% | 12 December 2022 |
| CVE-2022-45504 | An issue in the component tpi_systool_handle(0) (/goform/SysToolRestoreSet) of Tenda W6-S v1.0.0.4(510) allows unauthenticated attackers to arbitrarily reboot the device. | HIGH 7.5EPSS 18.3% | 8 December 2022 |
| CVE-2022-46770 | qubes-mirage-firewall (aka Mirage firewall for QubesOS) 0.8.x through 0.8.3 allows guest OS users to cause a denial of service (CPU consumption and loss of forwarding) via a crafted multicast UDP packet (IP address range of 224.0.0.0 through… | EXPLOITHIGH 7.5EPSS 22.4% | 7 December 2022 |
| CVE-2022-41800 | In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. | HIGH 8.7EPSS 76.9% | 7 December 2022 |
| CVE-2022-41622 | In all versions, BIG-IP and BIG-IQ are vulnerable to cross-site request forgery (CSRF) attacks through iControl SOAP. | HIGH 8.8EPSS 92.4% | 7 December 2022 |
| CVE-2022-45025 | Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function. | CRITICAL 9.8EPSS 34.8% | 7 December 2022 |
| CVE-2022-45359 | Arbitrary File Upload vulnerability in YITH WooCommerce Gift Cards premium plugin <= 3.19.0 on WordPress. | CRITICAL 9.8EPSS 13.5% | 6 December 2022 |
| CVE-2020-6627 | The web-management application on Seagate Central NAS STCG2000300, STCG3000300, and STCG4000300 devices allows OS command injection via mv_backend_launch in cirrus/application/helpers/mv_backend_helper.php by leveraging the "start" state and sending a… | EXPLOITCRITICAL 9.8EPSS 12.7% | 6 December 2022 |
| CVE-2022-43548 | A OS Command Injection vulnerability exists in Node.js versions <14.21.1, <16.18.1, <18.12.1, <19.0.1 due to an insufficient IsAllowedHost check that can easily be bypassed because IsIPAddress does not properly check if an IP address is invalid before… | HIGH 8.1EPSS 14.8% | 5 December 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.