Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 62 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-46169 | Cacti Command Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.8% | 5 December 2022 |
| CVE-2022-46164 | This vulnerability has been patched in version 2.6.1. | CRITICAL 9.8EPSS 47.4% | 5 December 2022 |
| CVE-2022-4262 | Google Chromium V8 Type Confusion Vulnerability | KEVHIGH 8.8EPSS 23.5% | 2 December 2022 |
| CVE-2022-4257 | A vulnerability was found in C-DATA Web Management System. | CRITICAL 9.8EPSS 43.9% | 1 December 2022 |
| CVE-2022-1471 | SnakeYaml's Constructor() class does not restrict types which can be instantiated during deserialization. | CRITICAL 9.8EPSS 99.5% | 1 December 2022 |
| CVE-2022-4178 | Use after free in Mojo in Google Chrome prior to 108.0.5359.71 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 23.9% | 30 November 2022 |
| CVE-2022-36964 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. | HIGH 8.8EPSS 17.4% | 29 November 2022 |
| CVE-2022-44635 | Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. | HIGH 8.8EPSS 68.8% | 29 November 2022 |
| CVE-2022-40799 | D-Link DNR-322L Download of Code Without Integrity Check Vulnerability | KEVHIGH 8.8EPSS 33.7% | 29 November 2022 |
| CVE-2022-38900 | decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS. | HIGH 7.5EPSS 23.6% | 28 November 2022 |
| CVE-2022-45933 | KubeView through 0.1.31 allows attackers to obtain control of a Kubernetes cluster because api/scrape/kube-system does not require authentication, and retrieves certificate files that can be used for authentication as kube-admin. | CRITICAL 9.8EPSS 51.7% | 27 November 2022 |
| CVE-2022-24999 | qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. | HIGH 7.5EPSS 15.7% | 26 November 2022 |
| CVE-2022-4135 | Google Chromium GPU Heap Buffer Overflow Vulnerability | KEVCRITICAL 9.6EPSS 31.9% | 25 November 2022 |
| CVE-2021-43258 | CartView.php in ChurchInfo 1.3.0 allows attackers to achieve remote code execution through insecure uploads. | HIGH 8.8EPSS 11.8% | 23 November 2022 |
| CVE-2022-40770 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. | HIGH 7.2EPSS 81.3% | 23 November 2022 |
| CVE-2020-23584 | Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" parameter that… | CRITICAL 9.8EPSS 41.4% | 23 November 2022 |
| CVE-2022-40303 | When parsing a multi-gigabyte XML document with the XML_PARSE_HUGE parser option enabled, several integer counters can overflow. | HIGH 7.5EPSS 41.4% | 23 November 2022 |
| CVE-2022-4116 | A vulnerability was found in quarkus. | CRITICAL 9.8EPSS 32.5% | 22 November 2022 |
| CVE-2022-39066 | There is a SQL injection vulnerability in ZTE MF286R. | HIGH 8.8EPSS 26.5% | 22 November 2022 |
| CVE-2022-41223 | Mitel MiVoice Connect Code Injection Vulnerability | KEVMEDIUM 6.8EPSS 10.7% | 22 November 2022 |
| CVE-2022-40765 | Mitel MiVoice Connect Command Injection Vulnerability | KEVMEDIUM 6.8EPSS 10.6% | 22 November 2022 |
| CVE-2022-4069 | Cross-site Scripting (XSS) - Generic in GitHub repository librenms/librenms prior to 22.10.0. | MEDIUM 4.8EPSS 93.3% | 20 November 2022 |
| CVE-2022-4068 | This enables an XSS attack that enables an attacker with a low privilege user to execute arbitrary JavaScript in the context of an admin's account. | MEDIUM 5.4EPSS 37.5% | 20 November 2022 |
| CVE-2022-4067 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. | MEDIUM 5.4EPSS 93.7% | 20 November 2022 |
| CVE-2022-3562 | Cross-site Scripting (XSS) - Stored in GitHub repository librenms/librenms prior to 22.10.0. | MEDIUM 5.4EPSS 94.2% | 20 November 2022 |
| CVE-2022-42904 | Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. | HIGH 7.2EPSS 83.1% | 18 November 2022 |
| CVE-2022-40881 | SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php | CRITICAL 9.8EPSS 31.4% | 17 November 2022 |
| CVE-2022-43781 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. | CRITICAL 9.8EPSS 98.0% | 17 November 2022 |
| CVE-2022-45402 | In Apache Airflow versions prior to 2.4.3, there was an open redirect in the webserver's `/login` endpoint. | MEDIUM 6.1EPSS 81.8% | 15 November 2022 |
| CVE-2022-40843 | The Tenda AC1200 V-W15Ev2 V15.11.0.10(1576) router is vulnerable to improper authorization / improper session management that allows the router login page to be bypassed. | MEDIUM 4.9EPSS 28.8% | 15 November 2022 |
| CVE-2022-37109 | patrickfuller camp up to and including commit bbd53a256ed70e79bd8758080936afbf6d738767 is vulnerable to Incorrect Access Control. | EXPLOITCRITICAL 9.8EPSS 49.5% | 14 November 2022 |
| CVE-2022-40127 | A vulnerability in Example Dags of Apache Airflow allows an attacker with UI access who can trigger DAGs, to execute arbitrary commands via manually provided run_id parameter. | HIGH 8.8EPSS 85.7% | 14 November 2022 |
| CVE-2022-43672 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671. | CRITICAL 9.8EPSS 67.1% | 12 November 2022 |
| CVE-2022-43671 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. | CRITICAL 9.8EPSS 74.8% | 12 November 2022 |
| CVE-2022-44088 | ESPCMS P8.21120101 was discovered to contain a remote code execution (RCE) vulnerability in the component INPUT_ISDESCRIPTION. | CRITICAL 9.8EPSS 20.1% | 10 November 2022 |
| CVE-2022-39396 | Versions prior to 4.10.18, and prior to 5.3.1 on the 5.X branch, are vulnerable to Remote Code Execution via prototype pollution. | CRITICAL 9.8EPSS 38.7% | 10 November 2022 |
| CVE-2022-3265 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. | MEDIUM 5.4EPSS 87.0% | 9 November 2022 |
| CVE-2022-41128 | Microsoft Windows Scripting Languages Remote Code Execution Vulnerability | KEVHIGH 8.8EPSS 24.6% | 9 November 2022 |
| CVE-2022-41080 | Microsoft Exchange Server Privilege Escalation Vulnerability | KEVHIGH 8.8EPSS 77.3% | 9 November 2022 |
| CVE-2022-31199 | Netwrix Auditor Insecure Object Deserialization Vulnerability | KEVCRITICAL 9.8EPSS 36.0% | 8 November 2022 |
| CVE-2022-44793 | handle_ipv6IpForwarding in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.4.3 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker to cause the instance to crash via a crafted UDP packet, resulting in Denial of Service. | MEDIUM 6.5EPSS 53.5% | 7 November 2022 |
| CVE-2022-44792 | handle_ipDefaultTTL in agent/mibgroup/ip-mib/ip_scalars.c in Net-SNMP 5.8 through 5.9.3 has a NULL Pointer Exception bug that can be used by a remote attacker (who has write access) to cause the instance to crash via a crafted UDP packet, resulting in… | MEDIUM 6.5EPSS 52.1% | 7 November 2022 |
| CVE-2022-43568 | In Splunk Enterprise versions below 8.1.12, 8.2.9, and 9.0.2, a View allows for a Reflected Cross Site Scripting via JavaScript Object Notation (JSON) in a query parameter when output_mode=radio. | MEDIUM 6.1EPSS 42.8% | 4 November 2022 |
| CVE-2022-43571 | In Splunk Enterprise versions below 8.2.9, 8.1.12, and 9.0.2, an authenticated user can execute arbitrary code through the dashboard PDF generation component. | HIGH 8.8EPSS 18.6% | 3 November 2022 |
| CVE-2022-39323 | Time based attack using a SQL injection in api REST user_token. | CRITICAL 9.8EPSS 37.4% | 3 November 2022 |
| CVE-2022-39379 | A remote code execution (RCE) vulnerability in non-default configurations of Fluentd allows unauthenticated attackers to execute arbitrary code via specially crafted JSON payloads. | CRITICAL 9.8EPSS 45.0% | 2 November 2022 |
| CVE-2022-38380 | An improper access control [CWE-284] vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API. | MEDIUM 4.3EPSS 23.0% | 2 November 2022 |
| CVE-2022-3654 | Use after free in Layout in Google Chrome prior to 107.0.5304.62 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 23.8% | 1 November 2022 |
| CVE-2022-3786 | Note that this occurs after certificate chain signature verification and requires either a CA to have signed a malicious certificate or for an application to continue certificate verification despite failure to construct a path to a trusted issuer. | HIGH 7.5EPSS 92.5% | 1 November 2022 |
| CVE-2022-3602 | Note that this occurs after certificate chain signature verification and requires either a CA to have signed the malicious certificate or for the application to continue certificate verification despite failure to construct a path to a trusted issuer. | HIGH 7.5EPSS 90.8% | 1 November 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.