Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 63 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-3801 | A vulnerability, which was classified as critical, was found in IBAX go-ibax. | HIGH 8.8EPSS 30.1% | 1 November 2022 |
| CVE-2022-41772 | Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior mishandle .ZIP archives containing characters used in path traversal. | CRITICAL 9.8EPSS 25.4% | 31 October 2022 |
| CVE-2022-41657 | Delta Electronics InfraSuite Device Master Versions 00.00.01a and prior allow attacker provided data already serialized into memory to be used in file operation application programmable interfaces (APIs). | CRITICAL 9.8EPSS 21.3% | 31 October 2022 |
| CVE-2022-38142 | Delta Electronics InfraSuite Device Master versions 00.00.01a and prior deserialize user-supplied data provided through the Device-Gateway service port without proper verification. | CRITICAL 9.8EPSS 18.6% | 31 October 2022 |
| CVE-2022-40471 | Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php | CRITICAL 9.8EPSS 28.0% | 31 October 2022 |
| CVE-2022-41702 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the InsertReg API. | MEDIUM 5.4EPSS 11.1% | 27 October 2022 |
| CVE-2022-41701 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutShift API. | MEDIUM 5.4EPSS 11.1% | 27 October 2022 |
| CVE-2022-41651 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the SetPF API. | MEDIUM 5.4EPSS 11.1% | 27 October 2022 |
| CVE-2022-41555 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PutLineMessageSetting API. | MEDIUM 5.4EPSS 11.1% | 27 October 2022 |
| CVE-2022-41133 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a SQL injection that exists in GetDIAE_line_message_settingsListParameters. | HIGH 8.8EPSS 27.1% | 27 October 2022 |
| CVE-2022-40965 | The affected product DIAEnergie (versions prior to v1.9.01.002) is vulnerable to a stored cross-site scripting vulnerability through the PostEnergyType API. | MEDIUM 5.4EPSS 11.1% | 27 October 2022 |
| CVE-2022-3387 | Advantech R-SeeNet Versions 2.4.19 and prior are vulnerable to path traversal attacks. | MEDIUM 5.3EPSS 14.0% | 27 October 2022 |
| CVE-2022-31898 | gl-inet GL-MT300N-V2 Mango v3.212 and GL-AX1800 Flint v3.214 were discovered to contain multiple command injection vulnerabilities via the ping_addr and trace_addr function parameters. | MEDIUM 6.8EPSS 15.8% | 27 October 2022 |
| CVE-2022-43775 | The HICT_Loop class in Delta Electronics DIAEnergy v1.9 contains a SQL Injection flaw that could allow an attacker to gain code execution on a remote system. | CRITICAL 9.8EPSS 21.0% | 26 October 2022 |
| CVE-2022-38181 | Arm Mali GPU Kernel Driver Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 18.5% | 25 October 2022 |
| CVE-2022-38580 | Zalando Skipper v0.13.236 is vulnerable to Server-Side Request Forgery (SSRF). | EXPLOITCRITICAL 9.8EPSS 15.9% | 25 October 2022 |
| CVE-2022-38108 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. | HIGH 7.2EPSS 65.9% | 20 October 2022 |
| CVE-2022-36958 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. | HIGH 8.8EPSS 81.5% | 20 October 2022 |
| CVE-2022-36957 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. | HIGH 7.2EPSS 14.7% | 20 October 2022 |
| CVE-2022-42233 | Tenda 11N with firmware version V5.07.33_cn suffers from an Authentication Bypass vulnerability. | CRITICAL 9.8EPSS 43.4% | 20 October 2022 |
| CVE-2016-20017 | D-Link DSL-2750B Devices Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 65.8% | 19 October 2022 |
| CVE-2016-20016 | A remote unauthenticated attacker can execute arbitrary operating system commands as root. | CRITICAL 9.8EPSS 86.2% | 19 October 2022 |
| CVE-2022-39428 | Vulnerability in the Oracle Web Applications Desktop Integrator product of Oracle E-Business Suite (component: Upload). | CRITICAL 9.8EPSS 37.1% | 18 October 2022 |
| CVE-2022-21587 | Oracle E-Business Suite Unspecified Vulnerability | KEVCRITICAL 9.8EPSS 98.3% | 18 October 2022 |
| CVE-2022-41544 | GetSimple CMS v3.3.16 was discovered to contain a remote code execution (RCE) vulnerability via the edited_file parameter in admin/theme-edit.php. | EXPLOIT ✓CRITICAL 9.8EPSS 14.3% | 18 October 2022 |
| CVE-2022-40684 | Fortinet Multiple Products Authentication Bypass Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 100.0% | 18 October 2022 |
| CVE-2022-3552 | Unrestricted Upload of File with Dangerous Type in GitHub repository boxbilling/boxbilling prior to 0.0.1. | EXPLOIT ✓HIGH 7.2EPSS 44.0% | 17 October 2022 |
| CVE-2022-2992 | A vulnerability in GitLab CE/EE affecting all versions from 11.10 prior to 15.1.6, 15.2 to 15.2.4, 15.3 to 15.3.2 allows an authenticated user to achieve remote code execution via the Import from GitHub API endpoint. | CRITICAL 9.9EPSS 86.2% | 17 October 2022 |
| CVE-2022-2884 | A vulnerability in GitLab CE/EE affecting all versions from 11.3.4 prior to 15.1.5, 15.2 to 15.2.3, 15.3 to 15.3 to 15.3.1 allows an an authenticated user to achieve remote code execution via the Import from GitHub API endpoint | EXPLOIT ✓CRITICAL 9.9EPSS 76.2% | 17 October 2022 |
| CVE-2022-42341 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. | HIGH 7.5EPSS 36.3% | 14 October 2022 |
| CVE-2022-42340 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Input Validation vulnerability that could result in arbitrary file system read. | HIGH 7.5EPSS 34.6% | 14 October 2022 |
| CVE-2022-38424 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary file system write. | HIGH 7.2EPSS 45.8% | 14 October 2022 |
| CVE-2022-38423 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. | MEDIUM 4.9EPSS 45.7% | 14 October 2022 |
| CVE-2022-38422 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in information disclosure. | HIGH 7.5EPSS 44.9% | 14 October 2022 |
| CVE-2022-38421 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of… | HIGH 7.2EPSS 79.6% | 14 October 2022 |
| CVE-2022-38420 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Use of Hard-coded Credentials vulnerability that could result in application denial-of-service by gaining access to start/stop arbitrary services. | HIGH 7.5EPSS 44.7% | 14 October 2022 |
| CVE-2022-38419 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. | HIGH 7.5EPSS 53.7% | 14 October 2022 |
| CVE-2022-38418 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of… | CRITICAL 9.8EPSS 80.4% | 14 October 2022 |
| CVE-2022-35712 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.8EPSS 37.6% | 14 October 2022 |
| CVE-2022-35711 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.8EPSS 74.1% | 14 October 2022 |
| CVE-2022-35710 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.8EPSS 43.5% | 14 October 2022 |
| CVE-2022-35698 | Adobe Commerce versions 2.4.4-p1 (and earlier) and 2.4.5 (and earlier) are affected by a Stored Cross-site Scripting vulnerability. | MEDIUM 5.4EPSS 14.7% | 14 October 2022 |
| CVE-2022-35690 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. | CRITICAL 9.8EPSS 72.7% | 14 October 2022 |
| CVE-2022-42889 | Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. | EXPLOITCRITICAL 9.8EPSS 99.9% | 13 October 2022 |
| CVE-2022-24697 | Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. | CRITICAL 9.8EPSS 84.8% | 13 October 2022 |
| CVE-2022-40871 | Dolibarr ERP & CRM <=15.0.3 is vulnerable to Eval injection. | CRITICAL 9.8EPSS 34.6% | 12 October 2022 |
| CVE-2022-41034 | Visual Studio Code Remote Code Execution Vulnerability | HIGH 7.8EPSS 67.5% | 11 October 2022 |
| CVE-2022-38053 | Microsoft SharePoint Server Remote Code Execution Vulnerability | HIGH 8.8EPSS 76.4% | 11 October 2022 |
| CVE-2022-38044 | Windows CD-ROM File System Driver Remote Code Execution Vulnerability | HIGH 7.8EPSS 56.3% | 11 October 2022 |
| CVE-2022-38028 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 14.9% | 11 October 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.