Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 64 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-37985 | Windows Graphics Component Information Disclosure Vulnerability | MEDIUM 5.5EPSS 38.6% | 11 October 2022 |
| CVE-2022-37974 | Windows Mixed Reality Developer Tools Information Disclosure Vulnerability | MEDIUM 6.5EPSS 36.5% | 11 October 2022 |
| CVE-2022-35829 | Service Fabric Explorer Spoofing Vulnerability | MEDIUM 4.8EPSS 18.9% | 11 October 2022 |
| CVE-2022-34689 | Windows CryptoAPI Spoofing Vulnerability | HIGH 7.5EPSS 38.1% | 11 October 2022 |
| CVE-2022-32174 | In Gogs, versions v0.6.5 through v0.12.10 are vulnerable to Stored Cross-Site Scripting (XSS) that leads to an account takeover. | CRITICAL 9.0EPSS 58.2% | 11 October 2022 |
| CVE-2022-39288 | Affected versions of fastify are subject to a denial of service via malicious use of the Content-Type header. | HIGH 7.5EPSS 59.2% | 10 October 2022 |
| CVE-2022-36635 | ZKteco ZKBioSecurity V5000 4.1.3 was discovered to contain a SQL injection vulnerability via the component /baseOpLog.do. | HIGH 8.8EPSS 17.4% | 7 October 2022 |
| CVE-2022-31680 | The vCenter Server contains an unsafe deserialisation vulnerability in the PSC (Platform services controller). | CRITICAL 9.1EPSS 31.1% | 7 October 2022 |
| CVE-2022-41082 | Microsoft Exchange Server Remote Code Execution Vulnerability | KEVHIGH 8.0EPSS 100.0% | 3 October 2022 |
| CVE-2022-41040 | Microsoft Exchange Server Server-Side Request Forgery Vulnerability | KEVHIGH 8.8EPSS 100.0% | 3 October 2022 |
| CVE-2022-20775 | Cisco SD-WAN Path Traversal Vulnerability | KEVHIGH 7.8EPSS 12.0% | 30 September 2022 |
| CVE-2022-36961 | A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution. | HIGH 8.8EPSS 74.3% | 30 September 2022 |
| CVE-2022-28851 | Adobe Experience Manager versions 6.5.13.0 (and earlier) is affected by a reflected Cross-Site Scripting (XSS) vulnerability. | MEDIUM 5.4EPSS 36.8% | 30 September 2022 |
| CVE-2022-21826 | This body ends up prefixing the next HTTP request sent down that connection, this means when someone loads website attacker may be able to make browser issue a POST to the application, enabling XSS. | MEDIUM 5.4EPSS 46.0% | 30 September 2022 |
| CVE-2022-31629 | In PHP versions before 7.4.31, 8.0.24 and 8.1.11, the vulnerability enables network and same-site attackers to set a standard insecure cookie in the victim's browser which is treated as a `__Host-` or `__Secure-` cookie by PHP applications. | MEDIUM 6.5EPSS 49.6% | 28 September 2022 |
| CVE-2022-40878 | In Exam Reviewer Management System 1.0, an authenticated attacker can upload a web-shell php file in profile page to achieve Remote Code Execution (RCE). | HIGH 8.8EPSS 23.7% | 27 September 2022 |
| CVE-2022-3323 | An SQL injection vulnerability in Advantech iView 5.7.04.6469. | HIGH 7.5EPSS 29.3% | 27 September 2022 |
| CVE-2022-3038 | Google Chromium Network Service Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 24.9% | 26 September 2022 |
| CVE-2022-2998 | Use after free in Browser Creation in Google Chrome prior to 104.0.5112.101 allowed a remote attacker who had convinced a user to engage in a specific UI interaction to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 30.3% | 26 September 2022 |
| CVE-2022-3062 | The Simple File List WordPress plugin before 4.4.12 does not escape parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting | MEDIUM 6.1EPSS 44.1% | 26 September 2022 |
| CVE-2022-41352 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | KEVCRITICAL 9.8EPSS 95.5% | 26 September 2022 |
| CVE-2022-36944 | Scala 2.13.x before 2.13.9 has a Java deserialization chain in its JAR file. | CRITICAL 9.8EPSS 11.0% | 23 September 2022 |
| CVE-2022-38742 | Rockwell Automation ThinManager ThinServer versions 11.0.0 - 13.0.0 is vulnerable to a heap-based buffer overflow. | CRITICAL 9.8EPSS 22.7% | 23 September 2022 |
| CVE-2022-40855 | Tenda W20E router V15.11.0.6 contains a stack overflow in the function formSetPortMapping with post request 'goform/setPortMapping/'. | CRITICAL 9.8EPSS 14.1% | 23 September 2022 |
| CVE-2022-3236 | Sophos Firewall Code Injection Vulnerability | KEVCRITICAL 9.8EPSS 98.9% | 23 September 2022 |
| CVE-2022-39197 | Fortra Cobalt Strike Teamserver Cross-Site Scripting (XSS) Vulnerability | KEVMEDIUM 6.1EPSS 44.1% | 22 September 2022 |
| CVE-2022-29799 | A vulnerability was found in networkd-dispatcher. | MEDIUM 5.5EPSS 11.8% | 21 September 2022 |
| CVE-2022-37027 | Ahsay AhsayCBS 9.1.4.0 allows an authenticated system user to inject arbitrary Java JVM options. | HIGH 7.2EPSS 22.2% | 21 September 2022 |
| CVE-2022-38916 | A file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files | CRITICAL 9.8EPSS 18.3% | 20 September 2022 |
| CVE-2022-38545 | Valine v1.4.18 was discovered to contain a remote code execution (RCE) vulnerability which allows attackers to execute arbitrary code via a crafted POST request. | CRITICAL 9.6EPSS 34.1% | 19 September 2022 |
| CVE-2022-3218 | Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution. | CRITICAL 9.8EPSS 74.2% | 19 September 2022 |
| CVE-2022-35914 | Teclib GLPI Remote Code Execution Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.9% | 19 September 2022 |
| CVE-2022-3142 | The NEX-Forms WordPress plugin before 7.9.7 does not properly sanitise and escape user input before using it in SQL statements, leading to SQL injections. | EXPLOIT ✓HIGH 8.8EPSS 14.6% | 19 September 2022 |
| CVE-2022-2840 | The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections | EXPLOIT ✓CRITICAL 9.8EPSS 13.2% | 19 September 2022 |
| CVE-2022-2754 | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks | CRITICAL 9.8EPSS 39.1% | 19 September 2022 |
| CVE-2022-2753 | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious… | MEDIUM 6.1EPSS 83.7% | 19 September 2022 |
| CVE-2022-39960 | This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexport_download=true request to a plugins/servlet/groupexportforjira/admin/ URI. | MEDIUM 5.3EPSS 25.7% | 17 September 2022 |
| CVE-2022-40300 | Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities. | CRITICAL 9.8EPSS 99.1% | 16 September 2022 |
| CVE-2022-38621 | Doufox v0.0.4 was discovered to contain a remote code execution (RCE) vulnerability via the edit file page. | CRITICAL 9.8EPSS 25.0% | 16 September 2022 |
| CVE-2022-38828 | TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi | CRITICAL 9.8EPSS 20.1% | 16 September 2022 |
| CVE-2022-38827 | TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to Buffer Overflow via cstecgi.cgi | CRITICAL 9.8EPSS 12.5% | 16 September 2022 |
| CVE-2022-40152 | Those using Woodstox to parse XML data may be vulnerable to Denial of Service attacks (DOS) if DTD support is enabled. | HIGH 7.5EPSS 18.2% | 16 September 2022 |
| CVE-2022-2863 | The Migration, Backup, Staging WordPress plugin before 0.9.76 does not sanitise and validate a parameter before using it to read the content of a file, allowing high privilege users to read any file from the web server via a Traversal attack | MEDIUM 4.9EPSS 25.1% | 16 September 2022 |
| CVE-2022-36534 | KG Syncovery 9 for Linux v9.47x and below was discovered to contain multiple remote code execution (RCE) vulnerabilities via the Job_ExecuteBefore and Job_ExecuteAfter parameters at post_profilesettings.php. | HIGH 8.8EPSS 50.5% | 16 September 2022 |
| CVE-2022-36533 | KG Syncovery 9 for Linux v9.47x and below was discovered to contain a cross-site scripting (XSS) vulnerability. | MEDIUM 5.4EPSS 42.6% | 16 September 2022 |
| CVE-2022-36532 | Bolt CMS contains a vulnerability in version 5.1.12 and below that allows an authenticated user with the ROLE_EDITOR privileges to upload and rename a malicious file to achieve remote code execution. | HIGH 8.8EPSS 24.3% | 16 September 2022 |
| CVE-2022-38352 | ThinkPHP v6.0.13 was discovered to contain a deserialization vulnerability via the component League\Flysystem\Cached\Storage\Psr6Cache. | CRITICAL 9.8EPSS 21.0% | 15 September 2022 |
| CVE-2022-38308 | TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cstesystem. | CRITICAL 9.8EPSS 21.2% | 14 September 2022 |
| CVE-2022-37661 | SmartRG SR506n 2.5.15 and SR510n 2.6.13 routers are vulnerable to Remote Code Execution (RCE) via the ping host feature. | EXPLOITCRITICAL 9.8EPSS 34.6% | 14 September 2022 |
| CVE-2022-36667 | Garage Management System 1.0 is vulnerable to the Remote Code Execution (RCE) due to the lack of filtering from the file upload function. | HIGH 8.8EPSS 24.9% | 14 September 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.