Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 67 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-35919 | Any normal OS system would allow access to contents at any arbitrary paths that are readable by MinIO process. | EXPLOITLOW 2.7EPSS 52.1% | 1 August 2022 |
| CVE-2022-31188 | Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. | EXPLOITCRITICAL 9.8EPSS 48.2% | 1 August 2022 |
| CVE-2022-27255 | In Realtek eCos RSDK 1.5.7p1 and MSDK 4.9.4p1, the SIP ALG function that rewrites SDP data has a stack-based buffer overflow. | CRITICAL 9.8EPSS 36.7% | 1 August 2022 |
| CVE-2022-36799 | Affected versions of Atlassian Jira Server and Data Center allowed remote attackers with system administrator permissions to execute arbitrary code via Template Injection leading to Remote Code Execution (RCE) in the Email Templates feature. | HIGH 7.2EPSS 46.7% | 1 August 2022 |
| CVE-2022-34531 | DedeCMS v5.7.95 was discovered to contain a remote code execution (RCE) vulnerability via the component mytag_ main.php. | CRITICAL 9.8EPSS 24.4% | 29 July 2022 |
| CVE-2022-2414 | Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. | HIGH 7.5EPSS 85.4% | 29 July 2022 |
| CVE-2022-34555 | TP-LINK TL-R473G 2.0.1 Build 220529 Rel.65574n was discovered to contain a remote code execution vulnerability which is exploited via a crafted packet. | CRITICAL 9.8EPSS 23.1% | 28 July 2022 |
| CVE-2022-30287 | Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. | HIGH 8.0EPSS 69.4% | 28 July 2022 |
| CVE-2022-2564 | Prototype Pollution in GitHub repository automattic/mongoose prior to 6.4.6. | CRITICAL 9.8EPSS 31.3% | 28 July 2022 |
| CVE-2022-2480 | Use after free in Service Worker API in Google Chrome prior to 103.0.5060.134 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 18.8% | 28 July 2022 |
| CVE-2022-2294 | WebRTC Heap Buffer Overflow Vulnerability | KEVHIGH 8.8EPSS 70.8% | 28 July 2022 |
| CVE-2022-34120 | Barangay Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the module editing function at /pages/activity/activity.php. | HIGH 7.2EPSS 19.7% | 27 July 2022 |
| CVE-2022-2550 | OS Command Injection in GitHub repository hestiacp/hestiacp prior to 1.6.5. | HIGH 8.8EPSS 49.3% | 27 July 2022 |
| CVE-2022-1364 | Google Chromium V8 Type Confusion Vulnerability | KEVHIGH 8.8EPSS 13.9% | 26 July 2022 |
| CVE-2022-34907 | An authentication bypass vulnerability exists in FileWave before 14.6.3 and 14.7.x before 14.7.2. | CRITICAL 9.8EPSS 16.4% | 25 July 2022 |
| CVE-2022-34906 | A hard-coded cryptographic key is used in FileWave before 14.6.3 and 14.7.x before 14.7.2. | HIGH 7.5EPSS 10.9% | 25 July 2022 |
| CVE-2022-35871 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). | HIGH 7.8EPSS 41.0% | 25 July 2022 |
| CVE-2022-35870 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). | HIGH 7.8EPSS 44.3% | 25 July 2022 |
| CVE-2022-35869 | This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). | CRITICAL 9.8EPSS 59.9% | 25 July 2022 |
| CVE-2022-35650 | The vulnerability was found in Moodle, occurs due to input validation error when importing lesson questions. | HIGH 7.5EPSS 53.7% | 25 July 2022 |
| CVE-2022-1232 | Type confusion in V8 in Google Chrome prior to 100.0.4896.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 17.1% | 25 July 2022 |
| CVE-2022-36450 | Obsidian 0.14.x and 0.15.x before 0.15.5 allows obsidian://hook-get-address remote code execution because window.open is used without checking the URL. | CRITICAL 9.8EPSS 20.6% | 25 July 2022 |
| CVE-2022-36446 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. | EXPLOITCRITICAL 9.8EPSS 95.9% | 25 July 2022 |
| CVE-2022-1096 | Google Chromium V8 Type Confusion Vulnerability | KEVHIGH 8.8EPSS 24.7% | 23 July 2022 |
| CVE-2022-25759 | The package convert-svg-core before 0.6.2 are vulnerable to Remote Code Injection via sending an SVG file containing the payload. | CRITICAL 9.8EPSS 11.5% | 22 July 2022 |
| CVE-2022-2143 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. | CRITICAL 9.8EPSS 62.6% | 22 July 2022 |
| CVE-2022-2139 | The affected product is vulnerable to directory traversal, which may allow an attacker to access unauthorized files and execute arbitrary code. | CRITICAL 9.8EPSS 16.0% | 22 July 2022 |
| CVE-2022-2138 | The affected product is vulnerable due to missing authentication, which may allow an attacker to read or modify sensitive data and execute arbitrary code, resulting in a denial-of-service condition. | HIGH 7.5EPSS 11.6% | 22 July 2022 |
| CVE-2022-2135 | The affected product is vulnerable to multiple SQL injections, which may allow an unauthorized attacker to disclose information. | HIGH 7.5EPSS 10.5% | 22 July 2022 |
| CVE-2022-0902 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100… | CRITICAL 9.8EPSS 16.9% | 21 July 2022 |
| CVE-2022-26138 | Atlassian Questions For Confluence App Hard-coded Credentials Vulnerability | KEVCRITICAL 9.8EPSS 98.2% | 20 July 2022 |
| CVE-2022-34047 | An access control issue in Wavlink WN530HG4 M30HG4.V5030.191116 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/set_safety.shtml?r=52300 and searching for [var syspasswd]. | EXPLOITHIGH 7.5EPSS 22.2% | 20 July 2022 |
| CVE-2022-34046 | An access control issue in Wavlink WN533A8 M33A8.V5030.190716 allows attackers to obtain usernames and passwords via view-source:http://IP_ADDRESS/sysinit.shtml?r=52300 and searching for [logincheck(user);]. | EXPLOITHIGH 7.5EPSS 21.1% | 20 July 2022 |
| CVE-2022-33318 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1,… | CRITICAL 9.8EPSS 50.1% | 20 July 2022 |
| CVE-2022-34607 | H3C Magic R200 R200V200R004L02 was discovered to contain a stack overflow via the HOST parameter at /doping.asp. | CRITICAL 9.8EPSS 14.3% | 20 July 2022 |
| CVE-2022-2488 | A vulnerability was found in WAVLINK WN535K2 and WN535K3 and classified as critical. | CRITICAL 9.8EPSS 33.4% | 20 July 2022 |
| CVE-2022-2487 | A vulnerability has been found in WAVLINK WN535K2 and WN535K3 and classified as critical. | CRITICAL 9.8EPSS 79.3% | 20 July 2022 |
| CVE-2022-2486 | A vulnerability, which was classified as critical, was found in WAVLINK WN535K2 and WN535K3. | CRITICAL 9.8EPSS 30.2% | 20 July 2022 |
| CVE-2022-21550 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 50.7% | 19 July 2022 |
| CVE-2022-34169 | The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. | HIGH 7.5EPSS 81.8% | 19 July 2022 |
| CVE-2022-35405 | Zoho ManageEngine Multiple Products Remote Code Execution Vulnerability | KEVCRITICAL 9.8EPSS 99.9% | 19 July 2022 |
| CVE-2022-24082 | If an on-premise installation of the Pega Platform is configured with the port for the JMX interface exposed to the Internet and port filtering is not properly configured, then it may be possible to upload serialized payloads to attack the underlying… | EXPLOITCRITICAL 9.8EPSS 12.2% | 19 July 2022 |
| CVE-2022-23745 | A potential memory corruption issue was found in Capsule Workspace Android app (running on GrapheneOS). | HIGH 7.5EPSS 16.9% | 18 July 2022 |
| CVE-2022-1565 | The plugin WP All Import is vulnerable to arbitrary file uploads due to missing file type validation via the wp_all_import_get_gz.php file in versions up to, and including, 3.6.7. | EXPLOIT ✓HIGH 7.2EPSS 15.2% | 18 July 2022 |
| CVE-2022-33891 | Apache Spark Command Injection Vulnerability | KEVHIGH 8.8EPSS 93.2% | 18 July 2022 |
| CVE-2022-26482 | An issue was discovered in Poly EagleEye Director II before 2.2.2.1. os.system command injection can be achieved by an admin. | HIGH 7.2EPSS 23.4% | 17 July 2022 |
| CVE-2022-26352 | dotCMS Unrestricted Upload of File Vulnerability | KEVCRITICAL 9.8EPSS 91.2% | 17 July 2022 |
| CVE-2021-36711 | WebInterface in OctoBot before 0.4.4 allows remote code execution because Tentacles upload is mishandled. | EXPLOITCRITICAL 9.8EPSS 16.6% | 16 July 2022 |
| CVE-2022-31161 | Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file. | EXPLOITCRITICAL 9.8EPSS 28.8% | 15 July 2022 |
| CVE-2022-34221 | Adobe Acrobat Reader versions 22.001.20142 (and earlier), 20.005.30334 (and earlier) and 17.012.30229 (and earlier) are affected by an Access of Resource Using Incompatible Type ('Type Confusion') vulnerability that could result in arbitrary code… | HIGH 7.8EPSS 11.1% | 15 July 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.