Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,489 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 31 October 2026
17,506 results · page 7 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2026-1419 | A weakness has been identified in D-Link DCS700l 1.03.09. | LOW 2.0EPSS 17.2% | 26 January 2026 |
| CVE-2026-24423 | SmarterTools SmarterMail Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.3EPSS 88.2% | 23 January 2026 |
| CVE-2022-25369 | An attacker can add a new administrator user without authentication. | CRITICAL 9.8EPSS 39.6% | 23 January 2026 |
| CVE-2026-0770 | Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 62.6% | 23 January 2026 |
| CVE-2026-0769 | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability. | CRITICAL 9.8EPSS 41.2% | 23 January 2026 |
| CVE-2026-0768 | Langflow code Code Injection Remote Code Execution Vulnerability. | CRITICAL 9.8EPSS 28.1% | 23 January 2026 |
| CVE-2026-23760 | SmarterTools SmarterMail Authentication Bypass Using an Alternate Path or Channel Vulnerability | KEVCRITICAL 9.3EPSS 96.4% | 22 January 2026 |
| CVE-2026-21852 | Prior to version 2.0.65, vulnerability in Claude Code's project-load flow allowed malicious repositories to exfiltrate data including Anthropic API keys before users confirmed trust. | MEDIUM 5.3EPSS 27.5% | 21 January 2026 |
| CVE-2026-24061 | GNU InetUtils Argument Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 99.0% | 21 January 2026 |
| CVE-2026-21962 | Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control Vulnerability | KEVCRITICAL 10.0EPSS 73.2% | 20 January 2026 |
| CVE-2025-56005 | An undocumented and unsafe feature in the PLY (Python Lex-Yacc) library 3.11 allows Remote Code Execution (RCE) via the `picklefile` parameter in the `yacc()` function. | CRITICAL 9.8EPSS 18.8% | 20 January 2026 |
| CVE-2026-22844 | A Command Injection vulnerability in Zoom Node Multimedia Routers (MMRs) before version 5.2.1716.0 may allow a meeting participant to conduct remote code execution of the MMR via network access. | CRITICAL 9.9EPSS 13.5% | 20 January 2026 |
| CVE-2026-1125 | A weakness has been identified in D-Link DIR-823X 250416. | MEDIUM 5.5EPSS 15.7% | 18 January 2026 |
| CVE-2026-23744 | Versions 1.4.2 and earlier are vulnerable to remote code execution (RCE) vulnerability, which allows an attacker to send a crafted HTTP request that triggers the installation of an MCP server, leading to RCE. | EXPLOITCRITICAL 9.8EPSS 67.5% | 16 January 2026 |
| CVE-2025-60021 | Remote command injection vulnerability in heap profiler builtin service in Apache bRPC ((all versions < 1.15.0)) on all platforms allows attacker to inject remote command. | CRITICAL 9.8EPSS 25.5% | 16 January 2026 |
| CVE-2026-23550 | Incorrect Privilege Assignment vulnerability in Modular DS Modular DS modular-connector allows Privilege Escalation.This issue affects Modular DS: from n/a through <= 2.5.1. | CRITICAL 9.8EPSS 21.4% | 14 January 2026 |
| CVE-2023-54335 | eXtplorer 2.1.14 contains an authentication bypass vulnerability that allows attackers to login without a password by manipulating the login request. | CRITICAL 9.3EPSS 13.7% | 13 January 2026 |
| CVE-2020-36911 | Covenant 0.1.3 - 0.5 contains a remote code execution vulnerability that allows attackers to craft malicious JWT tokens with administrative privileges. | CRITICAL 9.3EPSS 12.3% | 13 January 2026 |
| CVE-2026-20963 | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 29.2% | 13 January 2026 |
| CVE-2026-20947 | Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. | HIGH 8.8EPSS 18.4% | 13 January 2026 |
| CVE-2026-20925 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | MEDIUM 6.5EPSS 17.9% | 13 January 2026 |
| CVE-2026-20872 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. | MEDIUM 6.5EPSS 19.8% | 13 January 2026 |
| CVE-2025-64155 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet FortiSIEM 7.4.0, FortiSIEM 7.3.0 through 7.3.4, FortiSIEM 7.1.0 through 7.1.8, FortiSIEM 7.0.0 through 7.0.4, FortiSIEM 6.7.0 through… | CRITICAL 9.8EPSS 43.6% | 13 January 2026 |
| CVE-2026-22755 | Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Vivotek Affected device model numbers are FD8365, FD8365v2, FD9165, FD9171, FD9187, FD9189, FD9365, FD9371, FD9381, FD9387, FD9389,… | CRITICAL 9.3EPSS 13.8% | 13 January 2026 |
| CVE-2025-13447 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in… | MEDIUM 6.8EPSS 27.2% | 13 January 2026 |
| CVE-2025-13444 | OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in… | MEDIUM 6.8EPSS 27.2% | 13 January 2026 |
| CVE-2026-22812 | Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. | HIGH 8.8EPSS 16.5% | 12 January 2026 |
| CVE-2025-12420 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. | CRITICAL 9.3EPSS 53.2% | 12 January 2026 |
| CVE-2026-22200 | Enhancesoft osTicket versions 1.18.x prior to 1.18.3 and 1.17.x prior to 1.17.7 contain an arbitrary file read vulnerability in the ticket PDF export functionality. | HIGH 8.7EPSS 73.6% | 12 January 2026 |
| CVE-2025-68472 | Prior to version 25.11.1, an unauthenticated path traversal in the file upload API lets any caller read arbitrary files from the server filesystem and move them into MindsDB’s storage, exposing sensitive data. | CRITICAL 9.1EPSS 20.3% | 12 January 2026 |
| CVE-2025-52694 | Successful exploitation of the SQL injection vulnerability could allow an unauthenticated remote attacker to execute arbitrary SQL commands on the vulnerable service when it is exposed to the Internet, potentially affecting data confidentiality,… | CRITICAL 9.8EPSS 39.9% | 12 January 2026 |
| CVE-2025-68493 | Missing XML Validation vulnerability in Apache Struts, Apache Struts. | HIGH 8.1EPSS 50.4% | 11 January 2026 |
| CVE-2025-61686 | In @react-router/node versions 7.0.0 through 7.9.3, @remix-run/deno prior to version 2.17.2, and @remix-run/node prior to version 2.17.2, if createFileSessionStorage() is being used from @react-router/node (or @remix-run/node/@remix-run/deno in Remix… | CRITICAL 9.1EPSS 17.3% | 10 January 2026 |
| CVE-2025-70161 | EDIMAX BR-6208AC V2_1.02 is vulnerable to Command Injection. | CRITICAL 9.8EPSS 27.1% | 9 January 2026 |
| CVE-2026-0732 | A vulnerability was found in D-Link DI-8200G 17.12.20A1. | LOW 2.1EPSS 11.7% | 9 January 2026 |
| CVE-2026-21876 | Only the last captured value is available to the chained rule, which means malicious charsets in earlier parts can be missed if a later part has a legitimate charset. | EXPLOITMEDIUM 5.3EPSS 17.7% | 8 January 2026 |
| CVE-2026-21858 | Versions starting with 1.65.0 and below 1.121.0 enable an attacker to access files on the underlying server through execution of certain form-based workflows. | CRITICAL 10.0EPSS 78.2% | 8 January 2026 |
| CVE-2017-20216 | FLIR Thermal Camera PT-Series firmware version 8.0.0.64 contains multiple unauthenticated remote command injection vulnerabilities in the controllerFlirSystem.php script. | CRITICAL 9.3EPSS 12.0% | 8 January 2026 |
| CVE-2017-20215 | FLIR Thermal Camera FC-S/PT firmware version 8.0.0.64 contains an authenticated OS command injection vulnerability that allows attackers to execute shell commands with root privileges. | HIGH 8.7EPSS 15.8% | 8 January 2026 |
| CVE-2026-0628 | Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. | HIGH 8.8EPSS 20.9% | 7 January 2026 |
| CVE-2025-15472 | This manipulation of the argument DeviceURL causes os command injection. | HIGH 7.3EPSS 22.4% | 7 January 2026 |
| CVE-2025-15471 | A vulnerability was detected in TRENDnet TEW-713RE 1.02. | HIGH 8.9EPSS 13.7% | 7 January 2026 |
| CVE-2025-66376 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting Vulnerability | KEVMEDIUM 6.1EPSS 20.2% | 5 January 2026 |
| CVE-2025-15029 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Centreon Infra Monitoring (Awie export modules) allows SQL Injection to unauthenticated user. | CRITICAL 9.8EPSS 13.0% | 5 January 2026 |
| CVE-2025-5965 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Centreon Infra Monitoring (Backup configuration in the administration setup modules) allows OS Command Injection.This issue affects Infra… | HIGH 7.2EPSS 28.2% | 5 January 2026 |
| CVE-2026-21445 | Prior to version 1.7.0.dev45, multiple critical API endpoints in Langflow are missing authentication controls. | HIGH 8.8EPSS 33.3% | 2 January 2026 |
| CVE-2025-66398 | Prior to version 2.19.0, an unauthenticated attacker can pollute the internal state (`restoreFilePath`) of the server via the `/skServer/validateBackup` endpoint. | HIGH 8.8EPSS 19.9% | 1 January 2026 |
| CVE-2025-47411 | A user with a legitimate non-administrator account can exploit a vulnerability in the user ID creation mechanism in Apache StreamPipes that allows them to swap the username of an existing user with that of an administrator. | HIGH 8.1EPSS 15.3% | 1 January 2026 |
| CVE-2025-68926 | In versions prior to 1.0.0-alpha.78, RustFS implements gRPC authentication using a hardcoded static token `"rustfs rpc"` that is publicly exposed in the source code repository, hardcoded on both client and server sides, non-configurable with no… | CRITICAL 9.8EPSS 31.9% | 30 December 2025 |
| CVE-2025-52691 | SmarterTools SmarterMail Unrestricted Upload of File with Dangerous Type Vulnerability | KEVCRITICAL 10.0EPSS 85.7% | 29 December 2025 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.