Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 71 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-30063 | ftcms <=2.1 was discovered to be vulnerable to code execution attacks . | CRITICAL 9.8EPSS 18.0% | 11 May 2022 |
| CVE-2022-30453 | ShopWind <= 3.4.2 has a RCE vulnerability in Database.php | CRITICAL 9.8EPSS 15.7% | 11 May 2022 |
| CVE-2022-29847 | In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would allow them to relay encrypted WhatsUp Gold user credentials to an arbitrary host. | HIGH 7.5EPSS 57.6% | 11 May 2022 |
| CVE-2022-28269 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of Annotation objects that could result in a memory leak in the context of… | LOW 3.3EPSS 10.7% | 11 May 2022 |
| CVE-2022-28258 | Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated… | MEDIUM 5.5EPSS 10.1% | 11 May 2022 |
| CVE-2022-28246 | Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated… | MEDIUM 5.5EPSS 10.1% | 11 May 2022 |
| CVE-2022-28243 | Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated… | HIGH 7.8EPSS 11.0% | 11 May 2022 |
| CVE-2022-28240 | Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. | HIGH 7.8EPSS 12.5% | 11 May 2022 |
| CVE-2022-28238 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of annotations that could result in arbitrary code execution in the context… | HIGH 7.8EPSS 11.9% | 11 May 2022 |
| CVE-2022-28236 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. | HIGH 7.8EPSS 11.6% | 11 May 2022 |
| CVE-2022-28233 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of annotations that could result in arbitrary code execution in the context… | HIGH 7.8EPSS 12.5% | 11 May 2022 |
| CVE-2022-28232 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of the collab object that could result in arbitrary code execution in the… | HIGH 7.8EPSS 12.5% | 11 May 2022 |
| CVE-2022-28230 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of the acroform event that could result in arbitrary code execution in the… | HIGH 7.8EPSS 12.5% | 11 May 2022 |
| CVE-2022-27799 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of the acroform event that could result in arbitrary code execution in the… | HIGH 7.8EPSS 18.8% | 11 May 2022 |
| CVE-2022-27796 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of the acroform event that could result in arbitrary code execution in the… | HIGH 7.8EPSS 12.5% | 11 May 2022 |
| CVE-2022-27794 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by the use of a variable that has not been initialized when processing of embedded fonts, potentially resulting in arbitrary… | HIGH 7.8EPSS 14.3% | 11 May 2022 |
| CVE-2022-27791 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) is affected by a stack-based buffer overflow vulnerability due to insecure processing of a font, potentially resulting in arbitrary code… | HIGH 7.8EPSS 17.8% | 11 May 2022 |
| CVE-2022-27790 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of fonts that could result in arbitrary code execution in the context of… | HIGH 7.8EPSS 11.9% | 11 May 2022 |
| CVE-2022-27787 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. | HIGH 7.8EPSS 10.3% | 11 May 2022 |
| CVE-2022-27786 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of fonts that could result in arbitrary code execution in the context of… | HIGH 7.8EPSS 12.1% | 11 May 2022 |
| CVE-2022-27785 | Acrobat Reader DC versions 22.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability in the processing of fonts that could result in arbitrary code execution in the context of… | HIGH 7.8EPSS 12.5% | 11 May 2022 |
| CVE-2022-24104 | Acrobat Reader DC versions 20.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. | HIGH 7.8EPSS 11.1% | 11 May 2022 |
| CVE-2022-24102 | Acrobat Reader DC versions 20.001.20085 (and earlier), 20.005.3031x (and earlier) and 17.012.30205 (and earlier) are affected by a use-after-free vulnerability that could result in arbitrary code execution in the context of the current user. | HIGH 7.8EPSS 12.6% | 11 May 2022 |
| CVE-2022-29009 | Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Cyber Cafe Management System Project v1.0 allows attackers to bypass authentication. | CRITICAL 9.8EPSS 22.9% | 11 May 2022 |
| CVE-2022-29007 | Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Dairy Farm Shop Management System v1.0 allows attackers to bypass authentication. | CRITICAL 9.8EPSS 19.3% | 11 May 2022 |
| CVE-2022-29006 | Multiple SQL injection vulnerabilities via the username and password parameters in the Admin panel of Directory Management System v1.0 allows attackers to bypass authentication. | CRITICAL 9.8EPSS 19.3% | 11 May 2022 |
| CVE-2022-30129 | Visual Studio Code Remote Code Execution Vulnerability | HIGH 8.8EPSS 41.6% | 10 May 2022 |
| CVE-2022-29108 | Microsoft SharePoint Server Remote Code Execution Vulnerability | HIGH 8.8EPSS 11.1% | 10 May 2022 |
| CVE-2022-29104 | Windows Print Spooler Elevation of Privilege Vulnerability | HIGH 7.8EPSS 11.8% | 10 May 2022 |
| CVE-2022-26937 | Windows Network File System Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 76.0% | 10 May 2022 |
| CVE-2022-26925 | Microsoft Windows LSA Spoofing Vulnerability | KEVMEDIUM 5.9EPSS 10.5% | 10 May 2022 |
| CVE-2022-26923 | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | KEVHIGH 8.8EPSS 83.5% | 10 May 2022 |
| CVE-2022-23270 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | HIGH 8.1EPSS 70.3% | 10 May 2022 |
| CVE-2022-22017 | Remote Desktop Client Remote Code Execution Vulnerability | HIGH 8.8EPSS 37.1% | 10 May 2022 |
| CVE-2022-21972 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability | HIGH 8.1EPSS 79.3% | 10 May 2022 |
| CVE-2022-1476 | The All-in-One WP Migration plugin for WordPress is vulnerable to arbitrary file deletion via directory traversal due to insufficient file validation via the ~/lib/model/class-ai1wm-backups.php file, in versions up to, and including, 7.58. | MEDIUM 6.5EPSS 46.3% | 10 May 2022 |
| CVE-2022-23677 | A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch… | HIGH 8.1EPSS 20.5% | 10 May 2022 |
| CVE-2022-23676 | A remote execution of arbitrary code vulnerability was discovered in ArubaOS-Switch Devices version(s): ArubaOS-Switch 15.xx.xxxx: All versions; ArubaOS-Switch 16.01.xxxx: All versions; ArubaOS-Switch 16.02.xxxx: K.16.02.0033 and below; ArubaOS-Switch… | CRITICAL 9.8EPSS 23.0% | 10 May 2022 |
| CVE-2022-29329 | D-Link DAP-1330_OSS-firmware_1.00b21 was discovered to contain a heap overflow via the devicename parameter in /goform/setDeviceSettings. | CRITICAL 9.8EPSS 13.7% | 10 May 2022 |
| CVE-2022-29328 | D-Link DAP-1330_OSS-firmware_1.00b21 was discovered to contain a stack overflow via the function checkvalidupgrade. | CRITICAL 9.8EPSS 13.7% | 10 May 2022 |
| CVE-2022-29322 | D-Link DIR-816 A2_v1.10CNB04 was discovered to contain a stack overflow via the IPADDR and nvmacaddr parameters in /goform/form2Dhcpip. | CRITICAL 9.8EPSS 16.9% | 10 May 2022 |
| CVE-2022-1104 | The Popup Maker WordPress plugin before 1.16.5 does not sanitise and escape some of its Popup settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is… | EXPLOITMEDIUM 4.8EPSS 56.4% | 9 May 2022 |
| CVE-2022-0817 | The BadgeOS WordPress plugin through 3.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users | CRITICAL 9.8EPSS 11.6% | 9 May 2022 |
| CVE-2022-0592 | The MapSVG WordPress plugin before 6.2.20 does not validate and escape a parameter via a REST endpoint before using it in a SQL statement, leading to a SQL Injection exploitable by unauthenticated users. | CRITICAL 9.8EPSS 10.2% | 9 May 2022 |
| CVE-2022-30286 | pyscriptjs (aka PyScript Demonstrator) in PyScript through 2022-05-04 allows a remote user to read Python source code. | EXPLOITHIGH 7.5EPSS 13.6% | 9 May 2022 |
| CVE-2022-30333 | RARLAB UnRAR Directory Traversal Vulnerability | KEVHIGH 7.5EPSS 99.2% | 9 May 2022 |
| CVE-2020-19213 | SQL Injection vulnerability in cat_move.php in piwigo v2.9.5, via the selection parameter to move_categories. | CRITICAL 9.8EPSS 15.9% | 6 May 2022 |
| CVE-2022-30295 | uClibc-ng through 1.0.40 and uClibc through 0.9.33.2 use predictable DNS transaction IDs that may lead to DNS cache poisoning. | MEDIUM 6.5EPSS 11.2% | 6 May 2022 |
| CVE-2022-29535 | Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. | CRITICAL 9.8EPSS 91.8% | 5 May 2022 |
| CVE-2022-29592 | Tenda TX9 Pro 22.03.02.10 devices allow OS command injection via set_route (called by doSystemCmd_route). | CRITICAL 9.8EPSS 20.1% | 5 May 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.