Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 73 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-27926 | Synacor Zimbra Collaboration Suite (ZCS) Cross-Site Scripting (XSS) Vulnerability | KEVMEDIUM 6.1EPSS 17.6% | 21 April 2022 |
| CVE-2022-27925 | Synacor Zimbra Collaboration Suite (ZCS) Arbitrary File Upload Vulnerability | KEVHIGH 7.2EPSS 98.7% | 21 April 2022 |
| CVE-2022-27924 | Synacor Zimbra Collaboration Suite (ZCS) Command Injection Vulnerability | KEVHIGH 7.5EPSS 93.9% | 21 April 2022 |
| CVE-2022-26133 | SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated… | CRITICAL 9.8EPSS 70.6% | 20 April 2022 |
| CVE-2022-0540 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. | CRITICAL 9.8EPSS 88.1% | 20 April 2022 |
| CVE-2022-21490 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 79.4% | 19 April 2022 |
| CVE-2022-21489 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 78.9% | 19 April 2022 |
| CVE-2022-21449 | Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). | HIGH 7.5EPSS 77.2% | 19 April 2022 |
| CVE-2022-21445 | Oracle ADF Faces Deserialization of Untrusted Data Vulnerability | KEVCRITICAL 9.8EPSS 62.5% | 19 April 2022 |
| CVE-2022-1329 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site… | HIGH 8.8EPSS 92.7% | 19 April 2022 |
| CVE-2022-1119 | The Simple File List WordPress plugin is vulnerable to Arbitrary File Download via the eeFile parameter found in the ~/includes/ee-downloader.php file due to missing controls which makes it possible unauthenticated attackers to supply a path to a file… | HIGH 7.5EPSS 20.0% | 19 April 2022 |
| CVE-2022-27927 | A SQL injection vulnerability exists in Microfinance Management System 1.0 when MySQL is being used as the application database. | CRITICAL 9.8EPSS 13.8% | 19 April 2022 |
| CVE-2022-28108 | Selenium Server (Grid) before 4 allows CSRF because it permits non-JSON content types such as application/x-www-form-urlencoded, multipart/form-data, and text/plain. | HIGH 8.8EPSS 22.5% | 19 April 2022 |
| CVE-2022-29464 | WSO2 Multiple Products Unrestrictive Upload of File Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 18 April 2022 |
| CVE-2022-1020 | The Product Table for WooCommerce (wooproducttable) WordPress plugin before 3.1.2 does not have authorisation and CSRF checks in the wpt_admin_update_notice_option AJAX action (available to both unauthenticated and authenticated users), as well as does… | CRITICAL 9.8EPSS 25.9% | 18 April 2022 |
| CVE-2022-0661 | The Ad Injection WordPress plugin through 1.2.0.19 does not properly sanitize the body of the adverts injected into the pages, allowing a high privileged user (Admin+) to inject arbitrary HTML or javascript even with unfiltered_html disallowed, leading… | HIGH 7.2EPSS 40.2% | 18 April 2022 |
| CVE-2022-25226 | ThinVNC version 1.0b1 allows an unauthenticated user to bypass the authentication process via 'http://thin-vnc:8080/cmd?cmd=connect' by obtaining a valid SID without any kind of authentication. | CRITICAL 10.0EPSS 11.0% | 18 April 2022 |
| CVE-2022-28810 | Zoho ManageEngine ADSelfService Plus Remote Code Execution Vulnerability | KEVMEDIUM 6.8EPSS 71.0% | 18 April 2022 |
| CVE-2022-27908 | Zoho ManageEngine OpManager before 125588 (and before 125603) is vulnerable to authenticated SQL Injection in the Inventory Reports module. | HIGH 8.8EPSS 36.5% | 18 April 2022 |
| CVE-2022-26904 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | KEVHIGH 7.0EPSS 16.9% | 15 April 2022 |
| CVE-2022-26809 | Remote Procedure Call Runtime Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 90.9% | 15 April 2022 |
| CVE-2022-24500 | Windows SMB Remote Code Execution Vulnerability | HIGH 8.8EPSS 38.0% | 15 April 2022 |
| CVE-2022-24497 | Windows Network File System Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 34.8% | 15 April 2022 |
| CVE-2022-24491 | Windows Network File System Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 33.5% | 15 April 2022 |
| CVE-2022-24481 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | HIGH 7.8EPSS 16.8% | 15 April 2022 |
| CVE-2022-20695 | A vulnerability in the authentication functionality of Cisco Wireless LAN Controller (WLC) Software could allow an unauthenticated, remote attacker to bypass authentication controls and log in to the device through the management interface This… | CRITICAL 10.0EPSS 19.8% | 15 April 2022 |
| CVE-2022-27474 | SuiteCRM v7.11.23 was discovered to allow remote code execution via a crafted payload injected into the FirstName text field. | HIGH 7.2EPSS 23.1% | 15 April 2022 |
| CVE-2022-26498 | An issue was discovered in Asterisk through 19.x. | HIGH 7.5EPSS 16.5% | 15 April 2022 |
| CVE-2022-22149 | A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. | HIGH 8.8EPSS 72.6% | 14 April 2022 |
| CVE-2022-21234 | An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. | HIGH 8.8EPSS 72.6% | 14 April 2022 |
| CVE-2022-21210 | An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. | HIGH 8.8EPSS 71.2% | 14 April 2022 |
| CVE-2022-21145 | A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. | MEDIUM 4.8EPSS 77.8% | 14 April 2022 |
| CVE-2021-43287 | The business continuity add-on, which is enabled by default, leaks all secrets known to the GoCD server to unauthenticated attackers. | HIGH 7.5EPSS 27.4% | 14 April 2022 |
| CVE-2022-24816 | OSGeo GeoServer JAI-EXT Code Injection Vulnerability | KEVCRITICAL 10.0EPSS 99.9% | 13 April 2022 |
| CVE-2022-22960 | VMware Multiple Products Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 35.5% | 13 April 2022 |
| CVE-2022-22957 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). | HIGH 7.2EPSS 23.3% | 13 April 2022 |
| CVE-2022-22956 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. | CRITICAL 9.8EPSS 49.5% | 13 April 2022 |
| CVE-2021-22797 | A CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal) vulnerability exists that could cause malicious script to be deployed in an unauthorized location and may result in code execution on the engineering workstation… | HIGH 7.8EPSS 26.1% | 13 April 2022 |
| CVE-2022-29036 | Jenkins Credentials Plugin 1111.v35a_307992395 and earlier, except 1087.1089.v2f1b_9a_b_040e4, 1074.1076.v39c30cecb_0e2, and 2.6.1.1, does not escape the name and description of Credentials parameters on views displaying parameters, resulting in a… | MEDIUM 5.4EPSS 71.9% | 12 April 2022 |
| CVE-2022-28213 | When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently validate the XML document accepted from an untrusted source, which might result in arbitrary files retrieval from the… | EXPLOITHIGH 8.1EPSS 12.5% | 12 April 2022 |
| CVE-2021-31805 | Using forced OGNL evaluation on untrusted user input can lead to a Remote Code Execution and security degradation. | CRITICAL 9.8EPSS 85.4% | 12 April 2022 |
| CVE-2022-24248 | RiteCMS version 3.1.0 and below suffers from an arbitrary file deletion via path traversal vulnerability in Admin Panel. | MEDIUM 6.5EPSS 21.0% | 12 April 2022 |
| CVE-2022-23450 | A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). | CRITICAL 9.8EPSS 35.7% | 12 April 2022 |
| CVE-2022-28346 | QuerySet.annotate(), aggregate(), and extra() methods are subject to SQL injection in column aliases via a crafted dictionary (with dictionary expansion) as the passed **kwargs. | CRITICAL 9.8EPSS 18.7% | 12 April 2022 |
| CVE-2022-24838 | SMTP Command Injection in Appointment Emails via Newlines: as newlines and special characters are not sanitized in the email value in the JSON request, a malicious attacker can inject newlines to break out of the `RCPT TO:<BOOKING USER'S EMAIL> ` SMTP… | CRITICAL 9.8EPSS 33.0% | 11 April 2022 |
| CVE-2022-22954 | VMware Workspace ONE Access and Identity Manager Server-Side Template Injection Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 11 April 2022 |
| CVE-2022-27115 | In Studio-42 elFinder 2.1.60, there is a vulnerability that causes remote code execution through file name bypass for file upload. | CRITICAL 9.8EPSS 28.6% | 11 April 2022 |
| CVE-2021-46367 | RiteCMS version 3.1.0 and below suffers from a remote code execution vulnerability in the admin panel. | HIGH 7.2EPSS 29.7% | 8 April 2022 |
| CVE-2021-43421 | A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php, which allows a remote malicious user to upload arbitrary files and execute PHP code. | CRITICAL 9.8EPSS 42.8% | 7 April 2022 |
| CVE-2021-46419 | An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. | EXPLOITCRITICAL 9.1EPSS 71.4% | 7 April 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.