Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 76 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-22806 | A CWE-294: Authentication Bypass by Capture-replay vulnerability exists that could cause an unauthenticated connection to the UPS when a malformed connection is sent. | CRITICAL 9.8EPSS 12.5% | 9 March 2022 |
| CVE-2022-22805 | A CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') vulnerability exists that could cause remote code execution when an improperly handled TLS packet is reassembled. | CRITICAL 9.8EPSS 11.9% | 9 March 2022 |
| CVE-2022-24502 | Windows HTML Platforms Security Feature Bypass Vulnerability | MEDIUM 4.3EPSS 33.1% | 9 March 2022 |
| CVE-2022-24463 | Microsoft Exchange Server Spoofing Vulnerability | MEDIUM 6.5EPSS 31.8% | 9 March 2022 |
| CVE-2022-23285 | Remote Desktop Client Remote Code Execution Vulnerability | HIGH 8.8EPSS 25.6% | 9 March 2022 |
| CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability | HIGH 8.8EPSS 41.1% | 9 March 2022 |
| CVE-2022-23253 | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability | MEDIUM 6.5EPSS 56.4% | 9 March 2022 |
| CVE-2022-21990 | Remote Desktop Client Remote Code Execution Vulnerability | HIGH 8.8EPSS 18.8% | 9 March 2022 |
| CVE-2022-0482 | Exposure of Private Personal Information to an Unauthorized Actor in GitHub repository alextselegidis/easyappointments prior to 1.4.3. | EXPLOITCRITICAL 9.1EPSS 43.7% | 9 March 2022 |
| CVE-2022-24716 | Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including `icingaweb2` configuration files with database credentials. | EXPLOITHIGH 7.5EPSS 89.4% | 8 March 2022 |
| CVE-2022-24715 | Authenticated users, with access to the configuration, can create SSH resource files in unintended directories, leading to the execution of arbitrary code. | EXPLOITHIGH 8.8EPSS 14.9% | 8 March 2022 |
| CVE-2022-24713 | The regex crate features built-in mitigations to prevent denial of service attacks caused by untrusted regexes, or untrusted input matched by trusted regexes. | HIGH 7.5EPSS 14.5% | 8 March 2022 |
| CVE-2022-0441 | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin | EXPLOITCRITICAL 9.8EPSS 85.3% | 7 March 2022 |
| CVE-2022-0434 | As a result, unauthenticated attackers could perform SQL injection attacks | CRITICAL 9.8EPSS 14.8% | 7 March 2022 |
| CVE-2022-0349 | The NotificationX WordPress plugin before 2.3.9 does not sanitise and escape the nx_id parameter before using it in a SQL statement, leading to an Unauthenticated Blind SQL Injection | CRITICAL 9.8EPSS 34.4% | 7 March 2022 |
| CVE-2021-46704 | In GenieACS 1.2.x before 1.2.8, the UI interface API is vulnerable to unauthenticated OS command injection via the ping host argument (lib/ui/api.ts and lib/ping.ts). | CRITICAL 9.8EPSS 21.9% | 6 March 2022 |
| CVE-2021-44827 | There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root… | HIGH 8.8EPSS 54.0% | 4 March 2022 |
| CVE-2021-3737 | An improperly handled HTTP response in the HTTP client code of python may allow a remote attacker, who controls the HTTP server, to make the client script enter an infinite loop, consuming CPU time. | HIGH 7.5EPSS 13.2% | 4 March 2022 |
| CVE-2022-26318 | WatchGuard Firebox and XTM Appliances Arbitrary Code Execution | KEVCRITICAL 9.8EPSS 78.2% | 4 March 2022 |
| CVE-2021-46381 | Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow]. | EXPLOITHIGH 7.5EPSS 58.9% | 4 March 2022 |
| CVE-2021-46379 | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through URL redirection to untrusted site. | EXPLOITMEDIUM 6.1EPSS 15.8% | 4 March 2022 |
| CVE-2021-46378 | DLink DIR850 ET850-1.08TRb03 is affected by an incorrect access control vulnerability through an unauthenticated remote configuration download. | EXPLOITHIGH 7.5EPSS 31.9% | 4 March 2022 |
| CVE-2022-0832 | Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3. | MEDIUM 5.4EPSS 66.6% | 4 March 2022 |
| CVE-2021-46393 | There is a stack buffer overflow vulnerability in the formSetPPTPServer function of Tenda-AX3 router V16.03.12.10_CN. | CRITICAL 9.8EPSS 15.9% | 4 March 2022 |
| CVE-2022-0848 | OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11. | EXPLOITCRITICAL 9.8EPSS 35.4% | 4 March 2022 |
| CVE-2022-22947 | VMware Spring Cloud Gateway Code Injection Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 98.3% | 3 March 2022 |
| CVE-2022-23648 | A bug was found in containerd prior to versions 1.6.1, 1.5.10, and 1.14.12 where containers launched through containerd’s CRI implementation on Linux with a specially-crafted image configuration could gain access to read-only copies of arbitrary files… | HIGH 7.5EPSS 27.4% | 3 March 2022 |
| CVE-2022-25089 | Printix Secure Cloud Print Management through 1.3.1106.0 incorrectly uses Privileged APIs to modify values in HKEY_LOCAL_MACHINE via UITasks.PersistentRegistryData. | EXPLOITCRITICAL 9.8EPSS 18.4% | 3 March 2022 |
| CVE-2022-22909 | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module. | EXPLOITHIGH 8.8EPSS 45.4% | 3 March 2022 |
| CVE-2021-3654 | A vulnerability was found in openstack-nova's console proxy, noVNC. | MEDIUM 6.1EPSS 26.8% | 2 March 2022 |
| CVE-2022-0711 | This flaw could allow an attacker to send crafted HTTP response packets which lead to an infinite loop, eventually resulting in a denial of service condition. | HIGH 7.5EPSS 16.6% | 2 March 2022 |
| CVE-2022-0819 | Code Injection in GitHub repository dolibarr/dolibarr prior to 15.0.1. | HIGH 8.8EPSS 42.7% | 2 March 2022 |
| CVE-2022-23779 | Zoho ManageEngine Desktop Central before 10.1.2137.8 exposes the installed server name to anyone. | MEDIUM 5.3EPSS 13.2% | 2 March 2022 |
| CVE-2022-0824 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. | EXPLOITHIGH 8.8EPSS 97.0% | 2 March 2022 |
| CVE-2021-41282 | diag_routes.php in pfSense 2.5.2 allows sed data injection. | HIGH 8.8EPSS 87.1% | 1 March 2022 |
| CVE-2021-46387 | ZyXEL ZyWALL 2 Plus Internet Security Appliance is affected by Cross Site Scripting (XSS). | EXPLOITMEDIUM 6.1EPSS 21.0% | 1 March 2022 |
| CVE-2021-4039 | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. | EXPLOITCRITICAL 9.8EPSS 71.0% | 1 March 2022 |
| CVE-2022-0412 | The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL statement via the wishlist/remove_product REST endpoint,… | CRITICAL 9.8EPSS 74.0% | 28 February 2022 |
| CVE-2022-26159 | The auto-completion plugin in Ametys CMS before 4.5.0 allows a remote unauthenticated attacker to read documents such as plugins/web/service/search/auto-completion/<domain>/en.xml (and similar pathnames for other languages), which contain all characters… | MEDIUM 5.3EPSS 13.4% | 28 February 2022 |
| CVE-2022-25359 | On ICL ScadaFlex II SCADA Controller SC-1 and SC-2 1.03.07 devices, unauthenticated remote attackers can overwrite, delete, or create files. | EXPLOITCRITICAL 9.1EPSS 37.3% | 26 February 2022 |
| CVE-2022-25094 | Home Owners Collection Management System v1.0 was discovered to contain a remote code execution (RCE) vulnerability via the parameter "cover" in SystemSettings.php. | HIGH 8.8EPSS 23.3% | 26 February 2022 |
| CVE-2022-25064 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a remote code execution (RCE) vulnerability via the function oal_wan6_setIpAddr. | CRITICAL 9.8EPSS 36.5% | 25 February 2022 |
| CVE-2022-25061 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute. | CRITICAL 9.8EPSS 58.7% | 25 February 2022 |
| CVE-2022-25060 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_startPing. | CRITICAL 9.8EPSS 40.2% | 25 February 2022 |
| CVE-2022-24288 | In Apache Airflow, prior to version 2.2.4, some example DAGs did not properly sanitize user-provided params, making them susceptible to OS Command Injection from the web UI. | HIGH 8.8EPSS 77.9% | 25 February 2022 |
| CVE-2021-44664 | An Authenticated Remote Code Exection (RCE) vulnerability exists in Xerte through 3.9 in website_code/php/import/fileupload.php by uploading a maliciously crafted PHP file though the project interface disguised as a language file to bypasses the upload… | EXPLOITHIGH 8.8EPSS 12.8% | 24 February 2022 |
| CVE-2022-25305 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts… | MEDIUM 6.1EPSS 78.9% | 24 February 2022 |
| CVE-2022-25149 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject… | HIGH 7.5EPSS 77.5% | 24 February 2022 |
| CVE-2022-25148 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication… | EXPLOITCRITICAL 9.8EPSS 80.9% | 24 February 2022 |
| CVE-2022-21824 | Due to the formatting logic of the "console.table()" function it was not safe to allow user controlled input to be passed to the "properties" parameter while simultaneously passing a plain object with at least one property as the first parameter, which… | HIGH 8.2EPSS 21.5% | 24 February 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.