Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 77 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-0651 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_type parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without… | HIGH 7.5EPSS 32.2% | 24 February 2022 |
| CVE-2021-44532 | The string format was subject to an injection vulnerability when name constraints were used within a certificate chain, allowing the bypass of these name constraints.Versions of Node.js with the fix for this escape SANs containing the problematic… | MEDIUM 5.3EPSS 10.4% | 24 February 2022 |
| CVE-2022-25414 | Tenda AC9 V15.03.2.21_cn was discovered to contain a stack overflow via the parameter NPTR. | CRITICAL 9.8EPSS 10.4% | 24 February 2022 |
| CVE-2022-25084 | TOTOLink T6 V5.9c.4085_B20190428 was discovered to contain a command injection vulnerability in the "Main" function. | CRITICAL 9.8EPSS 21.8% | 24 February 2022 |
| CVE-2022-25082 | TOTOLink A950RG V5.9c.4050_B20190424 and V4.1.2cu.5204_B20210112 were discovered to contain a command injection vulnerability in the "Main" function. | CRITICAL 9.8EPSS 13.7% | 24 February 2022 |
| CVE-2022-25077 | TOTOLink A3100R V4.1.2cu.5050_B20200504 was discovered to contain a command injection vulnerability in the "Main" function. | CRITICAL 9.8EPSS 30.4% | 24 February 2022 |
| CVE-2022-25075 | TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. | CRITICAL 9.8EPSS 56.2% | 24 February 2022 |
| CVE-2022-25074 | TP-Link TL-WR902AC(US)_V3_191209 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). | CRITICAL 9.8EPSS 13.0% | 24 February 2022 |
| CVE-2022-25073 | TL-WR841Nv14_US_0.9.1_4.18 routers were discovered to contain a stack overflow in the function dm_fillObjByStr(). | CRITICAL 9.8EPSS 13.0% | 24 February 2022 |
| CVE-2022-25072 | TP-Link Archer A54 Archer A54(US)_V1_210111 routers were discovered to contain a stack overflow in the function DM_ Fillobjbystr(). | CRITICAL 9.8EPSS 13.0% | 24 February 2022 |
| CVE-2022-23176 | WatchGuard Firebox and XTM Privilege Escalation Vulnerability | KEVHIGH 8.8EPSS 10.8% | 24 February 2022 |
| CVE-2021-44967 | A Remote Code Execution (RCE) vulnerabilty exists in LimeSurvey 5.2.4 via the upload and install plugins function, which could let a remote malicious user upload an arbitrary PHP code file. | HIGH 8.8EPSS 13.5% | 24 February 2022 |
| CVE-2021-44567 | An unauthenticated SQL Injection vulnerability exists in RosarioSIS before 7.6.1 via the votes parameter in ProgramFunctions/PortalPollsNotes.fnc.php. | EXPLOITCRITICAL 9.8EPSS 23.1% | 24 February 2022 |
| CVE-2020-27467 | A Directory Traversal vulnerability exits in Processwire CMS before 2.7.1 via the download parameter to index.php. | HIGH 7.5EPSS 15.3% | 24 February 2022 |
| CVE-2022-20650 | A vulnerability in the NX-API feature of Cisco NX-OS Software could allow an authenticated, remote attacker to execute arbitrary commands with root privileges. | HIGH 8.8EPSS 14.5% | 23 February 2022 |
| CVE-2022-20624 | A vulnerability in the Cisco Fabric Services over IP (CFSoIP) feature of Cisco NX-OS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. | HIGH 7.5EPSS 12.4% | 23 February 2022 |
| CVE-2022-20623 | A vulnerability in the rate limiter for Bidirectional Forwarding Detection (BFD) traffic of Cisco NX-OS Software for Cisco Nexus 9000 Series Switches could allow an unauthenticated, remote attacker to cause BFD traffic to be dropped on an affected device. | HIGH 7.5EPSS 11.9% | 23 February 2022 |
| CVE-2022-0714 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.4436. | MEDIUM 5.5EPSS 12.7% | 22 February 2022 |
| CVE-2022-24295 | Okta Advanced Server Access Client for Windows prior to version 1.57.0 was found to be vulnerable to command injection via a specially crafted URL. | HIGH 8.8EPSS 16.6% | 21 February 2022 |
| CVE-2021-44142 | The Samba vfs_fruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfs_fruit… | HIGH 8.8EPSS 73.6% | 21 February 2022 |
| CVE-2021-24867 | Numerous Plugins and Themes from the AccessPress Themes (aka Access Keys) vendor are backdoored due to their website being compromised. | CRITICAL 9.8EPSS 18.0% | 21 February 2022 |
| CVE-2022-23375 | WikiDocs version 0.1.18 has an authenticated remote code execution vulnerability. | HIGH 8.8EPSS 19.9% | 19 February 2022 |
| CVE-2022-23642 | Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the `gitserver` service. | EXPLOITHIGH 8.8EPSS 74.3% | 18 February 2022 |
| CVE-2022-0543 | Debian-specific Redis Server Lua Sandbox Escape Vulnerability | KEVCRITICAL 10.0EPSS 99.4% | 18 February 2022 |
| CVE-2022-0666 | CRLF Injection leads to Stack Trace Exposure due to lack of filtering at https://demo.microweber.org/ in Packagist microweber/microweber prior to 1.2.11. | HIGH 7.5EPSS 44.3% | 18 February 2022 |
| CVE-2022-22916 | O2OA v6.4.7 was discovered to contain a remote code execution (RCE) vulnerability via /x_program_center/jaxrs/invoke. | CRITICAL 9.8EPSS 38.7% | 17 February 2022 |
| CVE-2021-46314 | A Remote Command Execution (RCE) vulnerability exists in HNAP1/control/SetNetworkTomographySettings.php of D-Link Router DIR-846 DIR846A1_FW100A43.bin and DIR846enFW100A53DLA-Retail.bin because backticks can be used for command injection when judging… | CRITICAL 9.8EPSS 33.3% | 17 February 2022 |
| CVE-2021-45382 | D-Link Multiple Routers Remote Code Execution Vulnerability | KEVCRITICAL 9.8EPSS 97.8% | 17 February 2022 |
| CVE-2021-3781 | A trivial sandbox (enabled with the `-dSAFER` option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. | CRITICAL 9.9EPSS 83.9% | 16 February 2022 |
| CVE-2021-3560 | Red Hat Polkit Incorrect Authorization Vulnerability | KEVEXPLOIT ✓HIGH 7.8EPSS 23.7% | 16 February 2022 |
| CVE-2022-24086 | Adobe Commerce and Magento Open Source Improper Input Validation Vulnerability | KEVCRITICAL 9.8EPSS 99.2% | 16 February 2022 |
| CVE-2022-0513 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without… | HIGH 7.5EPSS 53.5% | 16 February 2022 |
| CVE-2022-25236 | xmlparse.c in Expat (aka libexpat) before 2.4.5 allows attackers to insert namespace-separator characters into namespace URIs. | CRITICAL 9.8EPSS 35.3% | 16 February 2022 |
| CVE-2021-35380 | A Directory Traversal vulnerability exists in Solari di Udine TermTalk Server (TTServer) 3.24.0.2, which lets an unauthenticated malicious user gain access to the files on the remote system by gaining access to the relative path of the file they want to… | EXPLOITHIGH 7.5EPSS 36.7% | 15 February 2022 |
| CVE-2021-43734 | kkFileview v4.0.0 has arbitrary file read through a directory traversal vulnerability which may lead to sensitive file leak on related host. | HIGH 7.5EPSS 10.7% | 15 February 2022 |
| CVE-2022-23389 | PublicCMS v4.0 was discovered to contain a remote code execution (RCE) vulnerability via the cmdarray parameter. | CRITICAL 9.8EPSS 22.0% | 14 February 2022 |
| CVE-2021-45392 | A Buffer Overflow vulnerability exists in Tenda Router AX12 V22.03.01.21_CN in the sub_422CE4 function in page /goform/setIPv6Status via the prefixDelegate parameter, which causes a Denial of Service. | HIGH 7.5EPSS 12.3% | 14 February 2022 |
| CVE-2021-45420 | Emerson Dixell XWEB-500 products are affected by arbitrary file write vulnerability in /cgi-bin/logo_extra_upload.cgi, /cgi-bin/cal_save.cgi, and /cgi-bin/lo_utils.cgi. | CRITICAL 9.8EPSS 17.5% | 14 February 2022 |
| CVE-2022-0572 | Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2. | HIGH 7.8EPSS 26.5% | 14 February 2022 |
| CVE-2022-0306 | Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 85.4% | 12 February 2022 |
| CVE-2022-0289 | Use after free in Safe browsing in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 27.7% | 12 February 2022 |
| CVE-2022-0185 | Linux Kernel Heap-Based Buffer Overflow Vulnerability | KEVHIGH 8.4EPSS 25.2% | 11 February 2022 |
| CVE-2021-31932 | Nokia BTS TRS web console FTM_W20_FP2_2019.08.16_0010 allows Authentication Bypass. | CRITICAL 9.8EPSS 21.6% | 11 February 2022 |
| CVE-2021-22824 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in denial of service, due to missing length check on user-supplied data from a constructed message received on the network. | HIGH 7.5EPSS 14.2% | 11 February 2022 |
| CVE-2021-22823 | A CWE-306: Missing Authentication for Critical Function vulnerability exists that could cause deletion of arbitrary files in the context of the user running IGSS due to lack of validation of network messages. | CRITICAL 9.1EPSS 21.4% | 11 February 2022 |
| CVE-2021-22802 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could result in remote code execution due to missing length check on user supplied data, when a constructed message is received on the network. | CRITICAL 9.8EPSS 20.2% | 11 February 2022 |
| CVE-2022-24112 | Apache APISIX Authentication Bypass Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 96.1% | 11 February 2022 |
| CVE-2021-44521 | When running Apache Cassandra with the following configuration: enable_user_defined_functions: true enable_scripted_user_defined_functions: true enable_user_defined_functions_threads: false it is possible for an attacker to execute arbitrary code on the… | CRITICAL 9.1EPSS 58.9% | 11 February 2022 |
| CVE-2022-0557 | OS Command Injection in Packagist microweber/microweber prior to 1.2.11. | EXPLOITHIGH 7.2EPSS 51.2% | 11 February 2022 |
| CVE-2022-24954 | Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have a Stack-Based Buffer Overflow related to XFA, for the 'subform colSpan="-2"' and 'draw colSpan="1"' substrings. | CRITICAL 9.8EPSS 11.9% | 11 February 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.