Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,272 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 4 November 2026
17,511 results · page 78 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-20708 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | KEVHIGH 8.0EPSS 14.9% | 10 February 2022 |
| CVE-2022-20707 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and… | HIGH 7.3EPSS 75.3% | 10 February 2022 |
| CVE-2022-20705 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and… | CRITICAL 9.8EPSS 80.0% | 10 February 2022 |
| CVE-2022-20699 | Cisco Small Business RV Series Routers Stack-based Buffer Overflow Vulnerability | KEVCRITICAL 9.8EPSS 72.5% | 10 February 2022 |
| CVE-2021-45901 | The password-reset form in ServiceNow Orlando provides different responses to invalid authentication attempts depending on whether the username exists. | EXPLOITMEDIUM 5.3EPSS 14.3% | 10 February 2022 |
| CVE-2022-24315 | A CWE-125: Out-of-bounds Read vulnerability exists that could cause denial of service when an attacker repeatedly sends a specially crafted message. | HIGH 7.5EPSS 19.3% | 9 February 2022 |
| CVE-2022-24314 | A CWE-125: Out-of-bounds Read vulnerability exists that could cause memory leaks potentially resulting in denial of service when an attacker repeatedly sends a specially crafted message. | HIGH 7.5EPSS 18.2% | 9 February 2022 |
| CVE-2022-24313 | A CWE-120: Buffer Copy without Checking Size of Input vulnerability exists that could cause a stack-based buffer overflow potentially leading to remote code execution when an attacker sends a specially crafted message. | CRITICAL 9.8EPSS 44.6% | 9 February 2022 |
| CVE-2022-22536 | SAP Multiple Products HTTP Request Smuggling Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 97.9% | 9 February 2022 |
| CVE-2022-22718 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 18.5% | 9 February 2022 |
| CVE-2022-22715 | Named Pipe File System Elevation of Privilege Vulnerability | HIGH 7.8EPSS 13.5% | 9 February 2022 |
| CVE-2022-22005 | Microsoft SharePoint Server Remote Code Execution Vulnerability | HIGH 8.8EPSS 16.5% | 9 February 2022 |
| CVE-2022-21999 | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 41.0% | 9 February 2022 |
| CVE-2022-21993 | Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability | HIGH 7.5EPSS 43.6% | 9 February 2022 |
| CVE-2022-21971 | Microsoft Windows Runtime Remote Code Execution Vulnerability | KEVHIGH 7.8EPSS 53.9% | 9 February 2022 |
| CVE-2021-46354 | Thinfinity VirtualUI 2.1.28.0, 2.1.32.1 and 2.5.26.2, fixed in version 3.0 is affected by an information disclosure vulnerability in the parameter "Addr" in cmd site. | EXPLOITHIGH 7.5EPSS 12.9% | 9 February 2022 |
| CVE-2022-24682 | Synacor Zimbra Collaborate Suite (ZCS) Cross-Site Scripting Vulnerability | KEVMEDIUM 6.1EPSS 30.9% | 9 February 2022 |
| CVE-2021-44864 | TP-Link WR886N 3.0 1.0.1 Build 150127 Rel.34123n is vulnerable to Buffer Overflow. | MEDIUM 6.5EPSS 10.2% | 8 February 2022 |
| CVE-2021-25114 | The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection | CRITICAL 9.8EPSS 81.8% | 7 February 2022 |
| CVE-2022-22833 | An attacker can obtain sensitive information via a /js/app.js request. | EXPLOITHIGH 7.5EPSS 11.6% | 6 February 2022 |
| CVE-2022-22832 | An issue was discovered in Servisnet Tessa 0.0.2. | EXPLOITCRITICAL 9.8EPSS 14.1% | 6 February 2022 |
| CVE-2022-22831 | An attacker can add a new sysadmin user via a manipulation of the Authorization HTTP header. | EXPLOITCRITICAL 9.8EPSS 11.4% | 6 February 2022 |
| CVE-2022-0437 | Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14. | MEDIUM 6.1EPSS 15.1% | 5 February 2022 |
| CVE-2022-0218 | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the… | MEDIUM 6.1EPSS 66.4% | 4 February 2022 |
| CVE-2022-23329 | A vulnerability in ${"freemarker.template.utility.Execute"?new() of UJCMS Jspxcms v10.2.0 allows attackers to execute arbitrary commands via uploading malicious files. | CRITICAL 9.8EPSS 14.4% | 4 February 2022 |
| CVE-2022-24260 | A SQL injection vulnerability in Voipmonitor GUI before v24.96 allows attackers to escalate privileges to the Administrator level. | CRITICAL 9.8EPSS 50.0% | 4 February 2022 |
| CVE-2022-24144 | Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function WanParameterSetting. | CRITICAL 9.8EPSS 18.5% | 4 February 2022 |
| CVE-2022-23357 | mozilo2.0 was discovered to be vulnerable to directory traversal attacks via the parameter curent_dir. | CRITICAL 9.1EPSS 19.9% | 3 February 2022 |
| CVE-2022-23833 | An issue was discovered in MultiPartParser in Django 2.2 before 2.2.27, 3.2 before 3.2.12, and 4.0 before 4.0.2. | HIGH 7.5EPSS 49.5% | 3 February 2022 |
| CVE-2021-43062 | A improper neutralization of input during web page generation ('cross-site scripting') in Fortinet FortiMail version 7.0.1 and 7.0.0, version 6.4.5 and below, version 6.3.7 and below, version 6.0.11 and below allows attacker to execute unauthorized code… | EXPLOITMEDIUM 6.1EPSS 12.9% | 2 February 2022 |
| CVE-2022-24223 | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. | EXPLOITCRITICAL 9.8EPSS 62.0% | 1 February 2022 |
| CVE-2022-24218 | An issue in /admin/delete_image.php of eliteCMS v1.0 allows attackers to delete arbitrary files. | CRITICAL 9.1EPSS 17.0% | 1 February 2022 |
| CVE-2021-24926 | The Domain Check WordPress plugin before 1.0.17 does not sanitise and escape the domain parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting issue | EXPLOITMEDIUM 6.1EPSS 12.9% | 1 February 2022 |
| CVE-2021-24762 | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection. | EXPLOITCRITICAL 9.8EPSS 86.8% | 1 February 2022 |
| CVE-2022-23409 | The Logs plugin before 3.0.4 for Craft CMS allows remote attackers to read arbitrary files via input to actionStream in Controller.php. | EXPLOITMEDIUM 4.9EPSS 13.8% | 31 January 2022 |
| CVE-2021-34805 | For each URL request, it accesses the corresponding .fau file on the operating system without preventing %2e%2e%5c directory traversal. | HIGH 7.5EPSS 26.8% | 31 January 2022 |
| CVE-2022-24124 | The query API in Casdoor before 1.13.1 has a SQL injection vulnerability related to the field and value parameters, as demonstrated by api/get-organizations. | EXPLOITHIGH 7.5EPSS 55.3% | 29 January 2022 |
| CVE-2021-40412 | An OScommand injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. | HIGH 7.2EPSS 27.5% | 28 January 2022 |
| CVE-2021-40410 | An OS command injection vulnerability exists in the device network settings functionality of reolink RLC-410W v3.0.0.136_20121102. | HIGH 7.2EPSS 27.9% | 28 January 2022 |
| CVE-2021-40407 | Reolink RLC-410W IP Camera OS Command Injection Vulnerability | KEVHIGH 7.2EPSS 47.6% | 28 January 2022 |
| CVE-2021-4034 | Red Hat Polkit Out-of-Bounds Read and Write Vulnerability | KEVEXPLOITHIGH 7.8EPSS 94.9% | 28 January 2022 |
| CVE-2021-23174 | Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0]. | MEDIUM 4.8EPSS 83.9% | 28 January 2022 |
| CVE-2021-46065 | A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code. | MEDIUM 4.8EPSS 92.3% | 27 January 2022 |
| CVE-2022-0332 | An SQL injection risk was identified in the h5p activity web service responsible for fetching user attempt data. | EXPLOITCRITICAL 9.8EPSS 44.0% | 25 January 2022 |
| CVE-2022-23944 | User can access /plugin api without authentication. | CRITICAL 9.1EPSS 79.0% | 25 January 2022 |
| CVE-2022-23437 | There's a vulnerability within the Apache Xerces Java (XercesJ) XML parser when handling specially crafted XML document payloads. | MEDIUM 6.5EPSS 11.6% | 24 January 2022 |
| CVE-2021-25080 | The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against… | MEDIUM 6.1EPSS 84.2% | 24 January 2022 |
| CVE-2021-25076 | The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. | EXPLOITHIGH 8.8EPSS 17.1% | 24 January 2022 |
| CVE-2022-22930 | A remote code execution (RCE) vulnerability in the Template Management function of MCMS v5.2.4 allows attackers to execute arbitrary code via a crafted payload. | CRITICAL 9.8EPSS 23.7% | 21 January 2022 |
| CVE-2022-23119 | A directory traversal vulnerability in Trend Micro Deep Security and Cloud One - Workload Security Agent for Linux version 20 and below could allow an attacker to read arbitrary files from the file system. | HIGH 7.5EPSS 21.4% | 20 January 2022 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.