Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,334 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 5 November 2026
17,511 results · page 79 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2022-22733 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache ShardingSphere ElasticJob-UI allows an attacker who has guest account to do privilege escalation. | MEDIUM 6.5EPSS 37.6% | 20 January 2022 |
| CVE-2022-0281 | Exposure of Sensitive Information to an Unauthorized Actor in Packagist microweber/microweber prior to 1.2.11. | HIGH 7.5EPSS 10.5% | 20 January 2022 |
| CVE-2022-23046 | PhpIPAM v1.4.4 allows an authenticated admin user to inject SQL sentences in the "subnet" parameter while searching a subnet via app/admin/routing/edit-bgp-mapping-search.php | EXPLOITHIGH 7.2EPSS 25.2% | 19 January 2022 |
| CVE-2022-23221 | H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392. | CRITICAL 9.8EPSS 64.8% | 19 January 2022 |
| CVE-2022-21371 | Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Web Container). | EXPLOITHIGH 7.5EPSS 92.6% | 19 January 2022 |
| CVE-2022-21280 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 76.5% | 19 January 2022 |
| CVE-2022-21279 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 79.0% | 19 January 2022 |
| CVE-2021-35587 | Oracle Fusion Middleware Unspecified Vulnerability | KEVCRITICAL 9.8EPSS 96.3% | 19 January 2022 |
| CVE-2022-23307 | CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. | HIGH 8.8EPSS 54.4% | 18 January 2022 |
| CVE-2022-23305 | This allows attackers to manipulate the SQL by entering crafted strings into input fields or headers of an application that are logged allowing unintended SQL queries to be executed. | CRITICAL 9.8EPSS 66.5% | 18 January 2022 |
| CVE-2022-23302 | JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. | HIGH 8.8EPSS 63.8% | 18 January 2022 |
| CVE-2021-44757 | Zoho ManageEngine Desktop Central before 10.1.2137.9 and Desktop Central MSP before 10.1.2137.9 allow attackers to bypass authentication, and read sensitive information or upload an arbitrary ZIP archive to the server. | CRITICAL 9.1EPSS 24.2% | 18 January 2022 |
| CVE-2022-23178 | When the administrative web interface of the HDMI switcher is accessed unauthenticated, user credentials are disclosed that are valid to authenticate to the web interface. | EXPLOITCRITICAL 9.8EPSS 75.2% | 15 January 2022 |
| CVE-2021-45068 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. | HIGH 7.8EPSS 12.3% | 14 January 2022 |
| CVE-2021-45064 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the… | HIGH 7.8EPSS 11.5% | 14 January 2022 |
| CVE-2021-45062 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the… | HIGH 7.8EPSS 16.5% | 14 January 2022 |
| CVE-2021-44715 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated… | MEDIUM 5.5EPSS 14.7% | 14 January 2022 |
| CVE-2021-44710 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the… | HIGH 7.8EPSS 11.6% | 14 January 2022 |
| CVE-2021-44709 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a heap overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution… | HIGH 7.8EPSS 29.0% | 14 January 2022 |
| CVE-2021-44708 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a heap overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution… | HIGH 7.8EPSS 38.2% | 14 January 2022 |
| CVE-2021-44704 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the… | HIGH 7.8EPSS 10.8% | 14 January 2022 |
| CVE-2021-44703 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code… | HIGH 7.8EPSS 57.3% | 14 January 2022 |
| CVE-2021-44701 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a use-after-free vulnerability in the processing of Format event actions that could result in arbitrary code execution in the… | HIGH 7.8EPSS 20.9% | 14 January 2022 |
| CVE-2022-23227 | NUUO NVRmini2 Devices Missing Authentication Vulnerability | KEVCRITICAL 9.8EPSS 48.5% | 14 January 2022 |
| CVE-2021-34996 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. | HIGH 8.8EPSS 82.3% | 13 January 2022 |
| CVE-2021-34995 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. | HIGH 8.8EPSS 68.9% | 13 January 2022 |
| CVE-2022-23134 | Zabbix Frontend Improper Access Control Vulnerability | KEVMEDIUM 5.3EPSS 93.9% | 13 January 2022 |
| CVE-2022-23131 | Zabbix Frontend Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 95.7% | 13 January 2022 |
| CVE-2022-23111 | A cross-site request forgery (CSRF) vulnerability in Jenkins Publish Over SSH Plugin 1.22 and earlier allows attackers to connect to an attacker-specified SSH server using attacker-specified credentials. | MEDIUM 4.3EPSS 26.5% | 12 January 2022 |
| CVE-2022-20615 | Jenkins Matrix Project Plugin 1.19 and earlier does not escape HTML metacharacters in node and label names, and label descriptions, resulting in a stored cross-site scripting (XSS) vulnerability exploitable by attackers with Agent/Configure permission. | MEDIUM 5.4EPSS 81.8% | 12 January 2022 |
| CVE-2021-42561 | This allows attackers to use shell metacharacters (e.g., backticks "``" or dollar parenthesis "$()" ) in order to escape the current command and execute arbitrary shell commands. | HIGH 8.8EPSS 19.6% | 12 January 2022 |
| CVE-2022-21907 | HTTP Protocol Stack Remote Code Execution Vulnerability | EXPLOITCRITICAL 9.8EPSS 92.8% | 11 January 2022 |
| CVE-2022-21882 | Microsoft Win32k Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 59.2% | 11 January 2022 |
| CVE-2022-21881 | Windows Kernel Elevation of Privilege Vulnerability | HIGH 7.0EPSS 24.2% | 11 January 2022 |
| CVE-2021-43297 | A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. | CRITICAL 9.8EPSS 17.4% | 10 January 2022 |
| CVE-2021-24862 | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue | EXPLOITHIGH 7.2EPSS 72.7% | 10 January 2022 |
| CVE-2021-42392 | An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. | CRITICAL 9.8EPSS 83.2% | 10 January 2022 |
| CVE-2022-21662 | Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. | MEDIUM 5.4EPSS 64.5% | 6 January 2022 |
| CVE-2022-21661 | Due to improper sanitization in WP_Query, there can be cases where SQL injection is possible through plugins or themes that use it in a certain way. | EXPLOITHIGH 7.5EPSS 97.8% | 6 January 2022 |
| CVE-2021-45456 | Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user. | CRITICAL 9.8EPSS 88.9% | 6 January 2022 |
| CVE-2021-31589 | A cross-site scripting (XSS) vulnerability has been reported and confirmed for BeyondTrust Secure Remote Access Base Software version 6.0.1 and older, which allows the injection of unauthenticated, specially-crafted web requests without proper… | MEDIUM 6.1EPSS 26.0% | 5 January 2022 |
| CVE-2022-21647 | Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. | CRITICAL 9.8EPSS 37.7% | 4 January 2022 |
| CVE-2021-43711 | The downloadFlile.cgi binary file in TOTOLINK EX200 V4.0.3c.7646_B20201211 has a command injection vulnerability when receiving GET parameters. | CRITICAL 9.8EPSS 37.8% | 4 January 2022 |
| CVE-2021-43942 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. | MEDIUM 6.1EPSS 55.4% | 4 January 2022 |
| CVE-2021-45428 | TLR-2005KSH is affected by an incorrect access control vulnerability. | EXPLOITCRITICAL 9.8EPSS 56.9% | 3 January 2022 |
| CVE-2021-24786 | The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue | EXPLOITHIGH 7.2EPSS 17.3% | 3 January 2022 |
| CVE-2021-20150 | Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. | MEDIUM 5.3EPSS 40.1% | 30 December 2021 |
| CVE-2021-45427 | Emerson XWEB 300D EVO 3.0.7--3ee403 is affected by: unauthenticated arbitrary file deletion due to path traversal. | CRITICAL 9.8EPSS 19.2% | 30 December 2021 |
| CVE-2021-44832 | Apache Log4j2 versions 2.0-beta7 through 2.17.0 (excluding security fix releases 2.3.2 and 2.12.4) are vulnerable to a remote code execution (RCE) attack when a configuration uses a JDBC Appender with a JNDI LDAP data source URI when an attacker has… | MEDIUM 6.6EPSS 97.9% | 28 December 2021 |
| CVE-2021-43858 | Prior to version `RELEASE.2021-12-27T07-23-18Z`, a malicious client can hand-craft an HTTP API call that allows for updating policy for a user and gaining higher privileges. | HIGH 8.8EPSS 35.5% | 27 December 2021 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.