Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,334 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 5 November 2026
17,511 results · page 83 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2021-42258 | BQE BillQuick Web Suite SQL Injection Vulnerability | KEVCRITICAL 9.8EPSS 75.2% | 22 October 2021 |
| CVE-2021-42840 | SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. | EXPLOIT ✓HIGH 8.8EPSS 58.6% | 22 October 2021 |
| CVE-2021-31682 | The login portal for the Automated Logic WebCTRL/WebCTRL OEM web application contains a vulnerability that allows for reflected XSS attacks due to the operatorlocale GET parameter not being sanitized. | EXPLOITMEDIUM 6.1EPSS 10.5% | 22 October 2021 |
| CVE-2021-39352 | The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. | HIGH 7.2EPSS 56.3% | 21 October 2021 |
| CVE-2021-41163 | In affected versions maliciously crafted requests could lead to remote code execution. | CRITICAL 9.8EPSS 19.8% | 20 October 2021 |
| CVE-2021-21745 | ZTE MF971R product has a Referer authentication bypass vulnerability. | MEDIUM 4.3EPSS 55.7% | 20 October 2021 |
| CVE-2021-35621 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 50.0% | 20 October 2021 |
| CVE-2021-35616 | Vulnerability in the Oracle Transportation Management product of Oracle Supply Chain (component: UI Infrastructure). | MEDIUM 5.4EPSS 28.0% | 20 October 2021 |
| CVE-2021-35598 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 51.1% | 20 October 2021 |
| CVE-2021-35594 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 51.1% | 20 October 2021 |
| CVE-2021-35593 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 51.1% | 20 October 2021 |
| CVE-2021-35592 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 52.5% | 20 October 2021 |
| CVE-2021-35590 | Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General). | MEDIUM 6.3EPSS 88.5% | 20 October 2021 |
| CVE-2021-35559 | Vulnerability in the Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Swing). | MEDIUM 5.3EPSS 15.9% | 20 October 2021 |
| CVE-2021-30807 | Apple Multiple Products Memory Corruption Vulnerability | KEVHIGH 7.8EPSS 28.8% | 19 October 2021 |
| CVE-2021-30358 | Mobile Access Portal Native Applications who's path is defined by the administrator with environment variables may run applications from other locations by the Mobile Access Portal Agent. | HIGH 7.2EPSS 27.5% | 19 October 2021 |
| CVE-2021-38389 | Advantech WebAccess versions 9.02 and prior are vulnerable to a stack-based buffer overflow, which may allow an attacker to remotely execute code. | CRITICAL 9.8EPSS 10.4% | 18 October 2021 |
| CVE-2021-21797 | An exploitable double-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. | HIGH 7.8EPSS 15.0% | 18 October 2021 |
| CVE-2021-21796 | An exploitable use-after-free vulnerability exists in the JavaScript implementation of Nitro Pro PDF. | HIGH 7.8EPSS 15.8% | 18 October 2021 |
| CVE-2021-38297 | Go before 1.16.9 and 1.17.x before 1.17.2 has a Buffer Overflow via large arguments in a function invocation from a WASM module, when GOARCH=wasm GOOS=js is used. | CRITICAL 9.8EPSS 11.0% | 18 October 2021 |
| CVE-2018-16060 | SmartRTU devices allow remote attackers to obtain sensitive information (directory listing and source code) via a direct request to the /web URI. | EXPLOITHIGH 7.5EPSS 19.6% | 15 October 2021 |
| CVE-2021-27561 | Yealink Device Management Server-Side Request Forgery (SSRF) Vulnerability | KEVCRITICAL 9.8EPSS 82.9% | 15 October 2021 |
| CVE-2021-40728 | Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object… | HIGH 7.8EPSS 54.6% | 15 October 2021 |
| CVE-2021-42340 | The fix for bug 63362 present in Apache Tomcat 10.1.0-M1 to 10.1.0-M5, 10.0.0-M1 to 10.0.11, 9.0.40 to 9.0.53 and 8.5.60 to 8.5.71 introduced a memory leak. | HIGH 7.5EPSS 11.8% | 14 October 2021 |
| CVE-2021-33179 | The general user interface in Nagios XI versions prior to 5.8.4 is vulnerable to authenticated reflected cross-site scripting. | MEDIUM 6.1EPSS 11.7% | 14 October 2021 |
| CVE-2021-33177 | The Bulk Modifications functionality in Nagios XI versions prior to 5.8.5 is vulnerable to SQL injection. | HIGH 8.8EPSS 10.1% | 14 October 2021 |
| CVE-2021-42342 | This permits tunneling untrusted environment variables into vulnerable CGI scripts. | CRITICAL 9.8EPSS 59.5% | 14 October 2021 |
| CVE-2021-40493 | Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. | CRITICAL 9.8EPSS 50.2% | 13 October 2021 |
| CVE-2021-20131 | ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the Personalization interface. | HIGH 8.8EPSS 16.8% | 13 October 2021 |
| CVE-2021-20130 | ManageEngine ADManager Plus Build 7111 contains a post-authentication remote code execution vulnerability due to improperly validated file uploads in the PasswordExpiry interface. | HIGH 8.8EPSS 32.5% | 13 October 2021 |
| CVE-2021-20124 | Draytek VigorConnect Path Traversal Vulnerability | KEVHIGH 7.5EPSS 95.9% | 13 October 2021 |
| CVE-2021-20123 | Draytek VigorConnect Path Traversal Vulnerability | KEVHIGH 7.5EPSS 89.7% | 13 October 2021 |
| CVE-2021-41355 | .NET Core and Visual Studio Information Disclosure Vulnerability | MEDIUM 5.7EPSS 20.3% | 13 October 2021 |
| CVE-2021-40487 | Microsoft SharePoint Server Remote Code Execution Vulnerability | HIGH 8.1EPSS 48.2% | 13 October 2021 |
| CVE-2021-40449 | Microsoft Windows Win32k Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 81.9% | 13 October 2021 |
| CVE-2021-20031 | A Host Header Redirection vulnerability in SonicOS potentially allows a remote attacker to redirect firewall management users to arbitrary web domains. | EXPLOITMEDIUM 6.1EPSS 13.0% | 12 October 2021 |
| CVE-2021-42325 | Froxlor through 0.10.29.1 allows SQL injection in Database/Manager/DbManagerMySQL.php via a custom DB name. | EXPLOITCRITICAL 9.8EPSS 11.8% | 12 October 2021 |
| CVE-2021-38454 | A path traversal vulnerability in the Moxa MXview Network Management software Versions 3.x to 3.2.2 may allow an attacker to create or overwrite critical files used to execute code, such as programs or libraries. | CRITICAL 10.0EPSS 15.8% | 12 October 2021 |
| CVE-2021-33734 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). | HIGH 7.2EPSS 27.7% | 12 October 2021 |
| CVE-2021-33733 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). | HIGH 7.2EPSS 15.4% | 12 October 2021 |
| CVE-2021-33732 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). | HIGH 7.2EPSS 27.7% | 12 October 2021 |
| CVE-2021-33731 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). | HIGH 7.2EPSS 46.6% | 12 October 2021 |
| CVE-2021-33730 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP2 Update 1). | HIGH 7.2EPSS 27.7% | 12 October 2021 |
| CVE-2021-24563 | The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone… | EXPLOITMEDIUM 6.1EPSS 26.3% | 11 October 2021 |
| CVE-2021-37976 | Google Chromium Information Disclosure Vulnerability | KEVMEDIUM 6.5EPSS 19.9% | 8 October 2021 |
| CVE-2021-37975 | Google Chromium V8 Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 34.9% | 8 October 2021 |
| CVE-2021-37973 | Google Chromium Portals Use-After-Free Vulnerability | KEVCRITICAL 9.6EPSS 11.7% | 8 October 2021 |
| CVE-2021-30633 | Google Chromium Indexed DB API Use-After-Free Vulnerability | KEVCRITICAL 9.6EPSS 33.2% | 8 October 2021 |
| CVE-2021-30632 | Google Chromium V8 Out-of-Bounds Write Vulnerability | KEVHIGH 8.8EPSS 63.2% | 8 October 2021 |
| CVE-2021-30625 | Use after free in Selection API in Google Chrome prior to 93.0.4577.82 allowed a remote attacker who convinced the user the visit a malicious website to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 10.1% | 8 October 2021 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.