Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,334 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 5 November 2026
17,511 results · page 85 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2021-38406 | Delta Electronics DOPSoft 2 Improper Input Validation Vulnerability | KEVHIGH 7.8EPSS 76.4% | 17 September 2021 |
| CVE-2021-39327 | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of… | EXPLOITMEDIUM 5.3EPSS 71.7% | 17 September 2021 |
| CVE-2021-41303 | Apache Shiro before 1.8.0, when using Apache Shiro with Spring Boot, a specially crafted HTTP request may cause an authentication bypass. | CRITICAL 9.8EPSS 76.1% | 17 September 2021 |
| CVE-2021-41314 | Certain NETGEAR smart switches are affected by a \n injection in the web UI's password field, which - due to several faulty aspects of the authentication scheme - allows the attacker to create (or overwrite) a file with specific content (e.g., the "2"… | HIGH 8.8EPSS 13.6% | 16 September 2021 |
| CVE-2021-40438 | Apache HTTP Server-Side Request Forgery (SSRF) | KEVCRITICAL 9.0EPSS 100.0% | 16 September 2021 |
| CVE-2021-39275 | ap_escape_quotes() may write beyond the end of a buffer when given malicious input. | CRITICAL 9.8EPSS 39.4% | 16 September 2021 |
| CVE-2021-36160 | A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). | HIGH 7.5EPSS 62.9% | 16 September 2021 |
| CVE-2021-34798 | Malformed requests may cause the server to dereference a NULL pointer. | HIGH 7.5EPSS 64.5% | 16 September 2021 |
| CVE-2021-33045 | Dahua IP Camera Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 99.6% | 15 September 2021 |
| CVE-2021-33044 | Dahua IP Camera Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 100.0% | 15 September 2021 |
| CVE-2021-33690 | Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service… | CRITICAL 9.9EPSS 69.1% | 15 September 2021 |
| CVE-2021-38156 | In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. | MEDIUM 5.4EPSS 92.9% | 15 September 2021 |
| CVE-2021-21798 | An exploitable return of stack variable address vulnerability exists in the JavaScript implementation of Nitro Pro PDF. | HIGH 7.8EPSS 21.4% | 15 September 2021 |
| CVE-2021-40444 | Microsoft MSHTML Remote Code Execution Vulnerability | KEVHIGH 8.8EPSS 97.8% | 15 September 2021 |
| CVE-2021-38648 | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 11.4% | 15 September 2021 |
| CVE-2021-38647 | Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | KEVCRITICAL 9.8EPSS 99.9% | 15 September 2021 |
| CVE-2021-36952 | Visual Studio Remote Code Execution Vulnerability | HIGH 7.8EPSS 51.5% | 15 September 2021 |
| CVE-2021-38163 | SAP NetWeaver Unrestricted File Upload Vulnerability | KEVHIGH 8.8EPSS 36.9% | 14 September 2021 |
| CVE-2021-37200 | A vulnerability has been identified in SINEC NMS (All versions < V1.0 SP1). | HIGH 7.7EPSS 37.4% | 14 September 2021 |
| CVE-2021-33554 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. | HIGH 7.2EPSS 59.2% | 13 September 2021 |
| CVE-2021-33553 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. | HIGH 7.2EPSS 51.0% | 13 September 2021 |
| CVE-2021-33552 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. | HIGH 7.2EPSS 51.0% | 13 September 2021 |
| CVE-2021-33551 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. | HIGH 7.2EPSS 51.0% | 13 September 2021 |
| CVE-2021-33550 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. | HIGH 7.2EPSS 59.2% | 13 September 2021 |
| CVE-2021-33549 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code. | HIGH 7.2EPSS 67.3% | 13 September 2021 |
| CVE-2021-33548 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. | HIGH 7.2EPSS 59.2% | 13 September 2021 |
| CVE-2021-33544 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. | HIGH 7.2EPSS 95.8% | 13 September 2021 |
| CVE-2021-33543 | Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. | CRITICAL 9.8EPSS 81.3% | 13 September 2021 |
| CVE-2021-40870 | Aviatrix Controller Unrestricted Upload of File | KEVCRITICAL 9.8EPSS 93.0% | 13 September 2021 |
| CVE-2021-24040 | Due to use of unsafe YAML deserialization logic, an attacker with the ability to modify local YAML configuration files could provide malicious input, resulting in remote code execution or similar risks. | EXPLOITCRITICAL 9.8EPSS 17.4% | 10 September 2021 |
| CVE-2021-38540 | This allowed unauthenticated users to hit that endpoint to add/modify Airflow variables used in DAGs, potentially resulting in a denial of service, information disclosure or remote code execution. | CRITICAL 9.8EPSS 80.9% | 9 September 2021 |
| CVE-2021-38408 | A stack-based buffer overflow vulnerability in Advantech WebAccess Versions 9.02 and prior caused by a lack of proper validation of the length of user-supplied data may allow remote code execution. | CRITICAL 9.8EPSS 11.6% | 9 September 2021 |
| CVE-2021-40346 | An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs. | HIGH 7.5EPSS 58.8% | 8 September 2021 |
| CVE-2021-30657 | Apple macOS Unspecified Vulnerability | KEVMEDIUM 5.5EPSS 68.5% | 8 September 2021 |
| CVE-2021-35217 | Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. | HIGH 8.8EPSS 72.8% | 8 September 2021 |
| CVE-2021-30762 | Apple iOS WebKit Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 11.0% | 8 September 2021 |
| CVE-2021-30761 | Apple iOS WebKit Memory Corruption Vulnerability | KEVHIGH 8.8EPSS 10.5% | 8 September 2021 |
| CVE-2021-30721 | An attacker in a privileged network position may be able to leak sensitive user information. | MEDIUM 6.5EPSS 24.3% | 8 September 2021 |
| CVE-2020-11301 | Improper authentication of un-encrypted plaintext Wi-Fi frames in an encrypted network can lead to information disclosure in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer… | HIGH 7.5EPSS 11.1% | 8 September 2021 |
| CVE-2020-11264 | Improper authentication of Non-EAPOL/WAPI plaintext frames during four-way handshake can lead to arbitrary network packet injection in Snapdragon Auto, Snapdragon Compute, Snapdragon Connectivity, Snapdragon Consumer Electronics Connectivity, Snapdragon… | CRITICAL 9.8EPSS 13.2% | 8 September 2021 |
| CVE-2021-40539 | Zoho ManageEngine ADSelfService Plus Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 99.0% | 7 September 2021 |
| CVE-2021-40531 | Sketch before 75 allows library feeds to be used to bypass file quarantine. | CRITICAL 9.8EPSS 33.0% | 6 September 2021 |
| CVE-2021-38314 | The Gutenberg Template Library & Redux Framework plugin <= 4.2.11 for WordPress registered several AJAX actions available to unauthenticated users in the `includes` function in `redux-core/class-redux-core.php` that were unique to a given site but… | MEDIUM 5.3EPSS 29.0% | 2 September 2021 |
| CVE-2021-28560 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability. | HIGH 8.8EPSS 66.9% | 2 September 2021 |
| CVE-2021-28558 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by an Heap-based buffer overflow vulnerability in the PDFLibTool component. | HIGH 8.8EPSS 10.4% | 2 September 2021 |
| CVE-2021-28550 | Adobe Acrobat and Reader Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 52.1% | 2 September 2021 |
| CVE-2021-34746 | A vulnerability in the TACACS+ authentication, authorization and accounting (AAA) feature of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to bypass authentication and log in to an affected device… | CRITICAL 9.8EPSS 17.7% | 2 September 2021 |
| CVE-2021-40382 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. mjpegStreamer.cgi allows video screenshot access. | EXPLOITHIGH 7.5EPSS 22.7% | 1 September 2021 |
| CVE-2021-40381 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. index_MJpeg.cgi allows video access. | EXPLOITHIGH 7.5EPSS 22.7% | 1 September 2021 |
| CVE-2021-40380 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. cameralist.cgi and setcamera.cgi disclose credentials. | EXPLOITHIGH 7.5EPSS 22.7% | 1 September 2021 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.