Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,334 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 5 November 2026
17,511 results · page 86 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2021-40379 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. rstp://.../medias2 does not require authorization. | EXPLOITHIGH 7.5EPSS 21.6% | 1 September 2021 |
| CVE-2021-40378 | An issue was discovered on Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, and TN540 devices. /cgi-bin/support/killps.cgi deletes all data from the device. | EXPLOITHIGH 8.1EPSS 15.0% | 1 September 2021 |
| CVE-2021-35218 | Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. | HIGH 8.8EPSS 76.4% | 1 September 2021 |
| CVE-2021-35216 | Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. | HIGH 8.8EPSS 81.4% | 1 September 2021 |
| CVE-2021-35215 | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. | HIGH 8.8EPSS 69.9% | 1 September 2021 |
| CVE-2021-39378 | A SQL Injection vulnerability exists in openSIS 8.0 when MySQL (MariaDB) is being used as the application database. | CRITICAL 9.8EPSS 22.7% | 1 September 2021 |
| CVE-2021-37415 | Zoho ManageEngine ServiceDesk Authentication Bypass Vulnerability | KEVCRITICAL 9.8EPSS 99.8% | 1 September 2021 |
| CVE-2021-39316 | The Zoomsounds plugin <= 6.45 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be downloaded via the `dzsap_download` action using directory traversal in the `link` parameter. | EXPLOITHIGH 7.5EPSS 65.8% | 31 August 2021 |
| CVE-2021-36356 | KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). | EXPLOITCRITICAL 9.8EPSS 54.4% | 31 August 2021 |
| CVE-2021-34646 | Versions up to, and including, 5.4.3, of the Booster for WooCommerce WordPress plugin are vulnerable to authentication bypass via the process_email_verification function due to a random token generation weakness in the reset_and_mail_activation_link… | EXPLOITCRITICAL 9.8EPSS 50.9% | 30 August 2021 |
| CVE-2021-33055 | Zoho ManageEngine ADSelfService Plus through 6102 allows unauthenticated remote code execution in non-English editions. | CRITICAL 9.8EPSS 18.1% | 30 August 2021 |
| CVE-2021-38393 | A Blind SQL injection vulnerability exists in the /DataHandler/HandlerAlarmGroup.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. | CRITICAL 9.8EPSS 18.5% | 30 August 2021 |
| CVE-2021-38390 | A Blind SQL injection vulnerability exists in the /DataHandler/HandlerEnergyType.ashx endpoint of Delta Electronics DIAEnergie Version 1.7.5 and prior. | CRITICAL 9.8EPSS 19.8% | 30 August 2021 |
| CVE-2021-32955 | Delta Electronics DIAEnergie Version 1.7.5 and prior allows unrestricted file uploads, which may allow an attacker to remotely execute code. | CRITICAL 9.8EPSS 37.3% | 30 August 2021 |
| CVE-2021-26084 | Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 30 August 2021 |
| CVE-2021-39172 | Prior to version 2.5.1, authenticated users, regardless of their privileges (User or Admin), can exploit a new line injection in the configuration edition feature (e.g. mail settings) and gain arbitrary code execution on the server. | HIGH 8.8EPSS 29.2% | 27 August 2021 |
| CVE-2021-32648 | October CMS Improper Authentication | KEVCRITICAL 9.1EPSS 91.1% | 26 August 2021 |
| CVE-2021-22242 | Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown | MEDIUM 5.4EPSS 63.6% | 25 August 2021 |
| CVE-2021-30970 | A malicious application may be able to bypass Privacy preferences. | MEDIUM 5.5EPSS 14.8% | 24 August 2021 |
| CVE-2021-30937 | A memory corruption vulnerability was addressed with improved locking. | HIGH 7.8EPSS 17.3% | 24 August 2021 |
| CVE-2021-30892 | A malicious application may be able to modify protected parts of the file system. | MEDIUM 5.5EPSS 10.3% | 24 August 2021 |
| CVE-2021-30883 | Apple Multiple Products Memory Corruption Vulnerability | KEVHIGH 7.8EPSS 14.7% | 24 August 2021 |
| CVE-2021-30860 | Apple Multiple Products Integer Overflow Vulnerability | KEVHIGH 7.8EPSS 76.0% | 24 August 2021 |
| CVE-2021-30858 | Apple iOS, iPadOS, macOS Use-After-Free Vulnerability | KEVHIGH 8.8EPSS 13.4% | 24 August 2021 |
| CVE-2021-28554 | Acrobat Reader DC versions versions 2021.001.20155 (and earlier), 2020.001.30025 (and earlier) and 2017.011.30196 (and earlier) are affected by an Out-of-bounds Read vulnerability. | HIGH 7.8EPSS 46.0% | 24 August 2021 |
| CVE-2021-3712 | If a malicious actor can cause an application to directly construct an ASN1_STRING and then process it through one of the affected OpenSSL functions then this issue could be hit. | HIGH 7.4EPSS 50.4% | 24 August 2021 |
| CVE-2021-3711 | This can lead to a buffer overflow when EVP_PKEY_decrypt() is called by the application a second time with a buffer that is too small. | CRITICAL 9.8EPSS 87.8% | 24 August 2021 |
| CVE-2021-38556 | includes/configure_client.php in RaspAP 2.6.6 allows attackers to execute commands via command injection. | HIGH 8.8EPSS 13.0% | 24 August 2021 |
| CVE-2021-37538 | Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive… | CRITICAL 9.8EPSS 74.5% | 24 August 2021 |
| CVE-2021-39608 | Remote Code Execution (RCE) vulnerabilty exists in FlatCore-CMS 2.0.7 via the upload addon plugin, which could let a remote malicious user exeuct arbitrary php code. | EXPLOITHIGH 7.2EPSS 45.9% | 23 August 2021 |
| CVE-2021-39152 | In affected versions this vulnerability may allow a remote attacker to request data from internal resources that are not publicly available only by manipulating the processed input stream with a Java runtime version 14 to 8. | HIGH 8.5EPSS 11.4% | 23 August 2021 |
| CVE-2021-39146 | In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. | HIGH 8.5EPSS 14.3% | 23 August 2021 |
| CVE-2021-39144 | XStream Remote Code Execution Vulnerability | KEVHIGH 8.5EPSS 98.1% | 23 August 2021 |
| CVE-2021-39141 | In affected versions this vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. | HIGH 8.5EPSS 16.1% | 23 August 2021 |
| CVE-2021-28640 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. | HIGH 7.3EPSS 53.4% | 20 August 2021 |
| CVE-2021-28639 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. | HIGH 7.8EPSS 66.1% | 20 August 2021 |
| CVE-2021-28635 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a use-after-free vulnerability. | HIGH 7.8EPSS 51.2% | 20 August 2021 |
| CVE-2021-36748 | A SQL Injection issue in the list controller of the Prestahome Blog (aka ph_simpleblog) module before 1.7.8 for Prestashop allows a remote attacker to extract data from the database via the sb_category parameter. | HIGH 7.5EPSS 15.4% | 20 August 2021 |
| CVE-2021-22238 | GitLab was vulnerable to a stored XSS by using the design feature in issues. | MEDIUM 5.4EPSS 71.8% | 20 August 2021 |
| CVE-2021-34228 | Cross-site scripting in parent_control.htm in TOTOLINK A3002R version V1.1.1-B20200824 (Important Update, new UI) allows attackers to execute arbitrary JavaScript by modifying the "Description" field and "Service Name" field. | MEDIUM 6.1EPSS 29.2% | 20 August 2021 |
| CVE-2021-34730 | A vulnerability in the Universal Plug-and-Play (UPnP) service of Cisco Small Business RV110W, RV130, RV130W, and RV215W Routers could allow an unauthenticated, remote attacker to execute arbitrary code or cause an affected device to restart… | CRITICAL 9.8EPSS 18.5% | 18 August 2021 |
| CVE-2021-22940 | Node.js before 16.6.1, 14.17.5, and 12.22.5 is vulnerable to a use after free attack where an attacker might be able to exploit the memory corruption, to change process behavior. | HIGH 7.5EPSS 13.9% | 16 August 2021 |
| CVE-2021-22939 | If the Node.js https API was used incorrectly and "undefined" was in passed for the "rejectUnauthorized" parameter, no error was returned and connections to servers with an expired certificate would have been accepted. | MEDIUM 5.3EPSS 14.7% | 16 August 2021 |
| CVE-2021-22931 | Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can lead to output of wrong hostnames… | CRITICAL 9.8EPSS 22.0% | 16 August 2021 |
| CVE-2021-35395 | Realtek AP-Router SDK Buffer Overflow Vulnerability | KEVCRITICAL 9.8EPSS 98.1% | 16 August 2021 |
| CVE-2021-35394 | Realtek Jungle SDK Remote Code Execution Vulnerability | KEVCRITICAL 9.8EPSS 99.9% | 16 August 2021 |
| CVE-2021-35393 | The server is vulnerable to a stack buffer overflow vulnerability that is present due to unsafe parsing of the UPnP SUBSCRIBE/UNSUBSCRIBE Callback header. | CRITICAL 9.8EPSS 66.4% | 16 August 2021 |
| CVE-2021-35392 | The server is vulnerable to a heap buffer overflow that is present due to unsafe crafting of SSDP NOTIFY messages from received M-SEARCH messages ST header. | HIGH 7.5EPSS 82.1% | 16 August 2021 |
| CVE-2021-33193 | A crafted method sent through HTTP/2 will bypass validation and be forwarded by mod_proxy, which can lead to request splitting or cache poisoning. | HIGH 7.5EPSS 46.2% | 16 August 2021 |
| CVE-2021-3708 | D-Link router DSL-2750U with firmware vME1.16 or prior versions is vulnerable to OS command injection. | HIGH 7.8EPSS 24.6% | 16 August 2021 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.