Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
419,334 CVEs1,768 in CISA KEV17,511 with EPSS ≥ 10%25,055 with a public exploitUpdated 5 November 2026
17,511 results · page 87 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2021-26086 | Atlassian Jira Server and Data Center Path Traversal Vulnerability | KEVEXPLOITMEDIUM 5.3EPSS 100.0% | 16 August 2021 |
| CVE-2021-36380 | Sunhillo SureLine OS Command Injection Vulnerablity | KEVCRITICAL 9.8EPSS 97.8% | 13 August 2021 |
| CVE-2021-37350 | Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. | CRITICAL 9.8EPSS 79.3% | 13 August 2021 |
| CVE-2021-37346 | Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection). | CRITICAL 9.8EPSS 73.6% | 13 August 2021 |
| CVE-2021-37344 | Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection). | CRITICAL 9.8EPSS 96.8% | 13 August 2021 |
| CVE-2021-37343 | A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios. | HIGH 8.8EPSS 23.8% | 13 August 2021 |
| CVE-2021-36958 | A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. | HIGH 7.8EPSS 30.8% | 12 August 2021 |
| CVE-2021-36948 | Microsoft Windows Update Medic Service Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 23.3% | 12 August 2021 |
| CVE-2021-36942 | Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability | KEVHIGH 7.5EPSS 66.0% | 12 August 2021 |
| CVE-2021-34535 | Remote Desktop Client Remote Code Execution Vulnerability | HIGH 8.8EPSS 21.9% | 12 August 2021 |
| CVE-2021-34484 | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | KEVHIGH 7.8EPSS 21.8% | 12 August 2021 |
| CVE-2021-34480 | Scripting Engine Memory Corruption Vulnerability | MEDIUM 6.8EPSS 34.2% | 12 August 2021 |
| CVE-2021-34478 | Microsoft Office Remote Code Execution Vulnerability | HIGH 7.8EPSS 51.5% | 12 August 2021 |
| CVE-2021-26432 | Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability | CRITICAL 9.8EPSS 11.4% | 12 August 2021 |
| CVE-2021-26424 | Windows TCP/IP Remote Code Execution Vulnerability | CRITICAL 9.9EPSS 61.1% | 12 August 2021 |
| CVE-2021-37425 | Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key. | EXPLOITCRITICAL 9.1EPSS 66.3% | 10 August 2021 |
| CVE-2021-37152 | Multiple XSS issues exist in Sonatype Nexus Repository Manager 3 before 3.33.0. | MEDIUM 5.4EPSS 24.4% | 10 August 2021 |
| CVE-2021-33256 | A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. | HIGH 8.8EPSS 79.0% | 9 August 2021 |
| CVE-2021-24507 | The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated… | CRITICAL 9.8EPSS 11.0% | 9 August 2021 |
| CVE-2021-24499 | The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. | EXPLOITCRITICAL 9.8EPSS 60.1% | 9 August 2021 |
| CVE-2021-35325 | A stack overflow in the checkLoginUser function of TOTOLINK A720R A720R_Firmware v4.1.5cu.470_B20200911 allows attackers to cause a denial of service (DOS). | HIGH 7.5EPSS 13.3% | 5 August 2021 |
| CVE-2021-35324 | A vulnerability in the Form_Login function of TOTOLINK A720R A720R_Firmware V4.1.5cu.470_B20200911 allows attackers to bypass authentication. | CRITICAL 9.8EPSS 10.4% | 5 August 2021 |
| CVE-2021-22926 | If the name exists as a file, it will be used instead of by name.If the appliction runs with a current working directory that is writable by other users (like `/tmp`), a malicious user can create a file name with the same name as the app wants to use by… | HIGH 7.5EPSS 15.1% | 5 August 2021 |
| CVE-2021-21805 | An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). | CRITICAL 9.8EPSS 69.8% | 5 August 2021 |
| CVE-2021-34371 | Neo4j through 3.4.18 (with the shell server enabled) exposes an RMI service that arbitrarily deserializes Java objects, e.g., through setSessionVariable. | CRITICAL 9.8EPSS 13.4% | 5 August 2021 |
| CVE-2021-20028 | SonicWall Secure Remote Access (SRA) SQL Injection Vulnerability | KEVCRITICAL 9.8EPSS 30.1% | 4 August 2021 |
| CVE-2021-32706 | Prior to Pi-hole Web interface version 5.5.1, the `validDomainWildcard` preg_match filter allows a malicious character through that can be used to execute code, list directories, and overwrite sensitive files. | HIGH 8.8EPSS 60.2% | 4 August 2021 |
| CVE-2021-34850 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. | HIGH 7.8EPSS 38.3% | 4 August 2021 |
| CVE-2021-34847 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. | HIGH 7.8EPSS 61.6% | 4 August 2021 |
| CVE-2021-34842 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. | HIGH 7.8EPSS 13.3% | 4 August 2021 |
| CVE-2021-34833 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. | HIGH 7.8EPSS 95.7% | 4 August 2021 |
| CVE-2021-32804 | The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by… | HIGH 8.1EPSS 15.1% | 3 August 2021 |
| CVE-2021-30560 | Use after free in Blink XSLT in Google Chrome prior to 91.0.4472.164 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. | HIGH 8.8EPSS 20.4% | 3 August 2021 |
| CVE-2021-37557 | A SQL injection vulnerability in image generation in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the… | HIGH 8.8EPSS 27.4% | 3 August 2021 |
| CVE-2021-37556 | A SQL injection vulnerability in reporting export in Centreon before 20.04.14, 20.10.8, and 21.04.2 allows remote authenticated (but low-privileged) attackers to execute arbitrary SQL commands via the… | HIGH 8.8EPSS 27.4% | 3 August 2021 |
| CVE-2021-31630 | Command Injection in Open PLC Webserver v3 allows remote attackers to execute arbitrary code via the "Hardware Layer Code Box" component on the "/hardware" page of the application. | HIGH 8.8EPSS 27.1% | 3 August 2021 |
| CVE-2021-26085 | Atlassian Confluence Server Pre-Authorization Arbitrary File Read Vulnerability | KEVEXPLOITMEDIUM 5.3EPSS 99.9% | 3 August 2021 |
| CVE-2021-24488 | The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues | EXPLOITMEDIUM 6.1EPSS 11.2% | 2 August 2021 |
| CVE-2021-24472 | The OnAir2 WordPress theme before 3.9.9.2 and QT KenthaRadio WordPress plugin before 2.0.2 have exposed proxy functionality to unauthenticated users, sending requests to this proxy functionality will have the web server fetch and display the content… | CRITICAL 9.8EPSS 56.6% | 2 August 2021 |
| CVE-2021-36754 | PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception. | HIGH 7.5EPSS 64.9% | 30 July 2021 |
| CVE-2021-35479 | Nagios Log Server before 2.1.9 contains Stored XSS in the custom column view for the alert history and audit log function through the affected pp parameter. | MEDIUM 5.4EPSS 13.2% | 30 July 2021 |
| CVE-2021-35478 | Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. | MEDIUM 5.4EPSS 76.6% | 30 July 2021 |
| CVE-2021-32610 | In Archive_Tar before 1.4.14, symlinks can refer to targets outside of the extracted archive, a different vulnerability than CVE-2020-36193. | HIGH 7.1EPSS 73.4% | 30 July 2021 |
| CVE-2021-28966 | In Ruby through 3.0 on Windows, a remote attacker can submit a crafted path when a Web application handles a parameter with TmpDir. | HIGH 7.5EPSS 58.0% | 30 July 2021 |
| CVE-2020-36239 | Jira Data Center, Jira Core Data Center, Jira Software Data Center from version 6.3.0 before 8.5.16, from 8.6.0 before 8.13.8, from 8.14.0 before 8.17.0 and Jira Service Management Data Center from version 2.0.2 before 4.5.16, from version 4.6.0 before… | CRITICAL 9.8EPSS 49.8% | 29 July 2021 |
| CVE-2021-32789 | An SQL injection vulnerability impacts all WooCommerce sites running the WooCommerce Blocks feature plugin between version 2.5.0 and prior to version 2.5.16. | HIGH 7.5EPSS 17.2% | 26 July 2021 |
| CVE-2020-7388 | Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. | CRITICAL 9.8EPSS 69.4% | 22 July 2021 |
| CVE-2020-7387 | Sage X3 Installation Pathname Disclosure. | MEDIUM 5.3EPSS 34.3% | 22 July 2021 |
| CVE-2021-36222 | ec_verify in kdc/kdc_preauth_ec.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.18.4 and 1.19.x before 1.19.2 allows remote attackers to cause a NULL pointer dereference and daemon crash. | HIGH 7.5EPSS 10.5% | 22 July 2021 |
| CVE-2021-35464 | ForgeRock Access Management (AM) Core Server Remote Code Execution Vulnerability | KEVEXPLOITCRITICAL 9.8EPSS 100.0% | 22 July 2021 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.