Tools / CVE Explorer
Which vulnerabilities actually matter?
Every CVE with its CVSS severity, EPSS probability of exploitation and CISA KEV status side by side, refreshed daily from NVD, FIRST and CISA — plus a plain-English verdict on whether it needs an emergency change or the normal patch cycle.
The year’s CVE activity with KEV, EPSS and exploit data as a PDF: heatmaps, a vendor treemap, and the lists worth checking against your estate.
CVE Watchlist →Your products only, as a page, feed or emailThis week in CVEs →New by severity, KEV additions, EPSS jumpsKEV deadline calendar →CISA due dates, with an .ics feed
417,623 CVEs1,766 in CISA KEV17,506 with EPSS ≥ 10%25,055 with a public exploitUpdated 1 November 2026
17,506 results · page 9 of 351
| CVE | Summary | Priority | Published |
|---|---|---|---|
| CVE-2025-55182 | Meta React Server Components Remote Code Execution Vulnerability | KEVEXPLOITCRITICAL 10.0EPSS 99.8% | 3 December 2025 |
| CVE-2025-13486 | The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Remote Code Execution in versions 0.9.0.5 through 0.9.1.1 via the prepare_form() function. | CRITICAL 9.8EPSS 67.6% | 3 December 2025 |
| CVE-2025-66399 | In environments where downstream SNMP tooling or wrappers interpret newline-separated tokens as command boundaries, this can lead to unintended command execution with the privileges of the Cacti process. | HIGH 7.4EPSS 10.8% | 2 December 2025 |
| CVE-2025-62593 | Ray-Project Ray Code Injection Vulnerability | KEVCRITICAL 9.4EPSS 60.2% | 26 November 2025 |
| CVE-2025-58360 | OSGeo GeoServer Improper Restriction of XML External Entity Reference Vulnerability | KEVCRITICAL 9.8EPSS 61.2% | 25 November 2025 |
| CVE-2025-59366 | An authentication-bypass vulnerability exists in AiCloud. | CRITICAL 9.2EPSS 12.5% | 25 November 2025 |
| CVE-2025-6389 | The Sneeit Framework plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 8.3 via the sneeit_articles_pagination_callback() function. | CRITICAL 9.8EPSS 76.2% | 25 November 2025 |
| CVE-2025-41115 | In Grafana versions 12.x where SCIM provisioning is enabled and configured, a vulnerability in user identity handling allows a malicious or compromised SCIM client to provision a user with a numeric externalId, which in turn could allow to override… | CRITICAL 9.8EPSS 17.5% | 21 November 2025 |
| CVE-2025-13442 | A security vulnerability has been detected in UTT 进取 750W up to 3.2.2-191225. | MEDIUM 5.5EPSS 19.5% | 20 November 2025 |
| CVE-2025-11001 | 7-Zip ZIP File Parsing Directory Traversal Remote Code Execution Vulnerability. | EXPLOITHIGH 7.8EPSS 27.4% | 19 November 2025 |
| CVE-2025-13315 | Twonky Server 8.5.2 on Linux and Windows is vulnerable to an access control flaw. | CRITICAL 9.3EPSS 31.2% | 19 November 2025 |
| CVE-2025-64408 | Apache Causeway faces Java deserialization vulnerabilities that allow remote code execution (RCE) through user-controllable URL parameters. | MEDIUM 6.3EPSS 11.6% | 19 November 2025 |
| CVE-2025-58034 | Fortinet FortiWeb OS Command Injection Vulnerability | KEVHIGH 7.2EPSS 54.7% | 18 November 2025 |
| CVE-2025-9501 | The W3 Total Cache WordPress plugin before 2.8.13 is vulnerable to command injection via the _parse_dynamic_mfunc function, allowing unauthenticated users to execute PHP commands by submitting a comment with a malicious payload to a post. | CRITICAL 9.0EPSS 22.1% | 17 November 2025 |
| CVE-2025-64446 | Fortinet FortiWeb Path Traversal Vulnerability | KEVEXPLOIT ×2CRITICAL 9.8EPSS 91.1% | 14 November 2025 |
| CVE-2025-60689 | An unauthenticated command injection vulnerability exists in the Start_EPI function of the httpd binary on Linksys E1200 v2 routers (Firmware E1200_v2.0.11.001_us.tar.gz). | EXPLOITMEDIUM 5.4EPSS 18.3% | 13 November 2025 |
| CVE-2025-12762 | pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. | CRITICAL 9.8EPSS 12.7% | 13 November 2025 |
| CVE-2025-9316 | N-central < 2025.4 can generate sessionIDs for unauthenticated users This issue affects N-central: before 2025.4. | MEDIUM 6.9EPSS 37.4% | 12 November 2025 |
| CVE-2025-11700 | N-central versions < 2025.4 are vulnerable to multiple XML External Entities injection leading to information disclosure | HIGH 8.4EPSS 31.7% | 12 November 2025 |
| CVE-2025-12101 | Cross-Site Scripting (XSS) in NetScaler ADC and NetScaler Gateway when the appliance is configured as a Gateway (VPN virtual server, ICA Proxy, CVPN, RDP Proxy) OR AAA virtual server | MEDIUM 5.9EPSS 26.3% | 11 November 2025 |
| CVE-2025-12480 | Gladinet Triofox Improper Access Control Vulnerability | KEVCRITICAL 9.1EPSS 95.7% | 10 November 2025 |
| CVE-2025-10230 | Unsanitized NetBIOS name data from WINS registration packets are inserted into a shell command and executed by the Samba Active Directory Domain Controller’s wins hook, allowing an unauthenticated network attacker to achieve remote command execution as… | CRITICAL 10.0EPSS 39.8% | 7 November 2025 |
| CVE-2025-34299 | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. | CRITICAL 9.3EPSS 72.7% | 7 November 2025 |
| CVE-2025-64328 | Sangoma FreePBX OS Command Injection Vulnerability | KEVHIGH 8.6EPSS 84.6% | 7 November 2025 |
| CVE-2025-12490 | Netgate pfSense CE Suricata Path Traversal Remote Code Execution Vulnerability. | HIGH 8.8EPSS 17.0% | 6 November 2025 |
| CVE-2025-64459 | The methods `QuerySet.filter()`, `QuerySet.exclude()`, and `QuerySet.get()`, and the class `Q()`, are subject to SQL injection when using a suitably crafted dictionary, with dictionary expansion, as the `_connector` argument. | EXPLOITCRITICAL 9.1EPSS 19.3% | 5 November 2025 |
| CVE-2025-11749 | The AI Engine plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 via the /mcp/v1/ REST API endpoint that exposes the 'Bearer Token' value when 'No-Auth URL' is enabled. | CRITICAL 9.8EPSS 74.7% | 5 November 2025 |
| CVE-2025-12197 | The The Events Calendar plugin for WordPress is vulnerable to blind SQL Injection via the 's' parameter in versions 6.15.1.1 to 6.15.9 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL… | HIGH 7.5EPSS 18.2% | 5 November 2025 |
| CVE-2025-11953 | React Native Community CLI OS Command Injection Vulnerability | KEVCRITICAL 9.8EPSS 94.0% | 3 November 2025 |
| CVE-2025-11833 | The Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the __construct function in all versions up to, and including, 3.6.0. | CRITICAL 9.8EPSS 61.5% | 1 November 2025 |
| CVE-2025-52665 | A malicious actor with access to the management network could exploit a misconfiguration in UniFi’s door access application, UniFi Access, that exposed a management API without proper authentication. | CRITICAL 10.0EPSS 41.1% | 31 October 2025 |
| CVE-2025-11201 | MLflow Tracking Server Model Creation Directory Traversal Remote Code Execution Vulnerability. | CRITICAL 9.8EPSS 26.3% | 29 October 2025 |
| CVE-2025-64095 | Prior to 10.1.1, the default HTML editor provider allows unauthenticated file uploads and images can overwrite existing files. | CRITICAL 9.8EPSS 47.0% | 28 October 2025 |
| CVE-2025-34311 | IPFire versions prior to 2.29 (Core Update 198) contain a command injection vulnerability that allows an authenticated attacker to execute arbitrary commands as the user 'nobody' via multiple parameters when creating a Proxy report. | HIGH 8.7EPSS 13.5% | 28 October 2025 |
| CVE-2025-62725 | Docker Compose trusts the path information embedded in remote OCI compose artifacts. | HIGH 8.9EPSS 13.7% | 27 October 2025 |
| CVE-2025-55754 | Improper Neutralization of Escape, Meta, or Control Sequences vulnerability in Apache Tomcat. | CRITICAL 9.6EPSS 10.2% | 27 October 2025 |
| CVE-2025-55752 | Relative Path Traversal vulnerability in Apache Tomcat. | HIGH 7.5EPSS 64.4% | 27 October 2025 |
| CVE-2025-27225 | TRUfusion Enterprise through 7.10.4.0 exposes the /trufusionPortal/jsp/internal_admin_contact_login.jsp endpoint to unauthenticated users. | HIGH 7.5EPSS 18.4% | 27 October 2025 |
| CVE-2025-6440 | The WooCommerce Designer Pro plugin for WordPress, used by the Pricom - Printing Company & Design Services WordPress theme, is vulnerable to arbitrary file uploads due to missing file type validation in the 'wcdp_save_canvas_design_ajax' function in all… | CRITICAL 9.8EPSS 33.3% | 24 October 2025 |
| CVE-2025-6978 | Diagnostics command injection vulnerability | HIGH 7.2EPSS 13.4% | 23 October 2025 |
| CVE-2025-8677 | Querying for records within a specially crafted zone containing certain malformed DNSKEY records can lead to CPU exhaustion. | HIGH 7.5EPSS 10.7% | 22 October 2025 |
| CVE-2024-58274 | Hikvision CSMP (Comprehensive Security Management Platform) iSecure Center through 2024-08-01 allows execution of a command within $( ) in /center/api/installation/detection JSON data, as exploited in the wild in 2024 and 2025. | HIGH 8.3EPSS 17.4% | 22 October 2025 |
| CVE-2025-61757 | Oracle Fusion Middleware Missing Authentication for Critical Function Vulnerability | KEVCRITICAL 9.8EPSS 88.6% | 21 October 2025 |
| CVE-2025-60344 | A path traversal (directory traversal) vulnerability in D-Link DSR series routers allows unauthenticated remote attackers to manipulate input parameters used for file or directory path resolution (e.g., via sequences such as “../”). | HIGH 8.6EPSS 10.9% | 21 October 2025 |
| CVE-2025-9428 | Zohocorp ManageEngine Analytics Plus versions 6171 and prior are vulnerable to authenticated SQL Injection via the key update api. | HIGH 8.8EPSS 27.4% | 21 October 2025 |
| CVE-2025-57738 | Apache Syncope offers the ability to extend / customize the base behavior on every deployment by allowing to provide custom implementations of a few Java interfaces; such implementations can be provided either as Java or Groovy classes, with the latter… | HIGH 7.2EPSS 23.2% | 20 October 2025 |
| CVE-2025-62168 | In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. | HIGH 7.5EPSS 63.4% | 17 October 2025 |
| CVE-2025-62411 | LibreNMS <= 25.8.0 contains a Stored Cross-Site Scripting (XSS) vulnerability in the Alert Transports management functionality. | MEDIUM 4.8EPSS 12.7% | 16 October 2025 |
| CVE-2025-61678 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. | HIGH 8.6EPSS 44.0% | 14 October 2025 |
| CVE-2025-61675 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom… | HIGH 8.6EPSS 38.8% | 14 October 2025 |
How to read this
CVSS measures how bad a vulnerability could be if exploited. EPSS (from FIRST) estimates the probability it will actually be exploited in the next thirty days. KEV is CISA’s list of vulnerabilities that are being exploited right now. EXPLOIT means a working exploit is published in Exploit-DB, so the technical barrier is gone. Patch KEV entries first, then anything with a public exploit or an EPSS above 10 per cent, then work down by CVSS in your normal cycle.
Data is refreshed daily from the NVD, FIRST EPSS, the CISA KEV catalogue and the Exploit-DB repository. Every record can be downloaded as JSON from its page. Our SOC uses the same table to prioritise patching for clients; the verdict on each page is the rule of thumb our analysts apply.