Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,918 vulnerabilities · highest exploit probability first
- CVE-2026-19478Critical 9.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user…gitlab · gitlabEPSS60%·Published Aug 17, 2026
- CVE-2026-66066Critical 9.5Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processingEPSS28%1 exploitPublished Jul 30, 2026
- CVE-2026-10523Critical 9.8An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative…ivanti · standalone sentryEPSS53%·Published Jun 9, 2026
- CVE-2026-0826Critical 9.2In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.hp inc. · poly trio 8300EPSS32%1 exploitPublished Jun 1, 2026
- CVE-2024-44000Critical 9.8LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Fileslitespeedtech · litespeed cacheEPSS82%2 exploitsPublished May 13, 2026
- CVE-2024-28000Critical 9.8LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalationlitespeedtech · litespeed cacheEPSS68%1 exploitPublished May 13, 2026
- CVE-2026-46300High 7.8kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernelEPSS2.4%2 exploitsPublished May 13, 2026
- CVE-2026-43284High 7.8kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernelEPSS94%14 exploitsPublished May 12, 2026
- CVE-2026-34413High 8.8Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to…EPSS3.1%1 exploitPublished Apr 22, 2026
- CVE-2026-34415Critical 9.3Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern.EPSS4.4%1 exploitPublished Apr 22, 2026
- CVE-2026-0740Critical 9.8Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File UploadEPSS63%1 exploitPublished Apr 7, 2026
- CVE-2026-4257Critical 9.8Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill FunctionalityEPSS33%2 exploitsPublished Mar 30, 2026
- CVE-2026-3891Critical 9.8Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File UploadEPSS30%2 exploitsPublished Mar 13, 2026
- CVE-2026-2041High 8.8Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerabilitynagios · nagios xiEPSS76%·Published Feb 20, 2026
- CVE-2026-2043High 8.8Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerabilitynagios · nagios xiEPSS75%·Published Feb 20, 2026
- CVE-2026-2329Critical 9.3Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflowgrandstream · gxp1610 firmwareEPSS42%2 exploitsPublished Feb 18, 2026
- CVE-2025-40553Critical 9.8SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine.solarwinds · web help deskEPSS68%·Published Feb 9, 2026
- CVE-2025-40554Critical 9.8SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.solarwinds · web help deskEPSS61%·Published Feb 9, 2026
- CVE-2025-40552Critical 9.8SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.solarwinds · web help deskEPSS52%·Published Feb 9, 2026
- CVE-2025-15467High 8.8openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsingopenssl · opensslEPSS52%1 exploitPublished Jan 27, 2026
- CVE-2026-0769Critical 9.8Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerabilitylangflow · langflowEPSS42%1 exploitPublished Jan 23, 2026
- CVE-2026-0768Critical 9.8Langflow code Code Injection Remote Code Execution Vulnerabilitylangflow · langflowEPSS23%1 exploitPublished Jan 23, 2026
- CVE-2026-23744Critical 9.8REC in MCPJam inspector due to HTTP Endpoint exposesmcpjam · inspectorEPSS68%2 exploitsPublished Jan 16, 2026
- CVE-2025-12420Critical 9.3A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.servicenow · now assist ai agentsEPSS53%·Published Jan 12, 2026
- CVE-2026-22200High 8.7osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Readenhancesoft · osticketEPSS74%·Published Jan 12, 2026
- CVE-2026-21858Critical 10.0n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handlingn8n · n8nEPSS78%·Published Jan 7, 2026
- CVE-2025-55184High 7.5Denial of Service Vulnerability in React Server Componentsfacebook · reactEPSS67%Ransomware1 actorPublished Dec 11, 2025
- CVE-2025-55183Medium 5.3Source Code Exposure Vulnerability in React Server Componentsfacebook · reactEPSS64%Ransomware1 actorPublished Dec 11, 2025
- CVE-2025-13486Critical 9.8Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formEPSS68%1 exploitPublished Dec 5, 2025
- CVE-2025-66516Critical 10.0Apache Tika has XXE vulnerabilityapache · tikaEPSS89%·Published Dec 4, 2025
- CVE-2025-6389Critical 9.8Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callbackEPSS76%·Published Nov 25, 2025
- CVE-2025-34299Critical 9.3Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads.monstaftp · monsta ftpEPSS73%1 exploitPublished Nov 7, 2025
- CVE-2025-11749Critical 9.8AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege EscalationEPSS75%1 exploitPublished Nov 5, 2025
- CVE-2025-11833Critical 9.8Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log DisclosureEPSS61%·Published Nov 3, 2025
- CVE-2025-55752High 7.7Apache Tomcat Vulnerable to Relative Path Traversalapache · tomcatEPSS64%·Published Oct 27, 2025
- CVE-2025-62168High 7.5In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure.squid-cache · squidEPSS63%·Published Oct 17, 2025
- CVE-2025-55315Critical 9.9Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerabilitymicrosoft · asp.net coreEPSS66%1 exploitPublished Oct 15, 2025
- CVE-2025-61678High 8.6In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter.EPSS44%1 exploitPublished Oct 14, 2025
- CVE-2025-61675High 8.6In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration…EPSS38%1 exploitPublished Oct 14, 2025
- CVE-2025-49844Critical 9.9Redis: Redis Lua Use-After-Free may lead to remote code executionredis · redisEPSS82%·Published Oct 6, 2025
- CVE-2025-59528Critical 10.0Flowise has Remote Code Execution vulnerabilityflowiseai · flowiseEPSS86%2 exploitsPublished Sep 15, 2025
- CVE-2025-9528Low 2.0A vulnerability was determined in Linksys E1700 1.0.0.4.003.linksys · e1700 firmwareEPSS54%2 exploitsPublished Aug 27, 2025
- CVE-2025-9491Medium 4.6Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability.microsoft · windows 11 23h2EPSS73%·Published Aug 26, 2025
- CVE-2025-57791Medium 6.9A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation.commvault · commvaultEPSS34%1 exploitPublished Aug 20, 2025
- CVE-2025-57790High 8.7A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue.commvault · commvaultEPSS27%1 exploitPublished Aug 20, 2025
- CVE-2025-7441Critical 9.8StoryChief <= 1.0.42 - Unauthenticated Arbitrary File UploadEPSS50%2 exploitsPublished Aug 18, 2025
- CVE-2025-8943Critical 9.8Flowise OS command remote code executionflowiseai · flowiseEPSS75%1 exploitPublished Aug 14, 2025
- CVE-2025-25256Critical 9.8An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and…fortinet · fortisiemEPSS65%Ransomware1 actorPublished Aug 12, 2025
- CVE-2025-53778High 8.8Windows NTLM Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507EPSS51%·Published Aug 12, 2025
- CVE-2024-32640Critical 9.8Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the processAsyncObject method that can result in remote code execution.EPSS77%·Published Aug 11, 2025
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19478 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user… gitlab · gitlab | Critical 9.1 | 60% | · | |
| CVE-2026-66066 | Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing | Critical 9.5 | 28% | 1 exploit | |
| CVE-2026-10523 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative… ivanti · standalone sentry | Critical 9.8 | 53% | · | |
| CVE-2026-0826 | In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform. hp inc. · poly trio 8300 | Critical 9.2 | 32% | 1 exploit | |
| CVE-2024-44000 | LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Files litespeedtech · litespeed cache | Critical 9.8 | 82% | 2 exploits | |
| CVE-2024-28000 | LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation litespeedtech · litespeed cache | Critical 9.8 | 68% | 1 exploit | |
| CVE-2026-46300 | kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel | High 7.8 | 2.4% | 2 exploits | |
| CVE-2026-43284 | kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel | High 7.8 | 94% | 14 exploits | |
| CVE-2026-34413 | Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to… | High 8.8 | 3.1% | 1 exploit | |
| CVE-2026-34415 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. | Critical 9.3 | 4.4% | 1 exploit | |
| CVE-2026-0740 | Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 63% | 1 exploit | |
| CVE-2026-4257 | Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality | Critical 9.8 | 33% | 2 exploits | |
| CVE-2026-3891 | Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 30% | 2 exploits | |
| CVE-2026-2041 | Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability nagios · nagios xi | High 8.8 | 76% | · | |
| CVE-2026-2043 | Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability nagios · nagios xi | High 8.8 | 75% | · | |
| CVE-2026-2329 | Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow grandstream · gxp1610 firmware | Critical 9.3 | 42% | 2 exploits | |
| CVE-2025-40553 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. solarwinds · web help desk | Critical 9.8 | 68% | · | |
| CVE-2025-40554 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk. solarwinds · web help desk | Critical 9.8 | 61% | · | |
| CVE-2025-40552 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication. solarwinds · web help desk | Critical 9.8 | 52% | · | |
| CVE-2025-15467 | openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing openssl · openssl | High 8.8 | 52% | 1 exploit | |
| CVE-2026-0769 | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability langflow · langflow | Critical 9.8 | 42% | 1 exploit | |
| CVE-2026-0768 | Langflow code Code Injection Remote Code Execution Vulnerability langflow · langflow | Critical 9.8 | 23% | 1 exploit | |
| CVE-2026-23744 | REC in MCPJam inspector due to HTTP Endpoint exposes mcpjam · inspector | Critical 9.8 | 68% | 2 exploits | |
| CVE-2025-12420 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. servicenow · now assist ai agents | Critical 9.3 | 53% | · | |
| CVE-2026-22200 | osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read enhancesoft · osticket | High 8.7 | 74% | · | |
| CVE-2026-21858 | n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling n8n · n8n | Critical 10.0 | 78% | · | |
| CVE-2025-55184 | Denial of Service Vulnerability in React Server Components facebook · react | High 7.5 | 67% | Ransomware1 actor | |
| CVE-2025-55183 | Source Code Exposure Vulnerability in React Server Components facebook · react | Medium 5.3 | 64% | Ransomware1 actor | |
| CVE-2025-13486 | Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form | Critical 9.8 | 68% | 1 exploit | |
| CVE-2025-66516 | Apache Tika has XXE vulnerability apache · tika | Critical 10.0 | 89% | · | |
| CVE-2025-6389 | Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback | Critical 9.8 | 76% | · | |
| CVE-2025-34299 | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. monstaftp · monsta ftp | Critical 9.3 | 73% | 1 exploit | |
| CVE-2025-11749 | AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation | Critical 9.8 | 75% | 1 exploit | |
| CVE-2025-11833 | Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure | Critical 9.8 | 61% | · | |
| CVE-2025-55752 | Apache Tomcat Vulnerable to Relative Path Traversal apache · tomcat | High 7.7 | 64% | · | |
| CVE-2025-62168 | In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. squid-cache · squid | High 7.5 | 63% | · | |
| CVE-2025-55315 | Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability microsoft · asp.net core | Critical 9.9 | 66% | 1 exploit | |
| CVE-2025-61678 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. | High 8.6 | 44% | 1 exploit | |
| CVE-2025-61675 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration… | High 8.6 | 38% | 1 exploit | |
| CVE-2025-49844 | Redis: Redis Lua Use-After-Free may lead to remote code execution redis · redis | Critical 9.9 | 82% | · | |
| CVE-2025-59528 | Flowise has Remote Code Execution vulnerability flowiseai · flowise | Critical 10.0 | 86% | 2 exploits | |
| CVE-2025-9528 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. linksys · e1700 firmware | Low 2.0 | 54% | 2 exploits | |
| CVE-2025-9491 | Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. microsoft · windows 11 23h2 | Medium 4.6 | 73% | · | |
| CVE-2025-57791 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. commvault · commvault | Medium 6.9 | 34% | 1 exploit | |
| CVE-2025-57790 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. commvault · commvault | High 8.7 | 27% | 1 exploit | |
| CVE-2025-7441 | StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 50% | 2 exploits | |
| CVE-2025-8943 | Flowise OS command remote code execution flowiseai · flowise | Critical 9.8 | 75% | 1 exploit | |
| CVE-2025-25256 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and… fortinet · fortisiem | Critical 9.8 | 65% | Ransomware1 actor | |
| CVE-2025-53778 | Windows NTLM Elevation of Privilege Vulnerability microsoft · windows 10 1507 | High 8.8 | 51% | · | |
| CVE-2024-32640 | Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the processAsyncObject method that can result in remote code execution. | Critical 9.8 | 77% | · |
Showing 1–50 of 3,918
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.