Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
2,493 vulnerabilities · highest exploit probability first
- CVE-2026-66066Critical 9.5Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processingEPSS28%1 exploitPublished Jul 30, 2026
- CVE-2026-0826Critical 9.2In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.hp inc. · poly trio 8300EPSS32%1 exploitPublished Jun 1, 2026
- CVE-2024-44000Critical 9.8LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Fileslitespeedtech · litespeed cacheEPSS82%2 exploitsPublished May 13, 2026
- CVE-2024-28000Critical 9.8LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalationlitespeedtech · litespeed cacheEPSS68%1 exploitPublished May 13, 2026
- CVE-2026-46300High 7.8kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernelEPSS2.4%2 exploitsPublished May 13, 2026
- CVE-2026-43284High 7.8kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernelEPSS94%14 exploitsPublished May 12, 2026
- CVE-2026-34413High 8.8Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to…EPSS3.1%1 exploitPublished Apr 22, 2026
- CVE-2026-34415Critical 9.3Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern.EPSS4.4%1 exploitPublished Apr 22, 2026
- CVE-2026-0740Critical 9.8Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File UploadEPSS63%1 exploitPublished Apr 7, 2026
- CVE-2026-4257Critical 9.8Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill FunctionalityEPSS33%2 exploitsPublished Mar 30, 2026
- CVE-2026-3891Critical 9.8Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File UploadEPSS30%2 exploitsPublished Mar 13, 2026
- CVE-2026-2329Critical 9.3Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflowgrandstream · gxp1610 firmwareEPSS42%2 exploitsPublished Feb 18, 2026
- CVE-2025-15467High 8.8openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsingopenssl · opensslEPSS52%1 exploitPublished Jan 27, 2026
- CVE-2026-0769Critical 9.8Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerabilitylangflow · langflowEPSS42%1 exploitPublished Jan 23, 2026
- CVE-2026-0768Critical 9.8Langflow code Code Injection Remote Code Execution Vulnerabilitylangflow · langflowEPSS23%1 exploitPublished Jan 23, 2026
- CVE-2026-23744Critical 9.8REC in MCPJam inspector due to HTTP Endpoint exposesmcpjam · inspectorEPSS68%2 exploitsPublished Jan 16, 2026
- CVE-2025-13486Critical 9.8Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formEPSS68%1 exploitPublished Dec 5, 2025
- CVE-2025-34299Critical 9.3Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads.monstaftp · monsta ftpEPSS73%1 exploitPublished Nov 7, 2025
- CVE-2025-11749Critical 9.8AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege EscalationEPSS75%1 exploitPublished Nov 5, 2025
- CVE-2025-55315Critical 9.9Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerabilitymicrosoft · asp.net coreEPSS66%1 exploitPublished Oct 15, 2025
- CVE-2025-61678High 8.6In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter.EPSS44%1 exploitPublished Oct 14, 2025
- CVE-2025-61675High 8.6In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration…EPSS38%1 exploitPublished Oct 14, 2025
- CVE-2025-59528Critical 10.0Flowise has Remote Code Execution vulnerabilityflowiseai · flowiseEPSS86%2 exploitsPublished Sep 15, 2025
- CVE-2025-9528Low 2.0A vulnerability was determined in Linksys E1700 1.0.0.4.003.linksys · e1700 firmwareEPSS54%2 exploitsPublished Aug 27, 2025
- CVE-2025-57791Medium 6.9A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation.commvault · commvaultEPSS34%1 exploitPublished Aug 20, 2025
- CVE-2025-57790High 8.7A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue.commvault · commvaultEPSS27%1 exploitPublished Aug 20, 2025
- CVE-2025-7441Critical 9.8StoryChief <= 1.0.42 - Unauthenticated Arbitrary File UploadEPSS50%2 exploitsPublished Aug 18, 2025
- CVE-2025-8943Critical 9.8Flowise OS command remote code executionflowiseai · flowiseEPSS75%1 exploitPublished Aug 14, 2025
- CVE-2025-34152Critical 9.4An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint.EPSS87%1 exploitPublished Aug 7, 2025
- CVE-2013-10059High 8.6An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint.dlink · dir-615h firmwareEPSS27%3 exploitsPublished Aug 1, 2025
- CVE-2019-25224Critical 9.8WP Database Backup < 5.2 - Unauthenticated OS Command Injectionwpseeds · wp database backupEPSS22%1 exploitPublished Jul 25, 2025
- CVE-2025-32429Critical 9.3XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterxwiki · xwikiEPSS88%1 exploitPublished Jul 24, 2025
- CVE-2025-34117Critical 9.3A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413.EPSS21%1 exploitPublished Jul 16, 2025
- CVE-2025-34300Critical 10.0A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application.EPSS81%1 exploitPublished Jul 16, 2025
- CVE-2025-6965High 7.2There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available.sqlite · sqliteEPSS73%1 exploitPublished Jul 15, 2025
- CVE-2020-36847Critical 9.8The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension.simplefilelist · simple file listEPSS44%3 exploitsPublished Jul 12, 2025
- CVE-2013-3307High 8.3Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.EPSS63%1 exploitPublished Jul 11, 2025
- CVE-2025-53771Medium 6.5Microsoft SharePoint Server Spoofing Vulnerabilitymicrosoft · sharepoint serverEPSS100%Ransomware1 exploit8 actorsPublished Jul 8, 2025
- CVE-2025-5961High 7.2The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.wpvivid · migration\, backup\, stagingEPSS55%1 exploitPublished Jul 3, 2025
- CVE-2025-5306High 7.0Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.artica · pandora fmsEPSS36%1 exploitPublished Jun 27, 2025
- CVE-2025-34037Critical 10.0An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080.EPSS93%1 exploitPublished Jun 23, 2025
- CVE-2025-49132Critical 10.0Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionEPSS54%2 exploitsPublished Jun 19, 2025
- CVE-2025-34511High 8.8Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue.sitecore · experience managerEPSS30%1 exploitPublished Jun 17, 2025
- CVE-2025-34510High 8.8Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability.sitecore · experience commerceEPSS24%1 exploitPublished Jun 17, 2025
- CVE-2025-34509High 7.5Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev.sitecore · experience managerEPSS56%2 exploitsPublished Jun 17, 2025
- CVE-2025-49619High 8.5Skyvern has a Jinja runtime leakEPSS20%1 exploitPublished Jun 7, 2025
- CVE-2025-44148Critical 9.8Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx componentmailenable · mailenableEPSS55%1 exploitPublished Jun 3, 2025
- CVE-2025-48828High 8.1Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.vbulletin · vbulletinEPSS58%1 exploitPublished May 27, 2025
- CVE-2025-48827Critical 9.8vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.vbulletin · vbulletinEPSS76%1 exploitPublished May 27, 2025
- CVE-2025-4901Medium 5.3A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125).dlink · di-7003g firmwareEPSS79%1 exploitPublished May 18, 2025
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-66066 | Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing | Critical 9.5 | 28% | 1 exploit | |
| CVE-2026-0826 | In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform. hp inc. · poly trio 8300 | Critical 9.2 | 32% | 1 exploit | |
| CVE-2024-44000 | LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Files litespeedtech · litespeed cache | Critical 9.8 | 82% | 2 exploits | |
| CVE-2024-28000 | LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation litespeedtech · litespeed cache | Critical 9.8 | 68% | 1 exploit | |
| CVE-2026-46300 | kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel | High 7.8 | 2.4% | 2 exploits | |
| CVE-2026-43284 | kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel | High 7.8 | 94% | 14 exploits | |
| CVE-2026-34413 | Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to… | High 8.8 | 3.1% | 1 exploit | |
| CVE-2026-34415 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. | Critical 9.3 | 4.4% | 1 exploit | |
| CVE-2026-0740 | Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 63% | 1 exploit | |
| CVE-2026-4257 | Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality | Critical 9.8 | 33% | 2 exploits | |
| CVE-2026-3891 | Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 30% | 2 exploits | |
| CVE-2026-2329 | Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow grandstream · gxp1610 firmware | Critical 9.3 | 42% | 2 exploits | |
| CVE-2025-15467 | openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing openssl · openssl | High 8.8 | 52% | 1 exploit | |
| CVE-2026-0769 | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability langflow · langflow | Critical 9.8 | 42% | 1 exploit | |
| CVE-2026-0768 | Langflow code Code Injection Remote Code Execution Vulnerability langflow · langflow | Critical 9.8 | 23% | 1 exploit | |
| CVE-2026-23744 | REC in MCPJam inspector due to HTTP Endpoint exposes mcpjam · inspector | Critical 9.8 | 68% | 2 exploits | |
| CVE-2025-13486 | Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form | Critical 9.8 | 68% | 1 exploit | |
| CVE-2025-34299 | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. monstaftp · monsta ftp | Critical 9.3 | 73% | 1 exploit | |
| CVE-2025-11749 | AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation | Critical 9.8 | 75% | 1 exploit | |
| CVE-2025-55315 | Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability microsoft · asp.net core | Critical 9.9 | 66% | 1 exploit | |
| CVE-2025-61678 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. | High 8.6 | 44% | 1 exploit | |
| CVE-2025-61675 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration… | High 8.6 | 38% | 1 exploit | |
| CVE-2025-59528 | Flowise has Remote Code Execution vulnerability flowiseai · flowise | Critical 10.0 | 86% | 2 exploits | |
| CVE-2025-9528 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. linksys · e1700 firmware | Low 2.0 | 54% | 2 exploits | |
| CVE-2025-57791 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. commvault · commvault | Medium 6.9 | 34% | 1 exploit | |
| CVE-2025-57790 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. commvault · commvault | High 8.7 | 27% | 1 exploit | |
| CVE-2025-7441 | StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 50% | 2 exploits | |
| CVE-2025-8943 | Flowise OS command remote code execution flowiseai · flowise | Critical 9.8 | 75% | 1 exploit | |
| CVE-2025-34152 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. | Critical 9.4 | 87% | 1 exploit | |
| CVE-2013-10059 | An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. dlink · dir-615h firmware | High 8.6 | 27% | 3 exploits | |
| CVE-2019-25224 | WP Database Backup < 5.2 - Unauthenticated OS Command Injection wpseeds · wp database backup | Critical 9.8 | 22% | 1 exploit | |
| CVE-2025-32429 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter xwiki · xwiki | Critical 9.3 | 88% | 1 exploit | |
| CVE-2025-34117 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. | Critical 9.3 | 21% | 1 exploit | |
| CVE-2025-34300 | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. | Critical 10.0 | 81% | 1 exploit | |
| CVE-2025-6965 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. sqlite · sqlite | High 7.2 | 73% | 1 exploit | |
| CVE-2020-36847 | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. simplefilelist · simple file list | Critical 9.8 | 44% | 3 exploits | |
| CVE-2013-3307 | Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000. | High 8.3 | 63% | 1 exploit | |
| CVE-2025-53771 | Microsoft SharePoint Server Spoofing Vulnerability microsoft · sharepoint server | Medium 6.5 | 100% | Ransomware1 exploit8 actors | |
| CVE-2025-5961 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. wpvivid · migration\, backup\, staging | High 7.2 | 55% | 1 exploit | |
| CVE-2025-5306 | Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. artica · pandora fms | High 7.0 | 36% | 1 exploit | |
| CVE-2025-34037 | An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. | Critical 10.0 | 93% | 1 exploit | |
| CVE-2025-49132 | Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution | Critical 10.0 | 54% | 2 exploits | |
| CVE-2025-34511 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. sitecore · experience manager | High 8.8 | 30% | 1 exploit | |
| CVE-2025-34510 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. sitecore · experience commerce | High 8.8 | 24% | 1 exploit | |
| CVE-2025-34509 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. sitecore · experience manager | High 7.5 | 56% | 2 exploits | |
| CVE-2025-49619 | Skyvern has a Jinja runtime leak | High 8.5 | 20% | 1 exploit | |
| CVE-2025-44148 | Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component mailenable · mailenable | Critical 9.8 | 55% | 1 exploit | |
| CVE-2025-48828 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. vbulletin · vbulletin | High 8.1 | 58% | 1 exploit | |
| CVE-2025-48827 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025. vbulletin · vbulletin | Critical 9.8 | 76% | 1 exploit | |
| CVE-2025-4901 | A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). dlink · di-7003g firmware | Medium 5.3 | 79% | 1 exploit |
Showing 1–50 of 2,493
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.