Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
1,192 vulnerabilities · highest exploit probability first
  • CVE-2017-11165Critical 9.8
    dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
    thermofisher · dt80 dex firmware
    EPSS64%
    2 exploits
    Published Jul 12, 2017
  • CVE-2017-6326Critical 10.0
    The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process.
    symantec · messaging gateway
    EPSS73%
    2 exploits
    Published Jun 26, 2017
  • CVE-2017-9544Critical 9.8
    There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1.
    echatserver · easy chat server
    EPSS24%
    2 exploits
    Published Jun 12, 2017
  • CVE-2014-8687Critical 9.8
    Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.
    seagate · business nas firmware
    EPSS44%
    7 exploits
    Published Jun 8, 2017
  • CVE-2017-8835Critical 9.8
    SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.
    peplink · 1350hw2 firmware
    EPSS62%
    1 exploit
    Published Jun 5, 2017
  • CVE-2017-9417Critical 9.8
    Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.
    broadcom · bcm43xx wi-fi chipset firmware
    EPSS64%
    1 exploit
    Published Jun 4, 2017
  • CVE-2015-0936Critical 9.8
    Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
    ceragon · fibeair ip-10 firmware
    EPSS78%
    3 exploits
    Published Jun 1, 2017
  • CVE-2017-1092Critical 9.8
    IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers.
    ibm · informix open admin tool
    EPSS76%
    3 exploits
    Published May 22, 2017
  • CVE-2017-9101Critical 9.8
    import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
    playsms · playsms
    EPSS77%
    4 exploits
    Published May 21, 2017
  • CVE-2017-5174Critical 9.8
    An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12.
    geutebruck · ip camera g-cam efd-2250 firmware
    EPSS52%
    1 exploit
    Published May 19, 2017
  • CVE-2017-6622Critical 9.8
    A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges.
    cisco · prime collaboration provisioning
    EPSS62%
    1 exploit
    Published May 18, 2017
  • CVE-2017-8917Critical 9.8
    SQL injection vulnerability in Joomla!
    joomla · joomla\!
    EPSS100%
    5 exploits
    Published May 17, 2017
  • CVE-2016-10372Critical 9.8
    The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and…
    eir · d1000 modem firmware
    EPSS82%
    1 exploit
    Published May 16, 2017
  • CVE-2017-8895Critical 9.8
    In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution.
    veritas · backup exec
    EPSS71%
    2 exploits
    Published May 10, 2017
  • CVE-2017-6553Critical 9.8
    Buffer Overflow in Quest One Identity Privilege Manager for Unix before 6.0.0.061 allows remote attackers to obtain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.
    quest · privilege manager for unix
    EPSS42%
    2 exploits
    Published Apr 29, 2017
  • CVE-2016-1560Critical 9.8
    ExaGrid appliances with firmware before 4.8 P26 have a default password of (1) inflection for the root shell account and (2) support for the support account in the web interface, which allows remote attackers to obtain administrative access via an SSH or HTTP session.
    exagrid · ex10000e firmware
    EPSS72%
    3 exploits
    Published Apr 21, 2017
  • CVE-2016-2555Critical 9.8
    SQL injection vulnerability in include/lib/mysql_connect.inc.php in ATutor 2.2.1 allows remote attackers to execute arbitrary SQL commands via the searchFriends function to friends.inc.php.
    atutor · atutor
    EPSS80%
    3 exploits
    Published Apr 13, 2017
  • CVE-2016-7552Critical 9.8
    On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated attacker to delete arbitrary files as root.
    trendmicro · threat discovery appliance
    EPSS93%
    2 exploits
    Published Apr 12, 2017
  • CVE-2016-7547Critical 9.8
    A command execution flaw on the Trend Micro Threat Discovery Appliance 2.6.1062r1 exists with the timezone parameter in the admin_sys_time.cgi interface.
    trendmicro · threat discovery appliance
    EPSS93%
    2 exploits
    Published Apr 12, 2017
  • CVE-2017-6361Critical 9.8
    QNAP QTS before 4.2.4 Build 20170313 allows attackers to execute arbitrary commands via unspecified vectors.
    qnap · qts
    EPSS57%
    1 exploit
    Published Mar 23, 2017
  • CVE-2017-6360Critical 9.8
    QNAP QTS before 4.2.4 Build 20170313 allows attackers to gain administrator privileges and obtain sensitive information via unspecified vectors.
    qnap · qts
    EPSS66%
    1 exploit
    Published Mar 23, 2017
  • CVE-2017-6465Critical 9.8
    Remote Code Execution was discovered in FTPShell Client 6.53.
    ftpshell · ftpshell client
    EPSS50%
    4 exploits
    Published Mar 9, 2017
  • CVE-2017-6526Critical 9.8
    dnaLIMS is vulnerable to unauthenticated command execution through an improperly protected administrative web shell (cgi-bin/dna/sysAdmin.cgi POST requests).
    dnatools · dnalims
    EPSS57%
    2 exploits
    Published Mar 9, 2017
  • CVE-2017-6187Critical 9.8
    Buffer overflow in the built-in web server in DiskSavvy Enterprise 9.4.18 allows remote attackers to execute arbitrary code via a long URI in a GET request.
    disksavvy · disksavvy enterprise
    EPSS33%
    3 exploits
    Published Feb 22, 2017
  • CVE-2016-10176Critical 9.8
    The NETGEAR WNR2000v5 router allows an administrator to perform sensitive actions by invoking the apply.cgi URL on the web server of the device.
    netgear · wnr2000v5 firmware
    EPSS77%
    1 exploit
    Published Jan 30, 2017
  • CVE-2016-10175Critical 9.8
    The NETGEAR WNR2000v5 router leaks its serial number when performing a request to the /BRS_netgear_success.html URI.
    netgear · wnr2000v5 firmware
    EPSS66%
    1 exploit
    Published Jan 30, 2017
  • CVE-2017-3248Critical 9.8
    Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.
    oracle · weblogic server
    EPSS97%
    2 exploits
    Published Jan 27, 2017
  • CVE-2016-6603Critical 9.8
    ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.
    zohocorp · webnms framework
    EPSS87%
    4 exploits
    Published Jan 23, 2017
  • CVE-2016-6602Critical 9.8
    ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, which allows context-dependent attackers to obtain cleartext passwords by leveraging access to WEB-INF/conf/securitydbData.xml.
    zohocorp · webnms framework
    EPSS56%
    4 exploits
    Published Jan 23, 2017
  • CVE-2016-6600Critical 9.8
    Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a ..
    zohocorp · webnms framework
    EPSS91%
    5 exploits
    Published Jan 23, 2017
  • CVE-2016-4010Critical 9.8
    Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted serialized shopping cart data.
    magento · magento
    EPSS93%
    4 exploits
    Published Jan 23, 2017
  • CVE-2016-10108Critical 9.8
    Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.
    western digital · mycloud nas
    EPSS98%
    1 exploit
    Published Jan 3, 2017
  • CVE-2016-7456Critical 9.8
    VMware vSphere Data Protection (VDP) 5.5.x though 6.1.x has an SSH private key with a publicly known password, which makes it easier for remote attackers to obtain login access via an SSH session.
    vmware · vsphere data protection
    EPSS33%
    1 exploit
    Published Dec 29, 2016
  • CVE-2016-8869Critical 9.8
    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!
    joomla · joomla\!
    EPSS97%
    2 exploits
    Published Nov 4, 2016
  • CVE-2016-8582Critical 9.8
    A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
    alienvault · open source security information and event management
    EPSS57%
    2 exploits
    Published Oct 28, 2016
  • CVE-2016-6662Critical 9.8
    mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
    mariadb · mariadb
    EPSS68%
    2 exploits
    Published Sep 20, 2016
  • CVE-2016-5675Critical 9.8
    handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
    netgear · readynas surveillance
    EPSS71%
    2 exploits
    Published Aug 31, 2016
  • CVE-2016-5674Critical 9.8
    debugging_center_utils_.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
    netgear · readynas surveillance
    EPSS95%
    2 exploits
    Published Aug 31, 2016
  • CVE-2016-6195Critical 9.8
    SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in…
    vbulletin · vbulletin
    EPSS68%
    1 exploit
    Published Aug 30, 2016
  • CVE-2016-3510Critical 9.8
    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability…
    oracle · weblogic server
    EPSS91%
    1 exploit
    Published Jul 21, 2016
  • CVE-2016-2296Critical 9.4
    Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
    meteocontrol · web\'log basic 100
    EPSS64%
    1 exploit
    Published May 14, 2016
  • CVE-2016-3078Critical 9.8
    php: Heap overflow caused by integer overflow when reading zip files in ZipArchive
    php · php
    EPSS56%
    2 exploits
    Published Apr 28, 2016
  • CVE-2016-2004Critical 9.8
    HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication.
    hp · data protector
    EPSS94%
    6 exploits
    Published Apr 21, 2016
  • CVE-2016-2345Critical 9.8
    Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string.
    dameware · mini remote control
    EPSS51%
    1 exploit
    Published Mar 17, 2016
  • CVE-2016-1524Critical 9.6
    Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via…
    netgear · prosafe network management software 300
    EPSS94%
    1 exploit
    Published Feb 13, 2016
  • CVE-2016-1287Critical 9.8
    Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X…
    cisco · adaptive security appliance software
    EPSS74%
    3 exploits
    Published Feb 11, 2016
  • CVE-2016-1909Critical 9.8
    Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access…
    fortinet · fortios
    EPSS71%
    3 exploits
    Published Jan 15, 2016
  • CVE-2016-0854Critical 9.8
    Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
    advantech · webaccess
    EPSS77%
    3 exploits
    Published Jan 15, 2016
  • CVE-2015-3628Critical 9.0
    The iControl API in F5 BIG-IP LTM, AFM, Analytics, APM, ASM, Link Controller, and PEM 11.3.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP AAM 11.4.0 before 11.5.3 HF2 and 11.6.0 before 11.6.0 HF6, BIG-IP Edge Gateway, WebAccelerator, and WOM 11.3.0, BIG-IP GTM 11.3.0…
    f5 · big-ip edge gateway
    EPSS69%
    3 exploits
    Published Dec 7, 2015
  • CVE-2015-2342Critical 10.0
    The JMX RMI service in VMware vCenter Server 5.0 before u3e, 5.1 before u3b, 5.5 before u3, and 6.0 before u1 does not restrict registration of MBeans, which allows remote attackers to execute arbitrary code via the RMI protocol.
    vmware · vcenter server
    EPSS89%
    2 exploits
    Published Oct 12, 2015
Showing 501–550 of 1,192

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.