Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
890 vulnerabilities · highest exploit probability first
  • CVE-2014-7228High 7.5
    Akeeba Restore (restore.php), as used in Joomla!
    joomla · joomla\!
    EPSS55%
    2 exploits
    Published Nov 3, 2014
  • CVE-2013-7409High 7.5
    Buffer overflow in ALLPlayer 5.6.2 through 5.8.1 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a long string in a .m3u (playlist) file.
    allplayer · allplayer
    EPSS68%
    15 exploits
    Published Oct 30, 2014
  • CVE-2014-6037High 7.5
    Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with ..
    zohocorp · manageengine eventlog analyzer
    EPSS84%
    6 exploits
    Published Oct 26, 2014
  • CVE-2014-5005High 7.5
    Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before 9 build 90055 allows remote attackers to execute arbitrary code via a ..
    zohocorp · manageengine desktop central
    EPSS78%
    4 exploits
    Published Oct 21, 2014
  • CVE-2014-3704High 7.5
    Drupalgeddon — Drupal core SQL injection
    drupal · drupal
    EPSS100%
    13 exploits
    Published Oct 16, 2014
  • CVE-2014-4872High 7.5
    BMC Track-It!
    bmc · track-it\!
    EPSS79%
    3 exploits
    Published Oct 10, 2014
  • CVE-2013-3632High 8.8
    The Cron service in rpc.php in OpenMediaVault allows remote authenticated users to execute cron jobs as arbitrary users and execute arbitrary commands via the username parameter.
    openmediavault · openmediavault
    EPSS57%
    3 exploits
    Published Sep 29, 2014
  • CVE-2014-5519High 7.5
    The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp.
    phpwiki project · phpwiki
    EPSS65%
    4 exploits
    Published Sep 11, 2014
  • CVE-2014-5073High 7.5
    vmtadmin.cgi in VMTurbo Operations Manager before 4.6 build 28657 allows remote attackers to execute arbitrary commands via shell metacharacters in the fileDate parameter in a DOWN call.
    vmturbo · operations manager
    EPSS76%
    4 exploits
    Published Aug 29, 2014
  • CVE-2014-5460High 8.8
    Slideshow Gallery < 1.4.7 - Arbitrary File Upload
    tribulant · tibulant slideshow gallery
    EPSS71%
    6 exploits
    Published Aug 28, 2014
  • CVE-2014-4971High 7.2
    Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, which allows local users to write data to arbitrary memory locations, and consequently gain privileges, via a crafted address in an IOCTL call, related to (1) the MQAC.sys driver in the MQ…
    microsoft · windows xp
    EPSS23%
    9 exploits
    Published Jul 26, 2014
  • CVE-2014-4511High 7.5
    Gitlist before 0.5.0 allows remote attackers to execute arbitrary commands via shell metacharacters in the file name in the URI of a request for a (1) blame, (2) file, or (3) stats page, as demonstrated by requests to blame/master/, master/, and stats/master/.
    gitlist · gitlist
    EPSS83%
    7 exploits
    Published Jul 22, 2014
  • CVE-2014-2364High 7.5
    Multiple stack-based buffer overflows in Advantech WebAccess before 7.2 allow remote attackers to execute arbitrary code via a long string in the (1) ProjectName, (2) SetParameter, (3) NodeName, (4) CCDParameter, (5) SetColor, (6) AlarmImage, (7) GetParameter, (8) GetColor, (9)…
    advantech · advantech webaccess
    EPSS61%
    3 exploits
    Published Jul 19, 2014
  • CVE-2013-6117High 7.5
    Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.
    dahuasecurity · dvr firmware
    EPSS70%
    1 exploit
    Published Jul 11, 2014
  • CVE-2014-3888High 8.3
    Stack-based buffer overflow in BKFSim_vhfd.exe in Yokogawa CENTUM CS 1000, CENTUM CS 3000 R3.09.50 and earlier, CENTUM VP R5.03.20 and earlier, Exaopc R3.72.00 and earlier, B/M9000CS R5.05.01 and earlier, and B/M9000 VP R7.03.01 and earlier, when FCS/Test Function is enabled,…
    yokogawa · exaopc
    EPSS62%
    3 exploits
    Published Jul 10, 2014
  • CVE-2013-1412High 7.5
    DataLife Engine (DLE) 9.7 allows remote attackers to execute arbitrary PHP code via the catlist[] parameter to engine/preview.php, which is used in a preg_replace function call with an e modifier.
    dleviet · datalife engine
    EPSS40%
    5 exploits
    Published Jun 2, 2014
  • CVE-2013-5036High 7.5
    The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the (1) namespace parameter to the deobfuscation function or (2) sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb.
    squash · square squash
    EPSS46%
    3 exploits
    Published May 27, 2014
  • CVE-2014-3789High 7.5
    GetPermissions.asp in Cogent Real-Time Systems Cogent DataHub before 7.3.5 allows remote attackers to execute arbitrary commands via unspecified vectors.
    cogentdatahub · cogent datahub
    EPSS63%
    2 exploits
    Published May 22, 2014
  • CVE-2014-1649High 7.9
    The server in Symantec Workspace Streaming (SWS) before 7.5.0.749 allows remote attackers to access files and functionality by sending a crafted XMLRPC request over HTTPS.
    symantec · workspace streaming
    EPSS42%
    2 exploits
    Published May 16, 2014
  • CVE-2014-0782High 8.3
    Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS…
    yokogawa · exaopc
    EPSS57%
    2 exploits
    Published May 16, 2014
  • CVE-2013-4730High 10.0
    Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.
    pcman · ftp server
    EPSS67%
    13 exploits
    Published May 15, 2014
  • CVE-2014-2928High 7.1
    The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator,…
    f5 · big-ip edge gateway
    EPSS40%
    3 exploits
    Published May 12, 2014
  • CVE-2014-1762High 7.5
    Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at…
    microsoft · internet explorer
    EPSS71%
    1 exploit
    Published Apr 27, 2014
  • CVE-2014-0644High 7.8
    EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by…
    emc · cloud tiering appliance
    EPSS53%
    1 exploit
    Published Apr 16, 2014
  • CVE-2014-2850High 8.5
    The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
    sophos · web appliance
    EPSS58%
    3 exploits
    Published Apr 11, 2014
  • CVE-2014-2849High 8.5
    The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
    sophos · web appliance
    EPSS61%
    3 exploits
    Published Apr 11, 2014
  • CVE-2014-1691High 7.5
    The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
    horde · horde application framework
    EPSS43%
    2 exploits
    Published Apr 1, 2014
  • CVE-2014-0784High 8.3
    Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
    yokogawa · centum cs 3000
    EPSS36%
    2 exploits
    Published Mar 14, 2014
  • CVE-2014-1903High 7.5
    admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the…
    freepbx · freepbx
    EPSS52%
    3 exploits
    Published Feb 18, 2014
  • CVE-2012-0270High 7.5
    Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file to the getnum function in util/heti_main.c or (2) PVOC file to the getnum function in util/pv_import.c.
    csounds · csound
    EPSS55%
    2 exploits
    Published Feb 17, 2014
  • CVE-2013-5014High 7.5
    The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote attackers to read arbitrary files via XML data…
    symantec · endpoint protection manager
    EPSS68%
    3 exploits
    Published Feb 14, 2014
  • CVE-2014-0750High 7.5
    Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP…
    ge · intelligent platforms proficy hmi\/scada cimplicity
    EPSS70%
    2 exploits
    Published Jan 25, 2014
  • CVE-2013-2827High 7.5
    An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote attackers to download arbitrary DLL code onto a client machine and execute this code via the ProjectURL property value.
    wellintech · kingalarm\&event
    EPSS48%
    2 exploits
    Published Jan 15, 2014
  • CVE-2014-8636High 7.5
    Mozilla: XrayWrapper bypass through DOM objects (MFSA 2015-09)
    mozilla · firefox
    EPSS65%
    2 exploits
    Published Jan 15, 2014
  • CVE-2013-7260High 7.5
    Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file,…
    realnetworks · realplayer
    EPSS67%
    2 exploits
    Published Jan 3, 2014
  • CVE-2013-1349High 7.5
    Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.
    os4ed · opensis
    EPSS23%
    2 exploits
    Published Dec 9, 2013
  • CVE-2013-4547High 7.5
    nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
    f5 · nginx
    EPSS68%
    1 exploit
    Published Nov 23, 2013
  • CVE-2013-6829High 7.5
    admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.
    pineapp · mail-secure
    EPSS80%
    2 exploits
    Published Nov 20, 2013
  • CVE-2013-4557High 7.5
    The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.
    spip · spip
    EPSS25%
    1 exploit
    Published Nov 18, 2013
  • CVE-2013-4835High 7.5
    The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765.
    hp · sitescope
    EPSS71%
    2 exploits
    Published Nov 4, 2013
  • CVE-2013-6129High 7.5
    The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.
    vbulletin · vbulletin
    EPSS52%
    1 exploit
    Published Oct 19, 2013
  • CVE-2013-0810High 8.1
    Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka "Windows Theme File Remote Code Execution Vulnerability."
    microsoft · windows server 2003
    EPSS60%
    2 exploits
    Published Sep 11, 2013
  • CVE-2013-2370High 7.5
    Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671.
    hp · loadrunner
    EPSS62%
    2 exploits
    Published Jul 29, 2013
  • CVE-2013-2028High 7.5
    The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness…
    f5 · nginx
    EPSS87%
    6 exploits
    Published Jul 18, 2013
  • CVE-2013-1362High 7.5
    Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.
    nagios · remote plug in executor
    EPSS66%
    2 exploits
    Published Jul 9, 2013
  • CVE-2013-4786High 7.5
    freeipmi: Leakage of password hashes via RAKP authentication
    intel · intelligent platform management interface
    EPSS79%
    1 exploit
    Published Jul 8, 2013
  • CVE-2013-3563High 7.5
    Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string to TCP port 8001.
    lianja · lianja sql server
    EPSS49%
    3 exploits
    Published Jul 4, 2013
  • CVE-2013-3520High 7.5
    VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors.
    vmware · vcenter chargeback manager
    EPSS56%
    2 exploits
    Published Jun 17, 2013
  • CVE-2013-0136High 8.5
    Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1)…
    mutiny · mutiny
    EPSS40%
    2 exploits
    Published Jun 1, 2013
  • CVE-2013-0232High 7.5
    includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the…
    zoneminder · zoneminder
    EPSS48%
    2 exploits
    Published Mar 20, 2013
Showing 551–600 of 890

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.