Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 19, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
2,494 vulnerabilities · highest exploit probability first
  • CVE-2020-2038High 7.2
    An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges.
    paloaltonetworks · pan-os
    EPSS86%
    4 exploits
    Published Sep 9, 2020
  • CVE-2020-24949High 8.8
    Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).
    php-fusion · php-fusion
    EPSS68%
    3 exploits
    Published Sep 3, 2020
  • CVE-2020-24186Critical 10.0
    A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
    gvectors · wpdiscuz
    EPSS95%
    6 exploits
    Published Aug 24, 2020
  • CVE-2020-17456Critical 9.8
    SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.
    seowonintech · slc-130 firmware
    EPSS74%
    1 exploit
    Published Aug 19, 2020
  • CVE-2020-16205High 7.2
    Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5).
    geutebrueck · g-cam ebc-2110 firmware
    EPSS61%
    2 exploits
    Published Aug 14, 2020
  • CVE-2020-16139High 7.5
    A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely through sending specially crafted packets.
    cisco · unified ip conference station 7937g firmware
    EPSS80%
    1 exploit
    Published Aug 12, 2020
  • CVE-2020-17506Critical 9.8
    Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
    articatech · web proxy
    EPSS94%
    4 exploits
    Published Aug 12, 2020
  • CVE-2020-17505High 8.8
    Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php.
    articatech · web proxy
    EPSS82%
    2 exploits
    Published Aug 12, 2020
  • CVE-2020-7357Critical 9.9
    Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials.
    cayintech · cms
    EPSS32%
    1 exploit
    Published Aug 6, 2020
  • CVE-2020-13151Critical 9.8
    Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query.
    aerospike · aerospike server
    EPSS87%
    4 exploits
    Published Aug 5, 2020
  • CVE-2020-15922Critical 9.8
    There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges.
    midasolutions · eframework
    EPSS57%
    2 exploits
    Published Jul 23, 2020
  • CVE-2020-15920Critical 9.8
    There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges.
    midasolutions · eframework
    EPSS98%
    4 exploits
    Published Jul 23, 2020
  • CVE-2020-15893Critical 9.8
    An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02.
    dlink · dir-816l firmware
    EPSS21%
    1 exploit
    Published Jul 22, 2020
  • CVE-2020-12028High 8.1
    In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions.
    rockwellautomation · factorytalk view
    EPSS53%
    2 exploits
    Published Jul 20, 2020
  • CVE-2020-12027Medium 4.3
    All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system.
    rockwellautomation · factorytalk view
    EPSS53%
    1 exploit
    Published Jul 20, 2020
  • CVE-2020-12029High 7.8
    All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory.
    rockwellautomation · factorytalk view
    EPSS47%
    2 exploits
    Published Jul 20, 2020
  • CVE-2020-9496Medium 6.1
    XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03
    apache · ofbiz
    EPSS99%
    5 exploits
    Published Jul 15, 2020
  • CVE-2020-15050High 7.5
    Remote attackers can read arbitrary files from the server via Directory Traversal.
    supremainc · biostar 2
    EPSS51%
    2 exploits
    Published Jul 13, 2020
  • CVE-2020-7457High 8.1
    In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious…
    freebsd · freebsd
    EPSS33%
    2 exploits
    Published Jul 9, 2020
  • CVE-2020-8163High 8.8
    Remote code execution via user-provided local names in ActionView
    rubyonrails · rails
    EPSS82%
    1 exploit
    Published Jul 7, 2020
  • CVE-2020-13383High 7.5
    openSIS through 7.4 allows Directory Traversal.
    os4ed · opensis
    EPSS68%
    3 exploits
    Published Jul 1, 2020
  • CVE-2020-13382Critical 9.1
    openSIS through 7.4 has Incorrect Access Control.
    os4ed · opensis
    EPSS53%
    3 exploits
    Published Jul 1, 2020
  • CVE-2020-13381Critical 9.8
    openSIS through 7.4 allows SQL Injection.
    os4ed · opensis
    EPSS59%
    2 exploits
    Published Jul 1, 2020
  • CVE-2020-13158High 7.5
    Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.
    articatech · artica proxy
    EPSS54%
    1 exploit
    Published Jun 22, 2020
  • CVE-2020-14295High 7.2
    A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter.
    cacti · cacti
    EPSS86%
    5 exploits
    Published Jun 17, 2020
  • CVE-2020-13851High 8.8
    Artica Pandora FMS 7.44 allows remote command execution via the events feature.
    pandorafms · pandora fms
    EPSS91%
    2 exploits
    Published Jun 11, 2020
  • CVE-2014-0114High 7.5
    Arbitrary code execution in Apache Commons BeanUtils
    apache · commons beanutils
    EPSS99%
    2 exploits
    Published Jun 10, 2020
  • CVE-2020-1313High 7.8
    An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka 'Windows Update Orchestrator Service Elevation of Privilege Vulnerability'.
    microsoft · windows 10
    EPSS39%
    2 exploits
    Published Jun 9, 2020
  • CVE-2020-10644High 7.5
    The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.
    inductiveautomation · ignition gateway
    EPSS20%
    1 exploit
    Published Jun 9, 2020
  • CVE-2020-13160Critical 9.8
    AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.
    anydesk · anydesk
    EPSS81%
    4 exploits
    Published Jun 9, 2020
  • CVE-2020-12800Critical 9.8
    The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
    codedropz · drag and drop multiple file upload - contact form 7
    EPSS79%
    2 exploits
    Published Jun 8, 2020
  • CVE-2020-10546Critical 9.8
    rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection.
    rconfig · rconfig
    EPSS87%
    1 exploit
    Published Jun 4, 2020
  • CVE-2020-7115Critical 9.8
    The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass.
    arubanetworks · clearpass policy manager
    EPSS65%
    2 exploits
    Published Jun 3, 2020
  • CVE-2020-8606Critical 9.8
    A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.
    trendmicro · interscan web security virtual appliance
    EPSS73%
    3 exploits
    Published May 27, 2020
  • CVE-2020-8605High 8.8
    A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations.
    trendmicro · interscan web security virtual appliance
    EPSS88%
    4 exploits
    Published May 27, 2020
  • CVE-2020-8604High 7.5
    A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations.
    trendmicro · interscan web security virtual appliance
    EPSS90%
    3 exploits
    Published May 27, 2020
  • CVE-2020-13167Critical 9.8
    Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.
    netsweeper · netsweeper
    EPSS95%
    1 exploit
    Published May 19, 2020
  • CVE-2020-13166Critical 9.8
    The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.
    mylittletools · mylittleadmin
    EPSS78%
    3 exploits
    Published May 19, 2020
  • CVE-2020-8617Medium 5.9
    Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.
    isc · bind
    EPSS93%
    1 exploit
    Published May 19, 2020
  • CVE-2020-12256Medium 5.4
    rConfig 3.9.4 is vulnerable to reflected XSS.
    rconfig · rconfig
    EPSS96%
    1 exploit
    Published May 18, 2020
  • CVE-2020-11108High 8.8
    The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files.
    pi-hole · pi-hole
    EPSS78%
    8 exploits
    Published May 11, 2020
  • CVE-2020-11532Critical 9.8
    Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server.
    zohocorp · manageengine datasecurity plus
    EPSS77%
    1 exploit
    Published May 8, 2020
  • CVE-2020-11530Critical 9.8
    A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin.
    idangero · chop slider
    EPSS96%
    3 exploits
    Published May 8, 2020
  • CVE-2020-12720Critical 9.8
    vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
    vbulletin · vbulletin
    EPSS89%
    1 exploit
    Published May 7, 2020
  • CVE-2020-4429Critical 9.8
    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account.
    ibm · data risk manager
    EPSS72%
    2 exploits
    Published May 7, 2020
  • CVE-2020-3187Critical 9.1
    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to…
    cisco · firepower threat defense
    EPSS97%
    2 exploits
    Published May 6, 2020
  • CVE-2020-12109High 8.8
    Certain TP-Link devices allow Command Injection.
    tp-link · nc200 firmware
    EPSS74%
    3 exploits
    Published May 4, 2020
  • CVE-2020-7351High 8.8
    An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user.
    netfortris · trixbox
    EPSS65%
    2 exploits
    Published May 1, 2020
  • CVE-2020-11022Medium 6.1
    Potential XSS vulnerability in jQuery
    jquery · jquery
    EPSS99%
    2 exploits
    Published Apr 29, 2020
  • CVE-2019-5620Critical 9.8
    ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.
    hitachienergy · microscada pro sys600
    EPSS71%
    1 exploit
    Published Apr 29, 2020
Showing 601–650 of 2,494

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.