Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 19, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
2,494 vulnerabilities · highest exploit probability first
  • CVE-2019-14205High 7.5
    A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.
    nevma · adaptive images
    EPSS63%
    1 exploit
    Published Jul 21, 2019
  • CVE-2019-12725Critical 9.8
    Zeroshell 3.9.0 is prone to a remote command execution vulnerability.
    zeroshell · zeroshell
    EPSS90%
    2 exploits
    Published Jul 19, 2019
  • CVE-2019-9848Critical 9.8
    LibreOffice has a feature where documents can specify that pre-installed scripts can be executed on various document events such as mouse-over, etc.
    libreoffice · libreoffice
    EPSS29%
    1 exploit
    Published Jul 17, 2019
  • CVE-2019-13396Medium 5.3
    FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.
    getflightpath · flightpath
    EPSS63%
    2 exploits
    Published Jul 10, 2019
  • CVE-2019-13372Critical 9.8
    /web/Lib/Action/IndexAction.class.php in D-Link Central WiFi Manager CWM(100) before v1.03R0100_BETA6 allows remote attackers to execute arbitrary PHP code via a cookie because a cookie's username field allows eval injection, and an empty password bypasses authentication.
    dlink · central wifimanager
    EPSS82%
    2 exploits
    Published Jul 6, 2019
  • CVE-2018-15812High 7.5
    Insufficient Entropy in DotNetNuke
    dnnsoftware · dotnetnuke
    EPSS47%
    2 exploits
    Published Jul 5, 2019
  • CVE-2018-18326High 7.5
    Insufficient Entropy in DotNetNuke
    dnnsoftware · dotnetnuke
    EPSS54%
    2 exploits
    Published Jul 5, 2019
  • CVE-2017-8229Critical 9.8
    Amcrest IPM-721S V2.420.AC00.16.R.20160909 devices allow an unauthenticated attacker to download the administrative credentials.
    amcrest · ipm-721s firmware
    EPSS74%
    1 exploit
    Published Jul 3, 2019
  • CVE-2018-11686Critical 9.8
    The Publish Service in FlexPaper (later renamed FlowPaper) 2.3.6 allows remote code execution via setup.php and change_config.php.
    flowpaper · flexpaper
    EPSS53%
    1 exploit
    Published Jul 3, 2019
  • CVE-2019-7257Critical 10.0
    Linear eMerge E3-Series devices allow Unrestricted File Upload.
    nortekcontrol · linear emerge elite firmware
    EPSS70%
    2 exploits
    Published Jul 2, 2019
  • CVE-2019-7255Medium 6.1
    Linear eMerge E3-Series devices allow XSS.
    nortekcontrol · linear emerge elite firmware
    EPSS56%
    2 exploits
    Published Jul 2, 2019
  • CVE-2019-7254High 7.5
    Linear eMerge E3-Series devices allow File Inclusion.
    nortekcontrol · linear emerge elite firmware
    EPSS82%
    2 exploits
    Published Jul 2, 2019
  • CVE-2019-7276Critical 9.8
    Optergy Proton/Enterprise devices allow Remote Root Code Execution via a Backdoor Console.
    optergy · enterprise
    EPSS93%
    2 exploits
    Published Jul 1, 2019
  • CVE-2019-1622Medium 5.3
    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device.
    cisco · data center network manager
    EPSS79%
    2 exploits
    Published Jun 27, 2019
  • CVE-2019-1620Critical 9.8
    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to upload arbitrary files on an affected device.
    cisco · data center network manager
    EPSS84%
    2 exploits
    Published Jun 27, 2019
  • CVE-2019-1619Critical 9.8
    A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device.
    cisco · data center network manager
    EPSS83%
    2 exploits
    Published Jun 27, 2019
  • CVE-2019-7232High 8.8
    The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request.
    abb · pb610 panel builder 600 firmware
    EPSS52%
    1 exploit
    Published Jun 24, 2019
  • CVE-2019-12928Critical 9.8
    The QMP migrate command in QEMU version 4.0.0 and earlier is vulnerable to OS command injection, which allows the remote attacker to achieve code execution, denial of service, or information disclosure by sending a crafted QMP command to the listening server.
    qemu · qemu
    EPSS23%
    1 exploit
    Published Jun 24, 2019
  • CVE-2019-2729Critical 9.8
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.
    oracle · weblogic server
    EPSS89%
    2 exploits
    Published Jun 19, 2019
  • CVE-2019-11409High 8.8
    app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host.
    fusionpbx · fusionpbx
    EPSS87%
    4 exploits
    Published Jun 17, 2019
  • CVE-2019-12181High 8.8
    A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
    solarwinds · serv-u ftp server
    EPSS65%
    6 exploits
    Published Jun 17, 2019
  • CVE-2019-12840High 8.8
    In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
    webmin · webmin
    EPSS77%
    2 exploits
    Published Jun 15, 2019
  • CVE-2019-12780Critical 9.8
    The Belkin Wemo Enabled Crock-Pot allows command injection in the Wemo UPnP API via the SmartDevURL argument to the SetSmartDevInfo action.
    belkin · crock-pot smart slow cooker with wemo firmware
    EPSS71%
    2 exploits
    Published Jun 10, 2019
  • CVE-2019-12276High 7.5
    A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests.
    grandnode · grandnode
    EPSS57%
    1 exploit
    Published Jun 5, 2019
  • CVE-2019-12169High 8.8
    ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.
    atutor · atutor
    EPSS72%
    4 exploits
    Published Jun 3, 2019
  • CVE-2019-10123Critical 9.8
    SQL Injection in Advanced InfoData Systems (AIS) ESEL-Server 67 (which is the backend for the AIS logistics mobile app) allows an anonymous attacker to execute arbitrary code in the context of the user of the MSSQL database.
    ais · logistic software
    EPSS66%
    3 exploits
    Published May 31, 2019
  • CVE-2019-0221Medium 6.1
    Cross-site scripting in Apache Tomcat
    apache · tomcat
    EPSS59%
    1 exploit
    Published May 30, 2019
  • CVE-2013-7285Critical 9.8
    Command Injection in Xstream
    xstream · xstream
    EPSS84%
    1 exploit
    Published May 29, 2019
  • CVE-2019-12347Medium 6.1
    In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action.
    netgate · pfsense
    EPSS59%
    2 exploits
    Published May 29, 2019
  • CVE-2019-12314Critical 9.8
    Deltek Maconomy 2.2.5 is prone to local file inclusion via absolute path traversal in the WS.macx1.W_MCS/ PATH_INFO, as demonstrated by a cgi-bin/Maconomy/MaconomyWS.macx1.W_MCS/etc/passwd URI.
    deltek · maconomy
    EPSS84%
    3 exploits
    Published May 24, 2019
  • CVE-2019-3799Medium 6.5
    Path Traversal in Spring Cloud Config
    vmware · spring cloud config
    EPSS85%
    1 exploit
    Published May 23, 2019
  • CVE-2019-6814Critical 9.8
    A CWE-287: Improper Authentication vulnerability exists in the NET55XX Encoder with firmware prior to version 2.1.9.7 which could cause impact to confidentiality, integrity, and availability when a remote attacker crafts a malicious request to the encoder webUI.
    schneider-electric · net5500 firmware
    EPSS37%
    2 exploits
    Published May 22, 2019
  • CVE-2019-11231Critical 9.8
    insufficient input sanitation in the theme-edit.php file allows upload of files with arbitrary content (PHP code, for example).
    get-simple · getsimple cms
    EPSS72%
    3 exploits
    Published May 22, 2019
  • CVE-2019-4279Critical 9.8
    IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to execute arbitrary code on the system with a specially-crafted sequence of serialized objects from untrusted sources.
    ibm · websphere application server
    EPSS80%
    2 exploits
    Published May 17, 2019
  • CVE-2019-1821Critical 9.8
    A vulnerability in the web-based management interface of Cisco Prime Infrastructure (PI) and Cisco Evolved Programmable Network (EPN) Manager could allow an authenticated, remote attacker to execute code with root-level privileges on the underlying operating system.
    cisco · prime infrastructure
    EPSS98%
    3 exploits
    Published May 15, 2019
  • CVE-2019-0227High 7.5
    Server Side Request Forgery in Apache Axis
    apache · axis
    EPSS92%
    1 exploit
    Published May 14, 2019
  • CVE-2019-11600High 8.1
    A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter.
    openproject · openproject
    EPSS80%
    2 exploits
    Published May 13, 2019
  • CVE-2019-8387Critical 9.8
    MASTER IPCAMERA01 3.3.4.2103 devices allow Remote Command Execution, related to the thttpd component.
    barni · master ip camera01 firmware
    EPSS56%
    3 exploits
    Published May 8, 2019
  • CVE-2019-5434Critical 9.8
    An attacker could send a specifically crafted payload to the XML-RPC invocation script and trigger the unserialize() call on the "what" parameter in the "openads.spc" RPC method.
    revive-sas · revive adserver
    EPSS57%
    1 exploit
    Published May 6, 2019
  • CVE-2017-18372High 8.8
    The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user.
    billion · 5200w-t firmware
    EPSS22%
    1 exploit
    Published May 2, 2019
  • CVE-2017-18371Critical 9.8
    The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has three user accounts with default passwords, including two hardcoded service accounts: one with the username true and password true, and another with the username supervisor and password zyad1234.
    zyxel · p660hn-t1a v1 firmware
    EPSS23%
    1 exploit
    Published May 2, 2019
  • CVE-2017-18370High 8.8
    The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user.
    zyxel · p660hn-t1a v1 firmware
    EPSS24%
    1 exploit
    Published May 2, 2019
  • CVE-2017-18369Critical 9.8
    The Billion 5200W-T 1.02b.rc5.dt49 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user.
    billion · 5200w-t firmware
    EPSS68%
    1 exploit
    Published May 2, 2019
  • CVE-2019-11358Medium 6.1
    XSS in jQuery as used in Drupal, Backdrop CMS, and other products
    backdropcms · backdrop
    EPSS87%
    1 exploit
    Published Apr 26, 2019
  • CVE-2019-7214Critical 9.8
    SmarterTools SmarterMail 16.x before build 6985 allows deserialization of untrusted data.
    smartertools · smartermail
    EPSS85%
    2 exploits
    Published Apr 24, 2019
  • CVE-2019-7304Critical 9.8
    Canonical snapd before version 2.37.1 incorrectly performed socket owner validation, allowing an attacker to run arbitrary commands as root.
    canonical · snapd
    EPSS61%
    2 exploits
    Published Apr 23, 2019
  • CVE-2019-11447High 8.8
    An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal.
    cutephp · cutenews
    EPSS53%
    3 exploits
    Published Apr 22, 2019
  • CVE-2019-9733Critical 9.8
    By default, the access-admin account is used to reset the password of the admin account in case an administrator gets locked out from the Artifactory console.
    jfrog · artifactory
    EPSS54%
    1 exploit
    Published Apr 11, 2019
  • CVE-2019-10692Critical 9.8
    In the wp-google-maps plugin before 7.11.18 for WordPress, includes/class.rest-api.php in the REST API does not sanitize field names before a SELECT statement.
    codecabin · wp go maps
    EPSS77%
    1 exploit
    Published Apr 2, 2019
  • CVE-2019-9193High 7.2
    In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user.
    postgresql · postgresql
    EPSS92%
    2 exploits
    Published Apr 1, 2019
Showing 751–800 of 2,494

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.