Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 19, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
2,494 vulnerabilities · highest exploit probability first
  • CVE-2018-17456Critical 9.8
    Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a…
    git-scm · git
    EPSS97%
    5 exploits
    Published Oct 6, 2018
  • CVE-2018-15379Critical 9.8
    A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file.
    cisco · prime infrastructure
    EPSS86%
    3 exploits
    Published Oct 5, 2018
  • CVE-2018-17553High 8.8
    An "Unrestricted Upload of File with Dangerous Type" issue with directory traversal in navigate_upload.php in Naviwebs Navigate CMS 2.8 allows authenticated attackers to achieve remote code execution via a POST request with engine=picnik and id=../../../navigate_info.php.
    naviwebs · navigate cms
    EPSS79%
    4 exploits
    Published Oct 3, 2018
  • CVE-2018-17552Critical 9.8
    SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.
    naviwebs · navigate cms
    EPSS84%
    4 exploits
    Published Oct 3, 2018
  • CVE-2018-16283Critical 9.8
    The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.
    wechat brodcast project · wechat brodcast
    EPSS63%
    2 exploits
    Published Sep 24, 2018
  • CVE-2018-17173Critical 9.8
    LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.
    lg · supersign cms
    EPSS56%
    2 exploits
    Published Sep 21, 2018
  • CVE-2018-17283High 7.5
    Zoho ManageEngine OpManager before 12.3 Build 123196 does not require authentication for /oputilsServlet requests, as demonstrated by a /oputilsServlet?action=getAPIKey request that can be leveraged against Firewall Analyzer to add an admin user via /api/json/v2/admin/addUser or…
    zohocorp · manageengine opmanager
    EPSS66%
    1 exploit
    Published Sep 21, 2018
  • CVE-2018-17254Critical 9.8
    The JCK Editor component 6.4.4 for Joomla!
    arkextensions · jck editor
    EPSS83%
    4 exploits
    Published Sep 20, 2018
  • CVE-2018-17153Critical 9.8
    It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability.
    western digital · my cloud dl2100
    EPSS87%
    1 exploit
    Published Sep 18, 2018
  • CVE-2018-17128Medium 5.4
    A Persistent XSS issue was discovered in the Visual Editor in MyBB before 1.8.19 via a Video MyCode.
    mybb · mybb
    EPSS75%
    2 exploits
    Published Sep 17, 2018
  • CVE-2018-16836Critical 9.8
    Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.
    rubedo project · rubedo
    EPSS61%
    3 exploits
    Published Sep 11, 2018
  • CVE-2018-16763Critical 9.8
    FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.
    thedaylightstudio · fuel cms
    EPSS83%
    6 exploits
    Published Sep 9, 2018
  • CVE-2015-9266Critical 9.8
    The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques.
    ubnt · airos 4 xs2
    EPSS74%
    4 exploits
    Published Sep 5, 2018
  • CVE-2018-16509High 7.8
    Incorrect "restoration of privilege" checking during handling of /invalidaccess exceptions could be used by attackers able to supply crafted PostScript to execute code using the "pipe" instruction.
    artifex · ghostscript
    EPSS92%
    3 exploits
    Published Sep 5, 2018
  • CVE-2018-15745High 7.5
    Argus Surveillance DVR 4.0.0.0 devices allow Unauthenticated Directory Traversal, leading to File Disclosure via a ..%2F in the WEBACCOUNT.CGI RESULTPAGE parameter.
    argussurveillance · dvr
    EPSS98%
    1 exploit
    Published Aug 30, 2018
  • CVE-2018-12710High 8.0
    An issue was discovered on D-Link DIR-601 2.02NA devices.
    dlink · dir-601 firmware
    EPSS77%
    2 exploits
    Published Aug 29, 2018
  • CVE-2018-17207Critical 9.8
    Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution
    awesomemotive · duplicator
    EPSS60%
    1 exploit
    Published Aug 28, 2018
  • CVE-2018-15877High 8.8
    The Plainview Activity Monitor plugin before 20180826 for WordPress is vulnerable to OS command injection via shell metacharacters in the ip parameter of a wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools request.
    plainview activity monitor project · plainview activity monitor
    EPSS77%
    7 exploits
    Published Aug 26, 2018
  • CVE-2018-15473Medium 5.9
    OpenSSH through 7.7 is prone to a user enumeration vulnerability due to not delaying bailout for an invalid authenticating user until after the packet containing the request has been fully parsed, related to auth2-gss.c, auth2-hostbased.c, and auth2-pubkey.c.
    openbsd · openssh
    EPSS99%
    6 exploits
    Published Aug 17, 2018
  • CVE-2018-8353High 7.5
    A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10.
    microsoft · internet explorer
    EPSS68%
    2 exploits
    Published Aug 15, 2018
  • CVE-2018-15153High 8.8
    OS command injection occurring in versions of OpenEMR before 5.0.1.4 allows a remote authenticated attacker to execute arbitrary commands by making a crafted request to interface/main/daemon_frame.php after modifying the "hylafax_server" global variable in…
    open-emr · openemr
    EPSS62%
    1 exploit
    Published Aug 15, 2018
  • CVE-2018-14417Critical 9.8
    A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3.
    softnas · cloud
    EPSS89%
    2 exploits
    Published Aug 3, 2018
  • CVE-2018-14912High 7.5
    cgit_clone_objects in CGit before 1.2.1 has a directory traversal vulnerability when enable-http-clone=1 is not turned off, as demonstrated by a cgit/cgit.cgi/git/objects/?path=../ request.
    cgit project · cgit
    EPSS92%
    2 exploits
    Published Aug 3, 2018
  • CVE-2018-14728Critical 9.8
    upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.
    tecrail · responsive filemanager
    EPSS76%
    3 exploits
    Published Aug 3, 2018
  • CVE-2017-5941Critical 9.8
    Code Execution through IIFE in node-serialize
    node-serialize project · node-serialize
    EPSS61%
    3 exploits
    Published Jul 18, 2018
  • CVE-2018-1612Medium 5.8
    IBM QRadar Incident Forensics (IBM QRadar SIEM 7.2, and 7.3) could allow a remote attacker to bypass authentication and obtain sensitive information.
    ibm · qradar security information and event manager
    EPSS56%
    2 exploits
    Published Jul 17, 2018
  • CVE-2018-0707High 7.2
    Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.
    qnap · q\'center
    EPSS59%
    5 exploits
    Published Jul 16, 2018
  • CVE-2018-0706High 8.8
    Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access sensitive information.
    qnap · q\'center
    EPSS48%
    5 exploits
    Published Jul 16, 2018
  • CVE-2016-6563Critical 9.8
    Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers.
    dlink · dir-818l\(w\) firmware
    EPSS80%
    3 exploits
    Published Jul 13, 2018
  • CVE-2017-9462High 8.7
    Mercurial has Incorrect Permission Assignment for Critical Resource
    mercurial · mercurial
    EPSS22%
    1 exploit
    Published Jul 13, 2018
  • CVE-2018-11529High 8.0
    VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via crafted MKV files.
    videolan · vlc media player
    EPSS37%
    3 exploits
    Published Jul 11, 2018
  • CVE-2017-16709High 7.2
    Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated administrators to execute arbitrary code via unspecified vectors.
    crestron · airmedia am-100 firmware
    EPSS72%
    2 exploits
    Published Jul 11, 2018
  • CVE-2018-8279High 7.5
    A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore.
    microsoft · chakracore
    EPSS71%
    2 exploits
    Published Jul 10, 2018
  • CVE-2018-12465High 7.2
    An OS command injection vulnerability in the web administration component of Micro Focus Secure Messaging Gateway (SMG) allows a remote attacker authenticated as a privileged user to execute arbitrary OS commands on the SMG server.
    microfocus · secure messaging gateway
    EPSS80%
    2 exploits
    Published Jun 29, 2018
  • CVE-2018-12464Critical 9.8
    A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database.
    microfocus · secure messaging gateway
    EPSS81%
    2 exploits
    Published Jun 29, 2018
  • CVE-2018-12998Medium 6.1
    A reflected Cross-site scripting (XSS) vulnerability in Zoho ManageEngine Netflow Analyzer before build 123137, Network Configuration Manager before build 123128, OpManager before build 123148, OpUtils before build 123161, and Firewall Analyzer before build 123147 allows remote…
    zohocorp · firewall analyzer
    EPSS99%
    2 exploits
    Published Jun 29, 2018
  • CVE-2018-12895High 8.8
    WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file.
    wordpress · wordpress
    EPSS62%
    1 exploit
    Published Jun 26, 2018
  • CVE-2018-10594Critical 9.8
    Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1) utilize a fixed-length stack buffer where an unverified length value can be read from the network…
    deltaww · commgr
    EPSS69%
    5 exploits
    Published Jun 26, 2018
  • CVE-2018-10662Critical 9.8
    There is an Exposed Insecure Interface.
    axis · a1001 firmware
    EPSS80%
    3 exploits
    Published Jun 26, 2018
  • CVE-2018-10661Critical 9.8
    There is a bypass of access control.
    axis · a1001 firmware
    EPSS87%
    3 exploits
    Published Jun 26, 2018
  • CVE-2018-10660Critical 9.8
    There is Shell Command Injection.
    axis · a1001 firmware
    EPSS82%
    3 exploits
    Published Jun 26, 2018
  • CVE-2018-1000533Critical 9.8
    klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in searchTree function that can result in Execute any code as PHP user.
    gitlist · gitlist
    EPSS73%
    1 exploit
    Published Jun 26, 2018
  • CVE-2018-10956High 7.5
    IPConfigure Orchid Core VMS 2.0.5 allows Directory Traversal.
    ipconfigure · orchid core vms
    EPSS55%
    3 exploits
    Published Jun 25, 2018
  • CVE-2018-12634Critical 9.8
    CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.
    circontrol · circarlife scada
    EPSS56%
    2 exploits
    Published Jun 21, 2018
  • CVE-2018-4233High 8.8
    iOS before 11.4 is affected.
    apple · icloud
    EPSS54%
    4 exploits
    Published Jun 8, 2018
  • CVE-2018-11409Medium 5.3
    Splunk through 7.0.1 allows information disclosure by appending raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key.
    splunk · splunk
    EPSS98%
    3 exploits
    Published Jun 8, 2018
  • CVE-2018-11714Critical 9.8
    An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices.
    tp-link · tl-wr840n firmware
    EPSS67%
    1 exploit
    Published Jun 4, 2018
  • CVE-2018-11646High 7.5
    webkitFaviconDatabaseSetIconForPageURL and webkitFaviconDatabaseSetIconURLForPageURL in UIProcess/API/glib/WebKitFaviconDatabase.cpp in WebKit, as used in WebKitGTK+ through 2.21.3, mishandle an unset pageURL, leading to an application crash.
    webkitgtk · webkitgtk\+
    EPSS68%
    4 exploits
    Published Jun 1, 2018
  • CVE-2018-3639Medium 5.5
    Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis,…
    EPSS61%
    2 exploits
    Published May 22, 2018
  • CVE-2018-1111High 7.5
    DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in the NetworkManager integration script included in the DHCP client.
    fedoraproject · fedora
    EPSS98%
    5 exploits
    Published May 17, 2018
Showing 851–900 of 2,494

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.