Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
890 vulnerabilities · highest exploit probability first
- CVE-2003-0349High 7.5Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to…microsoft · windows 2000EPSS80%4 exploitsPublished Jul 24, 2003
- CVE-2003-0344High 7.5Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page.microsoft · internet explorerEPSS81%4 exploitsPublished Jun 16, 2003
- CVE-2003-0264High 7.5Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe, (2) a long XTRN argument to slmail.exe, (3) a long string to POPPASSWD, or (4) a long password to the POP3 server.seattle lab software · slmailEPSS72%5 exploitsPublished May 27, 2003
- CVE-2003-0213High 7.5ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow.poptop · pptp serverEPSS71%6 exploitsPublished May 12, 2003
- CVE-2003-0220High 7.5Buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arbitrary code via a handshake packet.kerio · personal firewall 2EPSS69%6 exploitsPublished May 12, 2003
- CVE-2002-0061High 7.5Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically…apache · http serverEPSS50%1 exploitPublished Apr 2, 2003
- CVE-2003-0109High 7.5Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0.microsoft · windows 2000EPSS86%10 exploitsPublished Mar 31, 2003
- CVE-2003-0050High 7.5parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters.apple · quicktime streaming serverEPSS69%2 exploitsPublished Mar 7, 2003
- CVE-2002-2226High 7.5Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument.tftpd32 · tftpd32EPSS63%3 exploitsPublished Dec 31, 2002
- CVE-2002-1643High 7.5Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request, (2) a DESCRIBE RTSP request with a long URL argument, or (3) two simultaneous HTTP GET…realnetworks · helix universal serverEPSS75%4 exploitsPublished Dec 19, 2002
- CVE-2002-1254High 7.5Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods."microsoft · internet explorerEPSS54%1 exploitPublished Dec 11, 2002
- CVE-2002-1142High 7.5Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub.microsoft · data access componentsEPSS76%2 exploitsPublished Nov 29, 2002
- CVE-2002-0965High 7.5Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file.oracle · oracle9iEPSS70%2 exploitsPublished Oct 4, 2002
- CVE-2002-1059High 7.5Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string.van dyke technologies · securecrtEPSS60%4 exploitsPublished Oct 4, 2002
- CVE-2002-1123High 7.5Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow.microsoft · sql serverEPSS78%3 exploitsPublished Sep 24, 2002
- CVE-2002-1120High 7.5Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request.savant · savant web serverEPSS67%5 exploitsPublished Sep 24, 2002
- CVE-2002-0656High 7.5Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3.openssl · opensslEPSS90%1 exploitPublished Aug 12, 2002
- CVE-2002-0661High 7.5Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via ..apache · http serverEPSS70%1 exploitPublished Aug 12, 2002
- CVE-2002-0649High 7.5Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL…microsoft · sql serverEPSS85%3 exploitsPublished Aug 12, 2002
- CVE-2002-0392High 7.5Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size.apache · http serverEPSS95%4 exploitsPublished Jul 3, 2002
- CVE-2002-0186High 7.5Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension."microsoft · sql serverEPSS55%1 exploitPublished Jul 3, 2002
- CVE-2002-0371High 7.5Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response.microsoft · internet explorerEPSS54%1 exploitPublished Jul 3, 2002
- CVE-2002-0079High 7.5Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code.microsoft · internet information serverEPSS77%4 exploitsPublished Apr 22, 2002
- CVE-2002-0148High 7.5Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page.microsoft · internet information serverEPSS64%1 exploitPublished Apr 22, 2002
- CVE-2001-0506High 7.2Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability.microsoft · internet information serverEPSS69%1 exploitPublished Sep 20, 2001
- CVE-2001-1320High 7.5Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows), as demonstrated by the PROTOS LDAPv3 test suite.pgp · keyserverEPSS68%2 exploitsPublished Jul 16, 2001
- CVE-2001-0333High 7.5Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding ..microsoft · internet information serverEPSS91%10 exploitsPublished Jun 27, 2001
- CVE-2001-0167High 7.6Buffer overflow in AT&T WinVNC (Virtual Network Computing) client 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long rfbConnFailed packet with a long reason string.att · winvncEPSS51%2 exploitsPublished May 3, 2001
- CVE-2001-0550High 7.5wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob).washington university · wu-ftpdEPSS75%2 exploitsPublished Apr 30, 2001
- CVE-2000-0945High 10.0The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory.cisco · catalyst 3500 xlEPSS73%1 exploitPublished Dec 19, 2000
- CVE-2000-0886High 7.5IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability.microsoft · internet information serverEPSS69%1 exploitPublished Dec 19, 2000
- CVE-2000-0884High 7.5IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability.microsoft · internet information serverEPSS63%9 exploitsPublished Dec 19, 2000
- CVE-2000-0917High 10.0Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands.caldera · openlinux ebuilderEPSS79%5 exploitsPublished Sep 25, 2000
- CVE-2000-0457High 7.5ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability.microsoft · internet information serverEPSS53%1 exploitPublished May 11, 2000
- CVE-2000-0284High 7.5Buffer overflow in University of Washington imapd version 4.7 allows users with a valid account to execute commands via LIST or other commands.university of washington · imapEPSS68%9 exploitsPublished Apr 16, 2000
- CVE-1999-1053High 7.5guestbook.pl cleanses user-inserted SSI commands by removing text between "" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->".apache · http serverEPSS85%3 exploitsPublished Sep 13, 1999
- CVE-1999-1510High 7.5Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via long (1) USER, (2) LIST, or (3) CWD commands.bisonware · bisonware ftp serverEPSS67%4 exploitsPublished May 17, 1999
- CVE-1999-0502High 7.5A Unix account has a default, null, blank, or missing password.sun · solarisEPSS53%2 exploitsPublished Mar 1, 1998
- CVE-1999-0256High 7.5Buffer overflow in War FTP allows remote execution of commands.microsoft · windows 95EPSS73%4 exploitsPublished Feb 1, 1998
- CVE-1999-0504High 7.5A Windows NT local user or administrator account has a default, null, blank, or missing password.microsoft · windows ntEPSS64%5 exploitsPublished Jan 1, 1997
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2003-0349 | Buffer overflow in the streaming media component for logging multicast requests in the ISAPI for the logging capability of Microsoft Windows Media Services (nsiislog.dll), as installed in IIS 5.0, allows remote attackers to execute arbitrary code via a large POST request to… microsoft · windows 2000 | High 7.5 | 80% | 4 exploits | |
| CVE-2003-0344 | Buffer overflow in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to execute arbitrary code via / (slash) characters in the Type property of an Object tag in a web page. microsoft · internet explorer | High 7.5 | 81% | 4 exploits | |
| CVE-2003-0264 | Multiple buffer overflows in SLMail 5.1.0.4420 allows remote attackers to execute arbitrary code via (1) a long EHLO argument to slmail.exe, (2) a long XTRN argument to slmail.exe, (3) a long string to POPPASSWD, or (4) a long password to the POP3 server. seattle lab software · slmail | High 7.5 | 72% | 5 exploits | |
| CVE-2003-0213 | ctrlpacket.c in PoPToP PPTP server before 1.1.4-b3 allows remote attackers to cause a denial of service via a length field of 0 or 1, which causes a negative value to be fed into a read operation, leading to a buffer overflow. poptop · pptp server | High 7.5 | 71% | 6 exploits | |
| CVE-2003-0220 | Buffer overflow in the administrator authentication process for Kerio Personal Firewall (KPF) 2.1.4 and earlier allows remote attackers to execute arbitrary code via a handshake packet. kerio · personal firewall 2 | High 7.5 | 69% | 6 exploits | |
| CVE-2002-0061 | Apache for Win32 before 1.3.24, and 2.0.x before 2.0.34-beta, allows remote attackers to execute arbitrary commands via shell metacharacters (a | pipe character) provided as arguments to batch (.bat) or .cmd scripts, which are sent unfiltered to the shell interpreter, typically… apache · http server | High 7.5 | 50% | 1 exploit | |
| CVE-2003-0109 | Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request to IIS 5.0. microsoft · windows 2000 | High 7.5 | 86% | 10 exploits | |
| CVE-2003-0050 | parse_xml.cgi in Apple Darwin Streaming Administration Server 4.1.2 and QuickTime Streaming Server 4.1.1 allows remote attackers to execute arbitrary code via shell metacharacters. apple · quicktime streaming server | High 7.5 | 69% | 2 exploits | |
| CVE-2002-2226 | Buffer overflow in tftpd of TFTP32 2.21 and earlier allows remote attackers to execute arbitrary code via a long filename argument. tftpd32 · tftpd32 | High 7.5 | 63% | 3 exploits | |
| CVE-2002-1643 | Multiple buffer overflows in RealNetworks Helix Universal Server 9.0 (9.0.2.768) allow remote attackers to execute arbitrary code via (1) a long Transport field in a SETUP RTSP request, (2) a DESCRIBE RTSP request with a long URL argument, or (3) two simultaneous HTTP GET… realnetworks · helix universal server | High 7.5 | 75% | 4 exploits | |
| CVE-2002-1254 | Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods." microsoft · internet explorer | High 7.5 | 54% | 1 exploit | |
| CVE-2002-1142 | Heap-based buffer overflow in the Remote Data Services (RDS) component of Microsoft Data Access Components (MDAC) 2.1 through 2.6, and Internet Explorer 5.01 through 6.0, allows remote attackers to execute code via a malformed HTTP request to the Data Stub. microsoft · data access components | High 7.5 | 76% | 2 exploits | |
| CVE-2002-0965 | Buffer overflow in TNS Listener for Oracle 9i Database Server on Windows systems, and Oracle 8 on VM, allows local users to execute arbitrary code via a long SERVICE_NAME parameter, which is not properly handled when writing an error message to a log file. oracle · oracle9i | High 7.5 | 70% | 2 exploits | |
| CVE-2002-1059 | Buffer overflow in Van Dyke SecureCRT SSH client before 3.4.6, and 4.x before 4.0 beta 3, allows an SSH server to execute arbitrary code via a long SSH1 protocol version string. van dyke technologies · securecrt | High 7.5 | 60% | 4 exploits | |
| CVE-2002-1123 | Buffer overflow in the authentication function for Microsoft SQL Server 2000 and Microsoft Desktop Engine (MSDE) 2000 allows remote attackers to execute arbitrary code via a long request to TCP port 1433, aka the "Hello" overflow. microsoft · sql server | High 7.5 | 78% | 3 exploits | |
| CVE-2002-1120 | Buffer overflow in Savant Web Server 3.1 and earlier allows remote attackers to execute arbitrary code via a long HTTP GET request. savant · savant web server | High 7.5 | 67% | 5 exploits | |
| CVE-2002-0656 | Buffer overflows in OpenSSL 0.9.6d and earlier, and 0.9.7-beta2 and earlier, allow remote attackers to execute arbitrary code via (1) a large client master key in SSL2 or (2) a large session ID in SSL3. openssl · openssl | High 7.5 | 90% | 1 exploit | |
| CVE-2002-0661 | Directory traversal vulnerability in Apache 2.0 through 2.0.39 on Windows, OS2, and Netware allows remote attackers to read arbitrary files and execute commands via .. apache · http server | High 7.5 | 70% | 1 exploit | |
| CVE-2002-0649 | Multiple buffer overflows in the Resolution Service for Microsoft SQL Server 2000 and Microsoft Desktop Engine 2000 (MSDE) allow remote attackers to cause a denial of service or execute arbitrary code via UDP packets to port 1434 in which (1) a 0x04 byte that causes the SQL… microsoft · sql server | High 7.5 | 85% | 3 exploits | |
| CVE-2002-0392 | Apache 1.3 through 1.3.24, and Apache 2.0 through 2.0.36, allows remote attackers to cause a denial of service and possibly execute arbitrary code via a chunk-encoded HTTP request that causes Apache to use an incorrect size. apache · http server | High 7.5 | 95% | 4 exploits | |
| CVE-2002-0186 | Buffer overflow in the SQLXML ISAPI extension of Microsoft SQL Server 2000 allows remote attackers to execute arbitrary code via data queries with a long content-type parameter, aka "Unchecked Buffer in SQLXML ISAPI Extension." microsoft · sql server | High 7.5 | 55% | 1 exploit | |
| CVE-2002-0371 | Buffer overflow in gopher client for Microsoft Internet Explorer 5.1 through 6.0, Proxy Server 2.0, or ISA Server 2000 allows remote attackers to execute arbitrary code via a gopher:// URL that redirects the user to a real or simulated gopher server that sends a long response. microsoft · internet explorer | High 7.5 | 54% | 1 exploit | |
| CVE-2002-0079 | Buffer overflow in the chunked encoding transfer mechanism in Internet Information Server (IIS) 4.0 and 5.0 Active Server Pages allows attackers to cause a denial of service or execute arbitrary code. microsoft · internet information server | High 7.5 | 77% | 4 exploits | |
| CVE-2002-0148 | Cross-site scripting vulnerability in Internet Information Server (IIS) 4.0, 5.0 and 5.1 allows remote attackers to execute arbitrary script as other users via an HTTP error page. microsoft · internet information server | High 7.5 | 64% | 1 exploit | |
| CVE-2001-0506 | Buffer overflow in ssinc.dll in IIS 5.0 and 4.0 allows local users to gain system privileges via a Server-Side Includes (SSI) directive for a long filename, which triggers the overflow when the directory name is added, aka the "SSI privilege elevation" vulnerability. microsoft · internet information server | High 7.2 | 69% | 1 exploit | |
| CVE-2001-1320 | Network Associates PGP Keyserver 7.0 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via exceptional BER encodings (possibly buffer overflows), as demonstrated by the PROTOS LDAPv3 test suite. pgp · keyserver | High 7.5 | 68% | 2 exploits | |
| CVE-2001-0333 | Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding .. microsoft · internet information server | High 7.5 | 91% | 10 exploits | |
| CVE-2001-0167 | Buffer overflow in AT&T WinVNC (Virtual Network Computing) client 3.3.3r7 and earlier allows remote attackers to execute arbitrary commands via a long rfbConnFailed packet with a long reason string. att · winvnc | High 7.6 | 51% | 2 exploits | |
| CVE-2001-0550 | wu-ftpd 2.6.1 allows remote attackers to execute arbitrary commands via a "~{" argument to commands such as CWD, which is not properly handled by the glob function (ftpglob). washington university · wu-ftpd | High 7.5 | 75% | 2 exploits | |
| CVE-2000-0945 | The web configuration interface for Catalyst 3500 XL switches allows remote attackers to execute arbitrary commands without authentication when the enable password is not set, via a URL containing the /exec/ directory. cisco · catalyst 3500 xl | High 10.0 | 73% | 1 exploit | |
| CVE-2000-0886 | IIS 5.0 allows remote attackers to execute arbitrary commands via a malformed request for an executable file whose name is appended with operating system commands, aka the "Web Server File Request Parsing" vulnerability. microsoft · internet information server | High 7.5 | 69% | 1 exploit | |
| CVE-2000-0884 | IIS 4.0 and 5.0 allows remote attackers to read documents outside of the web root, and possibly execute arbitrary commands, via malformed URLs that contain UNICODE encoded characters, aka the "Web Server Folder Traversal" vulnerability. microsoft · internet information server | High 7.5 | 63% | 9 exploits | |
| CVE-2000-0917 | Format string vulnerability in use_syslog() function in LPRng 3.6.24 allows remote attackers to execute arbitrary commands. caldera · openlinux ebuilder | High 10.0 | 79% | 5 exploits | |
| CVE-2000-0457 | ISM.DLL in IIS 4.0 and 5.0 allows remote attackers to read file contents by requesting the file and appending a large number of encoded spaces (%20) and terminated with a .htr extension, aka the ".HTR File Fragment Reading" or "File Fragment Reading via .HTR" vulnerability. microsoft · internet information server | High 7.5 | 53% | 1 exploit | |
| CVE-2000-0284 | Buffer overflow in University of Washington imapd version 4.7 allows users with a valid account to execute commands via LIST or other commands. university of washington · imap | High 7.5 | 68% | 9 exploits | |
| CVE-1999-1053 | guestbook.pl cleanses user-inserted SSI commands by removing text between "" separators, which allows remote attackers to execute arbitrary commands when guestbook.pl is run on Apache 1.3.9 and possibly other versions, since Apache allows other closing sequences besides "-->". apache · http server | High 7.5 | 85% | 3 exploits | |
| CVE-1999-1510 | Buffer overflows in Bisonware FTP server prior to 4.1 allow remote attackers to cause a denial of service, and possibly execute arbitrary commands, via long (1) USER, (2) LIST, or (3) CWD commands. bisonware · bisonware ftp server | High 7.5 | 67% | 4 exploits | |
| CVE-1999-0502 | A Unix account has a default, null, blank, or missing password. sun · solaris | High 7.5 | 53% | 2 exploits | |
| CVE-1999-0256 | Buffer overflow in War FTP allows remote execution of commands. microsoft · windows 95 | High 7.5 | 73% | 4 exploits | |
| CVE-1999-0504 | A Windows NT local user or administrator account has a default, null, blank, or missing password. microsoft · windows nt | High 7.5 | 64% | 5 exploits |
Showing 851–890 of 890
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.