Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
2,493 vulnerabilities · highest exploit probability first
- CVE-2025-47916Critical 9.8Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.invisioncommunity · invisioncommunityEPSS84%2 exploitsPublished May 16, 2025
- CVE-2024-46506Critical 10.0NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025.netalertx · netalertxEPSS62%1 exploitPublished May 13, 2025
- CVE-2025-27007Critical 9.8OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege EscalationEPSS54%2 exploitsPublished Apr 29, 2025
- CVE-2025-31650Medium 8.7Apache Tomcat Denial of Service via invalid HTTP priority headerapache · tomcatEPSS61%1 exploitPublished Apr 28, 2025
- CVE-2025-32969Critical 9.3org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIxwiki · xwikiEPSS80%1 exploitPublished Apr 23, 2025
- CVE-2025-2563High 8.1The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privilegeswpeverest · user registration \& membershipEPSS49%1 exploitPublished Apr 14, 2025
- CVE-2025-3102High 8.1SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User CreationEPSS76%1 exploitPublished Apr 9, 2025
- CVE-2025-32375Critical 9.8BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserializationbentoml · bentomlEPSS52%1 exploitPublished Apr 9, 2025
- CVE-2025-27520Critical 9.8BentoML Allows Remote Code Execution (RCE) via Insecure Deserializationbentoml · bentomlEPSS41%1 exploitPublished Apr 4, 2025
- CVE-2025-2945High 8.8pgAdmin 4 Vulnerable to Remote Code Executionpgadmin · pgadmin 4EPSS56%1 exploitPublished Apr 3, 2025
- CVE-2025-2294Critical 9.8Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File InclusionEPSS78%1 exploitPublished Mar 28, 2025
- CVE-2024-55963Medium 6.5A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart.appsmith · appsmithEPSS31%2 exploitsPublished Mar 26, 2025
- CVE-2025-30208High 7.5Vite bypasses server.fs.deny when using ?raw??vitejs · viteEPSS75%3 exploitsPublished Mar 25, 2025
- CVE-2025-1974Critical 9.8ingress-nginx admission controller RCE escalationEPSS99%1 exploitPublished Mar 25, 2025
- CVE-2025-1098High 8.8ingress-nginx controller - configuration injection via unsanitized mirror annotationsEPSS82%1 exploitPublished Mar 25, 2025
- CVE-2025-29927Critical 9.1Authorization Bypass in Next.js Middlewarevercel · next.jsEPSS99%Ransomware1 exploit1 actorPublished Mar 21, 2025
- CVE-2024-12971High 8.6Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6artica · pandora fmsEPSS61%1 exploitPublished Mar 17, 2025
- CVE-2025-29891Medium 4.8Apache Camel Message Header Injection through request parametersapache · camelEPSS76%1 exploitPublished Mar 12, 2025
- CVE-2025-27218Medium 5.3Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.EPSS65%2 exploitsPublished Feb 20, 2025
- CVE-2025-1094High 8.1Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns.EPSS90%1 exploitPublished Feb 13, 2025
- CVE-2025-24367High 8.7An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server.cacti · cactiEPSS54%2 exploitsPublished Jan 27, 2025
- CVE-2024-12084Critical 9.8rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handlingsamba · rsyncEPSS72%1 exploitPublished Jan 16, 2025
- CVE-2024-48760Critical 9.8An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function.gestioip · gestioipEPSS45%3 exploitsPublished Jan 14, 2025
- CVE-2024-12847Critical 9.8NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability.netgear · dgn1000 firmwareEPSS30%3 exploitsPublished Jan 10, 2025
- CVE-2024-56511Critical 9.3Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access.dataease · dataeaseEPSS50%1 exploitPublished Jan 10, 2025
- CVE-2024-55556Critical 9.8A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data.EPSS44%1 exploitPublished Jan 7, 2025
- CVE-2024-11972Critical 9.8The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk…themehunk · hunk companionEPSS59%1 exploitPublished Dec 31, 2024
- CVE-2024-11320Medium 6.9Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.pandorafms · pandora fmsEPSS91%1 exploitPublished Nov 29, 2024
- CVE-2024-42327Critical 9.9A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability.zabbix · zabbixEPSS79%1 exploitPublished Nov 27, 2024
- CVE-2024-47407Critical 10.0A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.EPSS64%1 exploitPublished Nov 22, 2024
- CVE-2024-48990High 7.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.needrestart project · needrestartEPSS21%1 exploitPublished Nov 19, 2024
- CVE-2024-8856Critical 9.8Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Uploadrevmakx · backup and staging by wp time capsuleEPSS94%2 exploitsPublished Nov 18, 2024
- CVE-2024-49754Medium 5.4LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.phplibrenms · librenmsEPSS72%1 exploitPublished Nov 15, 2024
- CVE-2024-10924Critical 9.8Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypassreally-simple-plugins · really simple securityEPSS82%2 exploitsPublished Nov 13, 2024
- CVE-2024-43425High 9.2Moodle Remote Code Execution vulnerabilitymoodle · moodleEPSS88%2 exploitsPublished Nov 7, 2024
- CVE-2024-10914Critical 9.2It has been declared as critical.dlink · dns-320 firmwareEPSS96%1 exploitPublished Nov 7, 2024
- CVE-2024-48307High 9.3JeecgBoot SQL Injection vulnerabilityjeecg · jeecg bootEPSS50%1 exploitPublished Oct 31, 2024
- CVE-2024-51568Critical 9.8CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.cyberpanel · cyberpanelEPSS48%2 exploitsPublished Oct 30, 2024
- CVE-2024-46538Critical 9.3A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.netgate · pfsenseEPSS80%1 exploitPublished Oct 22, 2024
- CVE-2024-37404High 8.8Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.ivanti · connect secureEPSS71%1 exploitPublished Oct 21, 2024
- CVE-2024-9264Critical 9.4Grafana Command Injection And Local File Inclusion Via Sql Expressionsgrafana · grafanaEPSS97%1 exploitPublished Oct 18, 2024
- CVE-2024-9916Medium 6.9A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9.usualtool · usualtoolcmsEPSS74%1 exploitPublished Oct 13, 2024
- CVE-2024-9464Critical 9.3An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.paloaltonetworks · expeditionEPSS83%1 exploitPublished Oct 10, 2024
- CVE-2024-5932Critical 9.8GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Executiongivewp · givewpEPSS77%1 exploitPublished Sep 30, 2024
- CVE-2024-8353Critical 9.8GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injectiongivewp · givewpEPSS29%1 exploitPublished Sep 30, 2024
- CVE-2024-47176Medium 5.3cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.openprinting · cups-browsedEPSS51%2 exploitsPublished Sep 26, 2024
- CVE-2024-47175Critical 9.8The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer.openprinting · libppdEPSS64%2 exploitsPublished Sep 26, 2024
- CVE-2024-47076High 8.6The cfGetPrinterAttributes5 function in libcupsfilters does not sanitize IPP attributes returned from an IPP server.openprinting · libcupsfiltersEPSS80%2 exploitsPublished Sep 26, 2024
- CVE-2024-8522High 7.5LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'thimpress · learnpressEPSS63%1 exploitPublished Sep 13, 2024
- CVE-2024-8504High 8.8An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.EPSS76%1 exploitPublished Sep 10, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-47916 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. invisioncommunity · invisioncommunity | Critical 9.8 | 84% | 2 exploits | |
| CVE-2024-46506 | NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. netalertx · netalertx | Critical 10.0 | 62% | 1 exploit | |
| CVE-2025-27007 | OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege Escalation | Critical 9.8 | 54% | 2 exploits | |
| CVE-2025-31650 | Apache Tomcat Denial of Service via invalid HTTP priority header apache · tomcat | Medium 8.7 | 61% | 1 exploit | |
| CVE-2025-32969 | org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API xwiki · xwiki | Critical 9.3 | 80% | 1 exploit | |
| CVE-2025-2563 | The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges wpeverest · user registration \& membership | High 8.1 | 49% | 1 exploit | |
| CVE-2025-3102 | SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation | High 8.1 | 76% | 1 exploit | |
| CVE-2025-32375 | BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization bentoml · bentoml | Critical 9.8 | 52% | 1 exploit | |
| CVE-2025-27520 | BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization bentoml · bentoml | Critical 9.8 | 41% | 1 exploit | |
| CVE-2025-2945 | pgAdmin 4 Vulnerable to Remote Code Execution pgadmin · pgadmin 4 | High 8.8 | 56% | 1 exploit | |
| CVE-2025-2294 | Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion | Critical 9.8 | 78% | 1 exploit | |
| CVE-2024-55963 | A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. appsmith · appsmith | Medium 6.5 | 31% | 2 exploits | |
| CVE-2025-30208 | Vite bypasses server.fs.deny when using ?raw?? vitejs · vite | High 7.5 | 75% | 3 exploits | |
| CVE-2025-1974 | ingress-nginx admission controller RCE escalation | Critical 9.8 | 99% | 1 exploit | |
| CVE-2025-1098 | ingress-nginx controller - configuration injection via unsanitized mirror annotations | High 8.8 | 82% | 1 exploit | |
| CVE-2025-29927 | Authorization Bypass in Next.js Middleware vercel · next.js | Critical 9.1 | 99% | Ransomware1 exploit1 actor | |
| CVE-2024-12971 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 artica · pandora fms | High 8.6 | 61% | 1 exploit | |
| CVE-2025-29891 | Apache Camel Message Header Injection through request parameters apache · camel | Medium 4.8 | 76% | 1 exploit | |
| CVE-2025-27218 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. | Medium 5.3 | 65% | 2 exploits | |
| CVE-2025-1094 | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. | High 8.1 | 90% | 1 exploit | |
| CVE-2025-24367 | An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. cacti · cacti | High 8.7 | 54% | 2 exploits | |
| CVE-2024-12084 | rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling samba · rsync | Critical 9.8 | 72% | 1 exploit | |
| CVE-2024-48760 | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. gestioip · gestioip | Critical 9.8 | 45% | 3 exploits | |
| CVE-2024-12847 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. netgear · dgn1000 firmware | Critical 9.8 | 30% | 3 exploits | |
| CVE-2024-56511 | Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. dataease · dataease | Critical 9.3 | 50% | 1 exploit | |
| CVE-2024-55556 | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. | Critical 9.8 | 44% | 1 exploit | |
| CVE-2024-11972 | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk… themehunk · hunk companion | Critical 9.8 | 59% | 1 exploit | |
| CVE-2024-11320 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. pandorafms · pandora fms | Medium 6.9 | 91% | 1 exploit | |
| CVE-2024-42327 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. zabbix · zabbix | Critical 9.9 | 79% | 1 exploit | |
| CVE-2024-47407 | A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. | Critical 10.0 | 64% | 1 exploit | |
| CVE-2024-48990 | Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. needrestart project · needrestart | High 7.8 | 21% | 1 exploit | |
| CVE-2024-8856 | Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload revmakx · backup and staging by wp time capsule | Critical 9.8 | 94% | 2 exploits | |
| CVE-2024-49754 | LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php librenms · librenms | Medium 5.4 | 72% | 1 exploit | |
| CVE-2024-10924 | Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass really-simple-plugins · really simple security | Critical 9.8 | 82% | 2 exploits | |
| CVE-2024-43425 | Moodle Remote Code Execution vulnerability moodle · moodle | High 9.2 | 88% | 2 exploits | |
| CVE-2024-10914 | It has been declared as critical. dlink · dns-320 firmware | Critical 9.2 | 96% | 1 exploit | |
| CVE-2024-48307 | JeecgBoot SQL Injection vulnerability jeecg · jeecg boot | High 9.3 | 50% | 1 exploit | |
| CVE-2024-51568 | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. cyberpanel · cyberpanel | Critical 9.8 | 48% | 2 exploits | |
| CVE-2024-46538 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php. netgate · pfsense | Critical 9.3 | 80% | 1 exploit | |
| CVE-2024-37404 | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution. ivanti · connect secure | High 8.8 | 71% | 1 exploit | |
| CVE-2024-9264 | Grafana Command Injection And Local File Inclusion Via Sql Expressions grafana · grafana | Critical 9.4 | 97% | 1 exploit | |
| CVE-2024-9916 | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. usualtool · usualtoolcms | Medium 6.9 | 74% | 1 exploit | |
| CVE-2024-9464 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. paloaltonetworks · expedition | Critical 9.3 | 83% | 1 exploit | |
| CVE-2024-5932 | GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution givewp · givewp | Critical 9.8 | 77% | 1 exploit | |
| CVE-2024-8353 | GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection givewp · givewp | Critical 9.8 | 29% | 1 exploit | |
| CVE-2024-47176 | cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL. openprinting · cups-browsed | Medium 5.3 | 51% | 2 exploits | |
| CVE-2024-47175 | The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. openprinting · libppd | Critical 9.8 | 64% | 2 exploits | |
| CVE-2024-47076 | The cfGetPrinterAttributes5 function in libcupsfilters does not sanitize IPP attributes returned from an IPP server. openprinting · libcupsfilters | High 8.6 | 80% | 2 exploits | |
| CVE-2024-8522 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' thimpress · learnpress | High 7.5 | 63% | 1 exploit | |
| CVE-2024-8504 | An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. | High 8.8 | 76% | 1 exploit |
Showing 51–100 of 2,493
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.