Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,192 vulnerabilities · highest exploit probability first
- CVE-2024-46538Critical 9.3A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.netgate · pfsenseEPSS80%1 exploitPublished Oct 22, 2024
- CVE-2024-9264Critical 9.4Grafana Command Injection And Local File Inclusion Via Sql Expressionsgrafana · grafanaEPSS97%1 exploitPublished Oct 18, 2024
- CVE-2024-9464Critical 9.3An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.paloaltonetworks · expeditionEPSS83%1 exploitPublished Oct 10, 2024
- CVE-2024-5932Critical 9.8GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Executiongivewp · givewpEPSS77%1 exploitPublished Sep 30, 2024
- CVE-2024-8353Critical 9.8GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injectiongivewp · givewpEPSS29%1 exploitPublished Sep 30, 2024
- CVE-2024-47175Critical 9.8The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer.openprinting · libppdEPSS64%2 exploitsPublished Sep 26, 2024
- CVE-2024-8503Critical 9.8An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records.EPSS79%1 exploitPublished Sep 10, 2024
- CVE-2024-8517Critical 9.8SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue.spip · spipEPSS95%1 exploitPublished Sep 6, 2024
- CVE-2024-7954Critical 9.8The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability.EPSS90%1 exploitPublished Aug 23, 2024
- CVE-2024-6782Critical 9.8Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.EPSS84%1 exploitPublished Aug 6, 2024
- CVE-2023-30625Critical 9.3rudder-server is vulnerable to SQL injectionrudderstack · rudder-serverEPSS86%1 exploitPublished Aug 5, 2024
- CVE-2023-49785Critical 9.3NextChat has full-read SSRF and XSS vulnerability in /api/cors endpointnextchat · nextchatEPSS83%1 exploitPublished Aug 5, 2024
- CVE-2024-7314Critical 9.8anji-plus AJ-Report is affected by an authentication bypass vulnerability.anji-plus · reportEPSS52%2 exploitsPublished Aug 2, 2024
- CVE-2024-20419Critical 10.0A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.cisco · smart software manager on-premEPSS81%1 exploitPublished Jul 18, 2024
- CVE-2012-6664Critical 9.1Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a ..EPSS30%1 exploitPublished Jun 21, 2024
- CVE-2024-25600Critical 10.0Bricks <= 1.9.6 - Unauthenticated Remote Code ExecutionEPSS88%Ransomware3 exploits1 actorPublished Jun 7, 2024
- CVE-2024-5084Critical 9.8Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Executionhashthemes · hash formEPSS51%1 exploitPublished May 24, 2024
- CVE-2024-4548Critical 9.8An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator.deltaww · diaenergieEPSS29%1 exploitPublished May 6, 2024
- CVE-2023-40504Critical 9.8LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability.lg · simple editorEPSS89%1 exploitPublished May 3, 2024
- CVE-2023-40498Critical 9.8LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability.lg · simple editorEPSS85%1 exploitPublished May 3, 2024
- CVE-2023-38096Critical 9.8NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability.netgear · prosafe network management systemEPSS82%1 exploitPublished May 3, 2024
- CVE-2024-3116Critical 9.8pgAdmin Remote Code Execution (RCE) vulnerabilitypgadmin · pgadmin 4EPSS66%1 exploitPublished Apr 4, 2024
- CVE-2024-2389Critical 9.8In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.progress · flowmonEPSS93%2 exploitsPublished Apr 2, 2024
- CVE-2024-25735Critical 9.1An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.wyrestorm · apollo vx20 firmwareEPSS51%2 exploitsPublished Mar 27, 2024
- CVE-2024-2054Critical 9.8The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.articatech · artica proxyEPSS81%2 exploitsPublished Mar 20, 2024
- CVE-2024-28255Critical 9.8The JwtFilter handles the API authentication by requiring and verifying JWT tokens.open-metadata · openmetadataEPSS73%2 exploitsPublished Mar 15, 2024
- CVE-2024-27956Critical 9.8Automatic <= 3.92.0 - Unauthenticated SQL Injectionvalvepress · automaticEPSS94%1 exploitPublished Mar 12, 2024
- CVE-2024-2044Critical 9.4pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated userpgadmin · pgadmin 4EPSS79%1 exploitPublished Mar 7, 2024
- CVE-2024-23759Critical 9.8Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.gambio · gambioEPSS48%1 exploitPublished Feb 12, 2024
- CVE-2024-22729Critical 9.8NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.netis-systems · mw5360 firmwareEPSS71%2 exploitsPublished Jan 25, 2024
- CVE-2024-0204Critical 9.8Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.fortra · goanywhere managed file transferEPSS95%2 exploitsPublished Jan 22, 2024
- CVE-2023-50919Critical 9.8An issue was discovered on GL.iNet devices before version 4.5.0.gl-inet · gl-a1300 firmwareEPSS48%2 exploitsPublished Jan 12, 2024
- CVE-2023-31446Critical 9.8In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.cassianetworks · xc1000 firmwareEPSS61%1 exploitPublished Jan 10, 2024
- CVE-2023-7102Critical 9.8Use of a Third Party library produced a vulnerability in Barracuda Networks Inc.barracuda · email security gateway 300 firmwareEPSS45%1 exploitPublished Dec 28, 2023
- CVE-2023-51467Critical 9.8The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary codeapache · ofbizEPSS96%1 exploitPublished Dec 27, 2023
- CVE-2023-6895Critical 9.8It has been declared as critical.hikvision · intercom broadcast systemEPSS89%Ransomware1 exploit1 actorPublished Dec 17, 2023
- CVE-2023-50917Critical 9.8MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters.mjdm · majordomoEPSS38%1 exploitPublished Dec 15, 2023
- CVE-2023-6553Critical 9.8Backup Migration <= 1.3.7 - Unauthenticated Remote Code Executionbackupbliss · backup migrationEPSS98%2 exploitsPublished Dec 10, 2023
- CVE-2023-49070Critical 9.8Pre-auth RCE in Apache Ofbiz 18.12.09.apache · ofbizEPSS95%1 exploitPublished Dec 6, 2023
- CVE-2022-1471Critical 9.8SnakeYaml Constructor Deserialization Remote Code Executionsnakeyaml project · snakeyamlEPSS100%3 exploitsPublished Dec 6, 2023
- CVE-2023-48022Critical 9.8Ray has arbitrary code execution via jobs submission APIanyscale · rayEPSS84%1 exploitPublished Nov 28, 2023
- CVE-2023-43177Critical 9.8CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.crushftp · crushftpEPSS82%1 exploitPublished Nov 17, 2023
- CVE-2023-6019Critical 9.8Ray OS Command Injection vulnerabilityray project · rayEPSS75%2 exploitsPublished Nov 16, 2023
- CVE-2023-46731Critical 9.8XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guestxwiki · xwikiEPSS89%1 exploitPublished Nov 8, 2023
- CVE-2023-5360Critical 9.8Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Uploadroyal-elementor-addons · royal elementor addonsEPSS86%2 exploitsPublished Nov 1, 2023
- CVE-2023-45498Critical 9.8VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.vinchin · vinchin backup and recoveryEPSS20%1 exploitPublished Oct 27, 2023
- CVE-2023-46574Critical 9.8An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.totolink · a3700r firmwareEPSS65%1 exploitPublished Oct 25, 2023
- CVE-2023-5684Critical 9.8It has been declared as critical.byzoro · smart s85f firmwareEPSS78%1 exploitPublished Oct 21, 2023
- CVE-2023-43654Critical 9.8TorchServe Server-Side Request Forgery vulnerabilitypytorch · torchserveEPSS42%1 exploitPublished Oct 2, 2023
- CVE-2023-5222Critical 9.8A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0.viessmann · vitogate 300 firmwareEPSS80%2 exploitsPublished Sep 27, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-46538 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php. netgate · pfsense | Critical 9.3 | 80% | 1 exploit | |
| CVE-2024-9264 | Grafana Command Injection And Local File Inclusion Via Sql Expressions grafana · grafana | Critical 9.4 | 97% | 1 exploit | |
| CVE-2024-9464 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. paloaltonetworks · expedition | Critical 9.3 | 83% | 1 exploit | |
| CVE-2024-5932 | GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution givewp · givewp | Critical 9.8 | 77% | 1 exploit | |
| CVE-2024-8353 | GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection givewp · givewp | Critical 9.8 | 29% | 1 exploit | |
| CVE-2024-47175 | The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. openprinting · libppd | Critical 9.8 | 64% | 2 exploits | |
| CVE-2024-8503 | An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. | Critical 9.8 | 79% | 1 exploit | |
| CVE-2024-8517 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. spip · spip | Critical 9.8 | 95% | 1 exploit | |
| CVE-2024-7954 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. | Critical 9.8 | 90% | 1 exploit | |
| CVE-2024-6782 | Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. | Critical 9.8 | 84% | 1 exploit | |
| CVE-2023-30625 | rudder-server is vulnerable to SQL injection rudderstack · rudder-server | Critical 9.3 | 86% | 1 exploit | |
| CVE-2023-49785 | NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint nextchat · nextchat | Critical 9.3 | 83% | 1 exploit | |
| CVE-2024-7314 | anji-plus AJ-Report is affected by an authentication bypass vulnerability. anji-plus · report | Critical 9.8 | 52% | 2 exploits | |
| CVE-2024-20419 | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. cisco · smart software manager on-prem | Critical 10.0 | 81% | 1 exploit | |
| CVE-2012-6664 | Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. | Critical 9.1 | 30% | 1 exploit | |
| CVE-2024-25600 | Bricks <= 1.9.6 - Unauthenticated Remote Code Execution | Critical 10.0 | 88% | Ransomware3 exploits1 actor | |
| CVE-2024-5084 | Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution hashthemes · hash form | Critical 9.8 | 51% | 1 exploit | |
| CVE-2024-4548 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. deltaww · diaenergie | Critical 9.8 | 29% | 1 exploit | |
| CVE-2023-40504 | LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-40498 | LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 85% | 1 exploit | |
| CVE-2023-38096 | NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. netgear · prosafe network management system | Critical 9.8 | 82% | 1 exploit | |
| CVE-2024-3116 | pgAdmin Remote Code Execution (RCE) vulnerability pgadmin · pgadmin 4 | Critical 9.8 | 66% | 1 exploit | |
| CVE-2024-2389 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. progress · flowmon | Critical 9.8 | 93% | 2 exploits | |
| CVE-2024-25735 | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. wyrestorm · apollo vx20 firmware | Critical 9.1 | 51% | 2 exploits | |
| CVE-2024-2054 | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. articatech · artica proxy | Critical 9.8 | 81% | 2 exploits | |
| CVE-2024-28255 | The JwtFilter handles the API authentication by requiring and verifying JWT tokens. open-metadata · openmetadata | Critical 9.8 | 73% | 2 exploits | |
| CVE-2024-27956 | Automatic <= 3.92.0 - Unauthenticated SQL Injection valvepress · automatic | Critical 9.8 | 94% | 1 exploit | |
| CVE-2024-2044 | pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user pgadmin · pgadmin 4 | Critical 9.4 | 79% | 1 exploit | |
| CVE-2024-23759 | Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function. gambio · gambio | Critical 9.8 | 48% | 1 exploit | |
| CVE-2024-22729 | NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. netis-systems · mw5360 firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2024-0204 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. fortra · goanywhere managed file transfer | Critical 9.8 | 95% | 2 exploits | |
| CVE-2023-50919 | An issue was discovered on GL.iNet devices before version 4.5.0. gl-inet · gl-a1300 firmware | Critical 9.8 | 48% | 2 exploits | |
| CVE-2023-31446 | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. cassianetworks · xc1000 firmware | Critical 9.8 | 61% | 1 exploit | |
| CVE-2023-7102 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. barracuda · email security gateway 300 firmware | Critical 9.8 | 45% | 1 exploit | |
| CVE-2023-51467 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code apache · ofbiz | Critical 9.8 | 96% | 1 exploit | |
| CVE-2023-6895 | It has been declared as critical. hikvision · intercom broadcast system | Critical 9.8 | 89% | Ransomware1 exploit1 actor | |
| CVE-2023-50917 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. mjdm · majordomo | Critical 9.8 | 38% | 1 exploit | |
| CVE-2023-6553 | Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution backupbliss · backup migration | Critical 9.8 | 98% | 2 exploits | |
| CVE-2023-49070 | Pre-auth RCE in Apache Ofbiz 18.12.09. apache · ofbiz | Critical 9.8 | 95% | 1 exploit | |
| CVE-2022-1471 | SnakeYaml Constructor Deserialization Remote Code Execution snakeyaml project · snakeyaml | Critical 9.8 | 100% | 3 exploits | |
| CVE-2023-48022 | Ray has arbitrary code execution via jobs submission API anyscale · ray | Critical 9.8 | 84% | 1 exploit | |
| CVE-2023-43177 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. crushftp · crushftp | Critical 9.8 | 82% | 1 exploit | |
| CVE-2023-6019 | Ray OS Command Injection vulnerability ray project · ray | Critical 9.8 | 75% | 2 exploits | |
| CVE-2023-46731 | XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest xwiki · xwiki | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-5360 | Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload royal-elementor-addons · royal elementor addons | Critical 9.8 | 86% | 2 exploits | |
| CVE-2023-45498 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability. vinchin · vinchin backup and recovery | Critical 9.8 | 20% | 1 exploit | |
| CVE-2023-46574 | An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. totolink · a3700r firmware | Critical 9.8 | 65% | 1 exploit | |
| CVE-2023-5684 | It has been declared as critical. byzoro · smart s85f firmware | Critical 9.8 | 78% | 1 exploit | |
| CVE-2023-43654 | TorchServe Server-Side Request Forgery vulnerability pytorch · torchserve | Critical 9.8 | 42% | 1 exploit | |
| CVE-2023-5222 | A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. viessmann · vitogate 300 firmware | Critical 9.8 | 80% | 2 exploits |
Showing 51–100 of 1,192
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.