Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 19, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
890 vulnerabilities · highest exploit probability first
  • CVE-2024-21888High 8.8
    A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.
    ivanti · connect secure
    EPSS85%
    1 exploit
    Published Feb 1, 2024
  • CVE-2023-52251High 8.8
    An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.
    provectus · ui
    EPSS87%
    2 exploits
    Published Jan 25, 2024
  • CVE-2024-0305High 7.5
    Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login.
    ncast project · ncast
    EPSS67%
    1 exploit
    Published Jan 8, 2024
  • CVE-2023-51448High 8.8
    Cacti provides an operational monitoring and fault management framework.
    cacti · cacti
    EPSS67%
    2 exploits
    Published Dec 22, 2023
  • CVE-2023-49085High 8.8
    Cacti provides an operational monitoring and fault management framework.
    cacti · cacti
    EPSS74%
    3 exploits
    Published Dec 22, 2023
  • CVE-2023-49084High 8.8
    While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server.
    cacti · cacti
    EPSS64%
    2 exploits
    Published Dec 21, 2023
  • CVE-2023-6893High 7.5
    Affected by this issue is some unknown functionality of the file /php/exportrecord.php.
    hikvision · intercom broadcast system
    EPSS70%
    1 exploit
    Published Dec 17, 2023
  • CVE-2023-46214High 8.8
    In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply.
    splunk · splunk
    EPSS89%
    1 exploit
    Published Nov 16, 2023
  • CVE-2023-43661High 8.8
    Cachet vulnerable to Authenticated Remote Code Execution
    all-three · cachet
    EPSS51%
    1 exploit
    Published Oct 16, 2023
  • CVE-2023-43261High 7.5
    An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.
    milesight · ur32 firmware
    EPSS64%
    1 exploit
    Published Oct 4, 2023
  • CVE-2023-5151High 8.8
    UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231.
    dlink · dar-8000 firmware
    EPSS81%
    1 exploit
    Published Sep 25, 2023
  • CVE-2023-38146High 8.8
    Windows Themes Remote Code Execution Vulnerability
    microsoft · windows 11 21h2
    EPSS37%
    1 exploit
    Published Sep 19, 2023
  • CVE-2023-39362High 7.2
    In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server.
    cacti · cacti
    EPSS85%
    3 exploits
    Published Sep 6, 2023
  • CVE-2023-38836High 8.8
    File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.
    boidcms · boidcms
    EPSS76%
    3 exploits
    Published Aug 21, 2023
  • CVE-2023-4415High 8.8
    It has been rated as critical.
    ruijienetworks · rg-ew1200g firmware
    EPSS58%
    1 exploit
    Published Aug 18, 2023
  • CVE-2022-21661High 7.5
    wordpress - security update
    wordpress · wordpress
    EPSS98%
    2 exploits
    Published Aug 14, 2023
  • CVE-2023-36255High 8.8
    An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.
    eramba · eramba
    EPSS53%
    1 exploit
    Published Aug 2, 2023
  • CVE-2023-34127High 8.8
    Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges.
    sonicwall · analytics
    EPSS86%
    1 exploit
    Published Jul 13, 2023
  • CVE-2023-34133High 7.5
    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database.
    sonicwall · analytics
    EPSS73%
    1 exploit
    Published Jul 13, 2023
  • CVE-2023-36969High 8.8
    CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.
    cmsmadesimple · cms made simple
    EPSS49%
    1 exploit
    Published Jul 6, 2023
  • CVE-2023-3450High 7.2
    The manipulation leads to os command injection.
    ruijie · rg-bcr860 firmware
    EPSS51%
    1 exploit
    Published Jun 28, 2023
  • CVE-2023-34468High 8.8
    Apache NiFi vulnerable to Code Injection
    apache · nifi
    EPSS62%
    1 exploit
    Published Jun 12, 2023
  • CVE-2023-34096High 8.8
    In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system.
    thruk · thruk
    EPSS63%
    6 exploits
    Published Jun 8, 2023
  • CVE-2023-32707High 8.8
    In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing…
    splunk · splunk cloud platform
    EPSS79%
    2 exploits
    Published Jun 1, 2023
  • CVE-2023-30253High 8.8
    Dolibarr vulnerable to remote code execution via uppercase manipulation
    dolibarr · dolibarr erp\/crm
    EPSS82%
    1 exploit
    Published May 30, 2023
  • CVE-2023-2766High 7.5
    The manipulation leads to files or directories accessible.
    weaver · e-office
    EPSS54%
    1 exploit
    Published May 17, 2023
  • CVE-2023-28128High 7.2
    An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.
    ivanti · avalanche
    EPSS85%
    1 exploit
    Published May 9, 2023
  • CVE-2023-28384High 8.8
    mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.
    myscada · mypro
    EPSS45%
    1 exploit
    Published Apr 27, 2023
  • CVE-2023-28770High 7.5
    The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from…
    zyxel · dx5401-b0 firmware
    EPSS58%
    1 exploit
    Published Apr 27, 2023
  • CVE-2023-29524High 8.8
    XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheet
    xwiki · xwiki
    EPSS76%
    1 exploit
    Published Apr 20, 2023
  • CVE-2023-21931High 7.5
    Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.
    oracle · weblogic server
    EPSS82%
    1 exploit
    Published Apr 19, 2023
  • CVE-2023-29084High 7.2
    Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.
    zohocorp · manageengine admanager plus
    EPSS98%
    1 exploit
    Published Apr 14, 2023
  • CVE-2023-27179High 7.5
    GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.
    gdidees · gdidees cms
    EPSS61%
    1 exploit
    Published Apr 11, 2023
  • CVE-2023-26067High 8.1
    Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).
    lexmark · cslbl firmware
    EPSS38%
    1 exploit
    Published Apr 10, 2023
  • CVE-2023-27253High 8.8
    A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.
    netgate · pfsense
    EPSS90%
    2 exploits
    Published Mar 17, 2023
  • CVE-2023-25573High 7.5
    In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication.
    metersphere · metersphere
    EPSS52%
    1 exploit
    Published Mar 9, 2023
  • CVE-2023-26475High 8.8
    xwiki-platform vulnerable to Remote Code Execution in Annotations
    xwiki · xwiki
    EPSS64%
    1 exploit
    Published Mar 2, 2023
  • CVE-2022-47075High 7.5
    An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.
    smartofficepayroll · smartoffice
    EPSS59%
    1 exploit
    Published Feb 28, 2023
  • CVE-2023-24078High 8.8
    Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/.
    realtimelogic · fuguhub
    EPSS53%
    2 exploits
    Published Feb 17, 2023
  • CVE-2023-0159High 7.5
    Extensive VC Addons for WPBakery page builder <= 1.9 - Unauthenticated Local File Inclusion
    wprealize · extensive vc addons for wpbakery page builder
    EPSS55%
    1 exploit
    Published Feb 14, 2023
  • CVE-2023-25194High 8.8
    Apache Kafka Connect vulnerable to Deserialization of Untrusted Data
    apache · kafka connect
    EPSS96%
    1 exploit
    Published Feb 7, 2023
  • CVE-2023-22809High 7.8
    In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process.
    sudo project · sudo
    EPSS55%
    2 exploits
    Published Jan 18, 2023
  • CVE-2023-0315High 8.8
    Froxlor vulnerable to Command Injection
    froxlor · froxlor
    EPSS98%
    2 exploits
    Published Jan 16, 2023
  • CVE-2023-21768High 7.8
    Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
    microsoft · windows 11
    EPSS65%
    1 exploit
    Published Jan 10, 2023
  • CVE-2022-44149High 8.8
    The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component.
    nexxtsolutions · amp300 firmware
    EPSS64%
    4 exploits
    Published Jan 6, 2023
  • CVE-2022-46689High 7.0
    A race condition was addressed with additional validation.
    apple · ipados
    EPSS48%
    1 exploit
    Published Dec 15, 2022
  • CVE-2022-41800High 8.7
    In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint.
    f5 · big-ip access policy manager
    EPSS77%
    3 exploits
    Published Dec 7, 2022
  • CVE-2022-41622High 8.8
    In all versions,
    f5 · big-ip access policy manager
    EPSS92%
    3 exploits
    Published Dec 7, 2022
  • CVE-2022-38108High 7.2
    SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.
    solarwinds · orion platform
    EPSS66%
    1 exploit
    Published Oct 20, 2022
  • CVE-2022-41034High 7.8
    Visual Studio Code Remote Code Execution Vulnerability
    microsoft · visual studio code
    EPSS67%
    1 exploit
    Published Oct 11, 2022
Showing 51–100 of 890

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.