Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
401 vulnerabilities · highest exploit probability first
- CVE-2014-0094Medium 5.0ClassLoader manipulation in Apache Strutsapache · strutsEPSS99%3 exploitsPublished May 14, 2022
- CVE-2011-5034Medium 5.3Apache Geronimo Hash Collisions Cause DoSapache · geronimoEPSS81%1 exploitPublished May 13, 2022
- CVE-2022-1175Medium 6.1Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.gitlab · gitlabEPSS82%1 exploitPublished May 12, 2022
- CVE-2022-1104Medium 4.8Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scriptingcode-atlantic · popup makerEPSS56%1 exploitPublished May 10, 2022
- CVE-2012-0392Medium 6.8Apache Struts's CookieInterceptor component does not use the parameter-name whitelistapache · strutsEPSS98%1 exploitPublished May 4, 2022
- CVE-2012-0394Medium 6.8Apache Struts's DebuggingInterceptor component allows remote code execution in developer modeapache · strutsEPSS73%3 exploitsPublished May 4, 2022
- CVE-2009-0580Medium 4.3Exposure of Sensitive Information in Apache Tomcatapache · tomcatEPSS94%1 exploitPublished May 2, 2022
- CVE-2008-2938Medium 4.3Apache Tomcat Directory Traversal vulnerabilityapache · tomcatEPSS100%2 exploitsPublished May 1, 2022
- CVE-2008-2370Medium 5.0Apache Tomcat Path Traversal Vulnerabilityapache · tomcatEPSS53%1 exploitPublished May 1, 2022
- CVE-2008-1232Medium 4.3Apache Tomcat Cross-site scripting (XSS) vulnerabilityapache · tomcatEPSS76%1 exploitPublished May 1, 2022
- CVE-2007-5333Medium 5.0Exposure of Sensitive Information in Apache Tomcatapache · tomcatEPSS63%1 exploitPublished May 1, 2022
- CVE-2007-2449Medium 4.3Apache Tomcat XSS Vulnerabilities in Examples Web Applicationapache · tomcatEPSS77%1 exploitPublished May 1, 2022
- CVE-2007-1355Medium 5.3Apache Tomcat Vulnerable to Cross-Site Scriptingapache · tomcatEPSS58%1 exploitPublished May 1, 2022
- CVE-2007-0450Medium 5.0Apache Tomcat Directory Traversalapache · http serverEPSS91%1 exploitPublished May 1, 2022
- CVE-2006-7196Medium 4.3Cross-site scripting in Apache Tomcatapache · tomcatEPSS72%1 exploitPublished May 1, 2022
- CVE-2022-28379Medium 4.8jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.nginxproxymanager · nginx proxy managerEPSS71%1 exploitPublished Apr 3, 2022
- CVE-2022-25305Medium 6.1The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that…veronalabs · wp statisticsEPSS79%1 exploitPublished Feb 24, 2022
- CVE-2021-46065Medium 4.8A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.zohocorp · manageengine servicedesk plusEPSS92%1 exploitPublished Jan 27, 2022
- CVE-2013-3630Medium 4.6Moodle Authenticated Spelling Binary Remote Code Executionmoodle · moodleEPSS42%3 exploitsPublished Oct 13, 2021
- CVE-2021-39327Medium 5.3The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files.ait-pro · bulletproof securityEPSS72%3 exploitsPublished Sep 17, 2021
- CVE-2020-7387Medium 5.3Sage X3 Installation Pathname Disclosure.sage · adxadminEPSS34%1 exploitPublished Jul 22, 2021
- CVE-2018-11784Medium 4.3tomcat7 - security updateapache · tomcatEPSS98%1 exploitPublished Jul 14, 2021
- CVE-2021-28164Medium 5.3In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory.eclipse · jettyEPSS82%2 exploitsPublished Jun 30, 2021
- CVE-2021-1499Medium 5.3A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device.cisco · hyperflex hx data platformEPSS80%2 exploitsPublished Jun 24, 2021
- CVE-2021-31643Medium 5.4An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter.chiyu-tech · bf-630 firmwareEPSS88%1 exploitPublished Jun 1, 2021
- CVE-2021-21983Medium 6.5Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating…vmware · vrealize operations managerEPSS69%2 exploitsPublished May 4, 2021
- CVE-2019-10098Medium 6.1In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.apache · http serverEPSS74%1 exploitPublished Apr 21, 2021
- CVE-2021-29447Medium 6.5A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks.wordpress · wordpressEPSS86%2 exploitsPublished Apr 15, 2021
- CVE-2021-26812Medium 6.1Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module.jitsi · meetEPSS97%1 exploitPublished Apr 14, 2021
- CVE-2021-25299Medium 6.1Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).nagios · nagios xiEPSS98%2 exploitsPublished Feb 15, 2021
- CVE-2020-16040Medium 6.5Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.google · chromeEPSS100%4 exploitsPublished Jan 8, 2021
- CVE-2020-13945Medium 6.5In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.apache · apisixEPSS73%2 exploitsPublished Dec 7, 2020
- CVE-2020-14181Medium 5.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint.atlassian · data centerEPSS100%2 exploitsPublished Sep 16, 2020
- CVE-2020-12027Medium 4.3All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system.rockwellautomation · factorytalk viewEPSS53%1 exploitPublished Jul 20, 2020
- CVE-2020-9496Medium 6.1XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03apache · ofbizEPSS99%5 exploitsPublished Jul 15, 2020
- CVE-2020-8617Medium 5.9Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.isc · bindEPSS93%1 exploitPublished May 19, 2020
- CVE-2020-12256Medium 5.4rConfig 3.9.4 is vulnerable to reflected XSS.rconfig · rconfigEPSS96%1 exploitPublished May 18, 2020
- CVE-2020-11022Medium 6.1Potential XSS vulnerability in jQueryjquery · jqueryEPSS99%2 exploitsPublished Apr 29, 2020
- CVE-2020-10977Medium 5.5GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.gitlab · gitlabEPSS43%2 exploitsPublished Apr 8, 2020
- CVE-2020-11456Medium 5.4LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).limesurvey · limesurveyEPSS71%2 exploitsPublished Apr 1, 2020
- CVE-2019-19985Medium 5.3The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.icegram · email subscribers \& newslettersEPSS71%1 exploitPublished Dec 26, 2019
- CVE-2019-10092Medium 6.1In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.apache · http serverEPSS81%2 exploitsPublished Sep 26, 2019
- CVE-2019-8449Medium 5.3The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.atlassian · jiraEPSS85%2 exploitsPublished Sep 11, 2019
- CVE-2019-1184Medium 6.7An elevation of privilege vulnerability exists when Windows Core Shell COM Server Registrar improperly handles COM calls.microsoft · windows 10EPSS70%1 exploitPublished Aug 14, 2019
- CVE-2019-13396Medium 5.3FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.getflightpath · flightpathEPSS63%2 exploitsPublished Jul 10, 2019
- CVE-2019-7255Medium 6.1Linear eMerge E3-Series devices allow XSS.nortekcontrol · linear emerge elite firmwareEPSS56%2 exploitsPublished Jul 2, 2019
- CVE-2019-1622Medium 5.3A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device.cisco · data center network managerEPSS79%2 exploitsPublished Jun 27, 2019
- CVE-2019-0221Medium 6.1Cross-site scripting in Apache Tomcatapache · tomcatEPSS59%1 exploitPublished May 30, 2019
- CVE-2019-12347Medium 6.1In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action.netgate · pfsenseEPSS59%2 exploitsPublished May 29, 2019
- CVE-2019-3799Medium 6.5Path Traversal in Spring Cloud Configvmware · spring cloud configEPSS85%1 exploitPublished May 23, 2019
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2014-0094 | ClassLoader manipulation in Apache Struts apache · struts | Medium 5.0 | 99% | 3 exploits | |
| CVE-2011-5034 | Apache Geronimo Hash Collisions Cause DoS apache · geronimo | Medium 5.3 | 81% | 1 exploit | |
| CVE-2022-1175 | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes. gitlab · gitlab | Medium 6.1 | 82% | 1 exploit | |
| CVE-2022-1104 | Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scripting code-atlantic · popup maker | Medium 4.8 | 56% | 1 exploit | |
| CVE-2012-0392 | Apache Struts's CookieInterceptor component does not use the parameter-name whitelist apache · struts | Medium 6.8 | 98% | 1 exploit | |
| CVE-2012-0394 | Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode apache · struts | Medium 6.8 | 73% | 3 exploits | |
| CVE-2009-0580 | Exposure of Sensitive Information in Apache Tomcat apache · tomcat | Medium 4.3 | 94% | 1 exploit | |
| CVE-2008-2938 | Apache Tomcat Directory Traversal vulnerability apache · tomcat | Medium 4.3 | 100% | 2 exploits | |
| CVE-2008-2370 | Apache Tomcat Path Traversal Vulnerability apache · tomcat | Medium 5.0 | 53% | 1 exploit | |
| CVE-2008-1232 | Apache Tomcat Cross-site scripting (XSS) vulnerability apache · tomcat | Medium 4.3 | 76% | 1 exploit | |
| CVE-2007-5333 | Exposure of Sensitive Information in Apache Tomcat apache · tomcat | Medium 5.0 | 63% | 1 exploit | |
| CVE-2007-2449 | Apache Tomcat XSS Vulnerabilities in Examples Web Application apache · tomcat | Medium 4.3 | 77% | 1 exploit | |
| CVE-2007-1355 | Apache Tomcat Vulnerable to Cross-Site Scripting apache · tomcat | Medium 5.3 | 58% | 1 exploit | |
| CVE-2007-0450 | Apache Tomcat Directory Traversal apache · http server | Medium 5.0 | 91% | 1 exploit | |
| CVE-2006-7196 | Cross-site scripting in Apache Tomcat apache · tomcat | Medium 4.3 | 72% | 1 exploit | |
| CVE-2022-28379 | jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. nginxproxymanager · nginx proxy manager | Medium 4.8 | 71% | 1 exploit | |
| CVE-2022-25305 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that… veronalabs · wp statistics | Medium 6.1 | 79% | 1 exploit | |
| CVE-2021-46065 | A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code. zohocorp · manageengine servicedesk plus | Medium 4.8 | 92% | 1 exploit | |
| CVE-2013-3630 | Moodle Authenticated Spelling Binary Remote Code Execution moodle · moodle | Medium 4.6 | 42% | 3 exploits | |
| CVE-2021-39327 | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. ait-pro · bulletproof security | Medium 5.3 | 72% | 3 exploits | |
| CVE-2020-7387 | Sage X3 Installation Pathname Disclosure. sage · adxadmin | Medium 5.3 | 34% | 1 exploit | |
| CVE-2018-11784 | tomcat7 - security update apache · tomcat | Medium 4.3 | 98% | 1 exploit | |
| CVE-2021-28164 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. eclipse · jetty | Medium 5.3 | 82% | 2 exploits | |
| CVE-2021-1499 | A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. cisco · hyperflex hx data platform | Medium 5.3 | 80% | 2 exploits | |
| CVE-2021-31643 | An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter. chiyu-tech · bf-630 firmware | Medium 5.4 | 88% | 1 exploit | |
| CVE-2021-21983 | Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating… vmware · vrealize operations manager | Medium 6.5 | 69% | 2 exploits | |
| CVE-2019-10098 | In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. apache · http server | Medium 6.1 | 74% | 1 exploit | |
| CVE-2021-29447 | A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. wordpress · wordpress | Medium 6.5 | 86% | 2 exploits | |
| CVE-2021-26812 | Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. jitsi · meet | Medium 6.1 | 97% | 1 exploit | |
| CVE-2021-25299 | Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). nagios · nagios xi | Medium 6.1 | 98% | 2 exploits | |
| CVE-2020-16040 | Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. google · chrome | Medium 6.5 | 100% | 4 exploits | |
| CVE-2020-13945 | In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. apache · apisix | Medium 6.5 | 73% | 2 exploits | |
| CVE-2020-14181 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. atlassian · data center | Medium 5.3 | 100% | 2 exploits | |
| CVE-2020-12027 | All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. rockwellautomation · factorytalk view | Medium 4.3 | 53% | 1 exploit | |
| CVE-2020-9496 | XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 apache · ofbiz | Medium 6.1 | 99% | 5 exploits | |
| CVE-2020-8617 | Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. isc · bind | Medium 5.9 | 93% | 1 exploit | |
| CVE-2020-12256 | rConfig 3.9.4 is vulnerable to reflected XSS. rconfig · rconfig | Medium 5.4 | 96% | 1 exploit | |
| CVE-2020-11022 | Potential XSS vulnerability in jQuery jquery · jquery | Medium 6.1 | 99% | 2 exploits | |
| CVE-2020-10977 | GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects. gitlab · gitlab | Medium 5.5 | 43% | 2 exploits | |
| CVE-2020-11456 | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups). limesurvey · limesurvey | Medium 5.4 | 71% | 2 exploits | |
| CVE-2019-19985 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure. icegram · email subscribers \& newsletters | Medium 5.3 | 71% | 1 exploit | |
| CVE-2019-10092 | In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. apache · http server | Medium 6.1 | 81% | 2 exploits | |
| CVE-2019-8449 | The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability. atlassian · jira | Medium 5.3 | 85% | 2 exploits | |
| CVE-2019-1184 | An elevation of privilege vulnerability exists when Windows Core Shell COM Server Registrar improperly handles COM calls. microsoft · windows 10 | Medium 6.7 | 70% | 1 exploit | |
| CVE-2019-13396 | FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module. getflightpath · flightpath | Medium 5.3 | 63% | 2 exploits | |
| CVE-2019-7255 | Linear eMerge E3-Series devices allow XSS. nortekcontrol · linear emerge elite firmware | Medium 6.1 | 56% | 2 exploits | |
| CVE-2019-1622 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. cisco · data center network manager | Medium 5.3 | 79% | 2 exploits | |
| CVE-2019-0221 | Cross-site scripting in Apache Tomcat apache · tomcat | Medium 6.1 | 59% | 1 exploit | |
| CVE-2019-12347 | In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. netgate · pfsense | Medium 6.1 | 59% | 2 exploits | |
| CVE-2019-3799 | Path Traversal in Spring Cloud Config vmware · spring cloud config | Medium 6.5 | 85% | 1 exploit |
Showing 51–100 of 401
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.