Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
2,494 vulnerabilities · highest exploit probability first
  • CVE-2015-1328High 7.8
    The overlayfs implementation in the linux (aka Linux kernel) package before 3.19.0-21.21 in Ubuntu through 15.04 does not properly check permissions for file creation in the upper filesystem directory, which allows local users to obtain root access by leveraging a configuration…
    linux · linux kernel
    EPSS38%
    5 exploits
    Published Nov 28, 2016
  • CVE-2016-7241High 7.5
    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
    microsoft · edge
    EPSS71%
    3 exploits
    Published Nov 10, 2016
  • CVE-2016-7237Medium 6.5
    Local Security Authority Subsystem Service (LSASS) in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, and 1607, and Windows Server 2016 allows remote…
    microsoft · windows 10
    EPSS67%
    1 exploit
    Published Nov 10, 2016
  • CVE-2016-8870High 8.1
    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!
    joomla · joomla\!
    EPSS81%
    2 exploits
    Published Nov 4, 2016
  • CVE-2016-8869Critical 9.8
    The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla!
    joomla · joomla\!
    EPSS97%
    2 exploits
    Published Nov 4, 2016
  • CVE-2016-8582Critical 9.8
    A vulnerability exists in gauge.php of AlienVault OSSIM and USM before 5.3.2 that allows an attacker to execute an arbitrary SQL query and retrieve database information or read local system files via MySQL's LOAD_FILE.
    alienvault · open source security information and event management
    EPSS57%
    2 exploits
    Published Oct 28, 2016
  • CVE-2016-3209Medium 5.5
    Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; Office 2007 SP3; Office 2010 SP2; Word Viewer; Skype for…
    microsoft · live meeting
    EPSS54%
    1 exploit
    Published Oct 13, 2016
  • CVE-2016-6433High 8.8
    The Threat Management Console in Cisco Firepower Management Center 5.2.0 through 6.0.1 allows remote authenticated users to execute arbitrary commands via crafted web-application parameters, aka Bug ID CSCva30872.
    cisco · secure firewall management center
    EPSS81%
    3 exploits
    Published Oct 6, 2016
  • CVE-2016-2776High 7.5
    buffer.c in named in ISC BIND 9 before 9.9.9-P3, 9.10.x before 9.10.4-P3, and 9.11.x before 9.11.0rc3 does not properly construct responses, which allows remote attackers to cause a denial of service (assertion failure and daemon exit) via a crafted query.
    isc · bind
    EPSS89%
    1 exploit
    Published Sep 28, 2016
  • CVE-2016-6662Critical 9.8
    mysql: general_log can write to configuration files, leading to privilege escalation (CPU Oct 2016)
    mariadb · mariadb
    EPSS68%
    2 exploits
    Published Sep 20, 2016
  • CVE-2016-3357High 7.8
    Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePoint Server 2010 SP2, SharePoint Server 2013 SP1, Excel Automation Services on SharePoint Server…
    microsoft · office
    EPSS55%
    1 exploit
    Published Sep 14, 2016
  • CVE-2016-3325Low 3.1
    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
    microsoft · edge
    EPSS54%
    1 exploit
    Published Sep 14, 2016
  • CVE-2016-3247High 7.5
    Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Browser Memory Corruption Vulnerability."
    microsoft · edge
    EPSS71%
    1 exploit
    Published Sep 14, 2016
  • CVE-2016-4264High 8.6
    The Office Open XML (OOXML) feature in Adobe ColdFusion 10 before Update 21 and 11 before Update 10 allows remote attackers to read arbitrary files or send TCP requests to intranet servers via a crafted OOXML spreadsheet containing an external entity declaration in conjunction…
    adobe · coldfusion
    EPSS69%
    1 exploit
    Published Sep 1, 2016
  • CVE-2016-5676High 7.5
    cgi-bin/cgi_system in NUUO NVRmini 2 1.7.5 through 2.x, NUUO NVRsolo 1.7.5 through 2.x, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to reset the administrator password via a cmd=loaddefconfig action.
    netgear · readynas surveillance
    EPSS54%
    1 exploit
    Published Aug 31, 2016
  • CVE-2016-5675Critical 9.8
    handle_daylightsaving.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.0.0 through 3.0.0, NUUO Crystal 2.2.1 through 3.2.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the NTPServer parameter.
    netgear · readynas surveillance
    EPSS71%
    2 exploits
    Published Aug 31, 2016
  • CVE-2016-5674Critical 9.8
    debugging_center_utils_.php in NUUO NVRmini 2 1.7.5 through 3.0.0, NUUO NVRsolo 1.7.5 through 3.0.0, and NETGEAR ReadyNAS Surveillance 1.1.1 through 1.4.1 allows remote attackers to execute arbitrary PHP code via the log parameter.
    netgear · readynas surveillance
    EPSS95%
    2 exploits
    Published Aug 31, 2016
  • CVE-2016-6195Critical 9.8
    SQL injection vulnerability in forumrunner/includes/moderation.php in vBulletin before 4.2.2 Patch Level 5 and 4.2.3 before Patch Level 1 allows remote attackers to execute arbitrary SQL commands via the postids parameter to forumrunner/request.php, as exploited in the wild in…
    vbulletin · vbulletin
    EPSS68%
    1 exploit
    Published Aug 30, 2016
  • CVE-2016-3304High 7.8
    The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers…
    microsoft · live meeting
    EPSS51%
    1 exploit
    Published Aug 9, 2016
  • CVE-2016-3303High 7.8
    The Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Office 2007 SP3, Office 2010 SP2, Word Viewer, Skype for Business 2016, Lync 2013 SP1, Lync 2010, Lync 2010 Attendee, and Live Meeting 2007 Console allows remote attackers…
    microsoft · live meeting
    EPSS51%
    1 exploit
    Published Aug 9, 2016
  • CVE-2016-3288High 7.5
    Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code via a crafted web page, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-3290.
    microsoft · internet explorer
    EPSS52%
    1 exploit
    Published Aug 9, 2016
  • CVE-2016-6515High 7.5
    The auth_password function in auth-passwd.c in sshd in OpenSSH before 7.3 does not limit password lengths for password authentication, which allows remote attackers to cause a denial of service (crypt CPU consumption) via a long string.
    openbsd · openssh
    EPSS59%
    1 exploit
    Published Aug 7, 2016
  • CVE-2016-3510Critical 9.8
    Unspecified vulnerability in the Oracle WebLogic Server component in Oracle Fusion Middleware 10.3.6.0, 12.1.3.0, and 12.2.1.0 allows remote attackers to affect confidentiality, integrity, and availability via vectors related to WLS Core Components, a different vulnerability…
    oracle · weblogic server
    EPSS91%
    1 exploit
    Published Jul 21, 2016
  • CVE-2016-3225High 7.8
    The SMB server component in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application that forwards an…
    microsoft · windows 10
    EPSS43%
    3 exploits
    Published Jun 15, 2016
  • CVE-2016-3222High 8.8
    Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Microsoft Edge Memory Corruption Vulnerability."
    microsoft · edge
    EPSS57%
    1 exploit
    Published Jun 15, 2016
  • CVE-2016-0199High 8.8
    Microsoft Internet Explorer 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Internet Explorer Memory Corruption Vulnerability," a different vulnerability than CVE-2016-0200 and…
    microsoft · internet explorer
    EPSS51%
    3 exploits
    Published Jun 15, 2016
  • CVE-2016-1543High 7.5
    The RPC API in the RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and reset arbitrary user passwords by sending an action packet to xmlrpc after an authorization failure.
    bmc · bladelogic server automation console
    EPSS72%
    3 exploits
    Published Jun 13, 2016
  • CVE-2016-1542High 7.5
    The RPC API in RSCD agent in BMC BladeLogic Server Automation (BSA) 8.2.x, 8.3.x, 8.5.x, 8.6.x, and 8.7.x on Linux and UNIX allows remote attackers to bypass authorization and enumerate users by sending an action packet to xmlrpc after an authorization failure.
    bmc · bladelogic server automation console
    EPSS75%
    3 exploits
    Published Jun 13, 2016
  • CVE-2016-2296Critical 9.4
    Meteocontrol WEB'log Basic 100, Light, Pro, and Pro Unlimited does not require authentication for "post-admin" login pages, which allows remote attackers to obtain sensitive information or modify data via unspecified vectors.
    meteocontrol · web\'log basic 100
    EPSS64%
    1 exploit
    Published May 14, 2016
  • CVE-2016-2107Medium 5.9
    The AES-NI implementation in OpenSSL before 1.0.1t and 1.0.2 before 1.0.2h does not consider memory allocation during a certain padding check, which allows remote attackers to obtain sensitive cleartext information via a padding-oracle attack against an AES CBC session.
    openssl · openssl
    EPSS89%
    1 exploit
    Published May 5, 2016
  • CVE-2016-1209High 8.1
    Ninja Forms Contact Form 2.9.36 - 2.9.42 - Unauthenticated Arbitrary File Upload
    ninjaforms · ninja forms
    EPSS62%
    3 exploits
    Published May 4, 2016
  • CVE-2016-3078Critical 9.8
    php: Heap overflow caused by integer overflow when reading zip files in ZipArchive
    php · php
    EPSS56%
    2 exploits
    Published Apr 28, 2016
  • CVE-2016-1593High 7.2
    Directory traversal vulnerability in the import users feature in Micro Focus Novell Service Desk before 7.2 allows remote authenticated administrators to upload and execute arbitrary JSP files via a ..
    novell · service desk
    EPSS64%
    3 exploits
    Published Apr 22, 2016
  • CVE-2016-2004Critical 9.8
    HPE Data Protector before 7.03_108, 8.x before 8.15, and 9.x before 9.06 allow remote attackers to execute arbitrary code via unspecified vectors related to lack of authentication.
    hp · data protector
    EPSS94%
    6 exploits
    Published Apr 21, 2016
  • CVE-2016-2056High 8.8
    xymond in Xymon 4.1.x, 4.2.x, and 4.3.x before 4.3.25 allow remote authenticated users to execute arbitrary commands via shell metacharacters in the adduser_name argument in (1) web/useradm.c or (2) web/chpasswd.c.
    xymon · xymon
    EPSS55%
    2 exploits
    Published Apr 13, 2016
  • CVE-2015-8399Medium 4.3
    Atlassian Confluence before 5.8.17 allows remote authenticated users to read configuration files via the decoratorName parameter to (1) spaces/viewdefaultdecorator.action or (2) admin/viewdefaultdecorator.action.
    atlassian · confluence
    EPSS60%
    1 exploit
    Published Apr 11, 2016
  • CVE-2016-2345Critical 9.8
    Stack-based buffer overflow in dwrcs.exe in the dwmrcs daemon in SolarWinds DameWare Mini Remote Control 12.0 allows remote attackers to execute arbitrary code via a crafted string.
    dameware · mini remote control
    EPSS51%
    1 exploit
    Published Mar 17, 2016
  • CVE-2016-0100High 8.4
    Microsoft Windows Vista SP2 and Server 2008 SP2 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Library Loading Input Validation Remote Code Execution Vulnerability."
    microsoft · windows vista
    EPSS57%
    2 exploits
    Published Mar 9, 2016
  • CVE-2015-7547High 8.1
    Multiple stack-based buffer overflows in the (1) send_dg and (2) send_vc functions in the libresolv library in the GNU C Library (aka glibc or libc6) before 2.23 allow remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted DNS…
    gnu · glibc
    EPSS91%
    2 exploits
    Published Feb 18, 2016
  • CVE-2016-1525High 8.6
    Directory traversal vulnerability in data/config/image.do in NETGEAR Management System NMS300 1.5.0.11 and earlier allows remote authenticated users to read arbitrary files via a ..
    netgear · prosafe network management software 300
    EPSS75%
    3 exploits
    Published Feb 13, 2016
  • CVE-2016-1524Critical 9.6
    Multiple unrestricted file upload vulnerabilities in NETGEAR Management System NMS300 1.5.0.11 and earlier allow remote attackers to execute arbitrary Java code by using (1) fileUpload.do or (2) lib-1.0/external/flash/fileUpload.do to upload a JSP file, and then accessing it via…
    netgear · prosafe network management software 300
    EPSS94%
    1 exploit
    Published Feb 13, 2016
  • CVE-2016-1287Critical 9.8
    Buffer overflow in the IKEv1 and IKEv2 implementations in Cisco ASA Software before 8.4(7.30), 8.7 before 8.7(1.18), 9.0 before 9.0(4.38), 9.1 before 9.1(7), 9.2 before 9.2(4.5), 9.3 before 9.3(3.7), 9.4 before 9.4(2.4), and 9.5 before 9.5(2.2) on ASA 5500 devices, ASA 5500-X…
    cisco · adaptive security appliance software
    EPSS74%
    3 exploits
    Published Feb 11, 2016
  • CVE-2016-0051High 7.8
    The WebDAV client in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to gain privileges via a crafted application, aka "WebDAV Elevation…
    microsoft · windows 10
    EPSS23%
    4 exploits
    Published Feb 10, 2016
  • CVE-2016-0041High 7.8
    Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a…
    microsoft · internet explorer
    EPSS83%
    2 exploits
    Published Feb 10, 2016
  • CVE-2016-0492Medium 6.4
    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Load Testing for Web Apps, a different…
    oracle · application testing suite
    EPSS92%
    6 exploits
    Published Jan 21, 2016
  • CVE-2016-0491Medium 6.4
    Unspecified vulnerability in the Oracle Application Testing Suite component in Oracle Enterprise Manager Grid Control 12.4.0.2 and 12.5.0.2 allows remote attackers to affect integrity and availability via unknown vectors related to Load Testing for Web Apps.
    oracle · application testing suite
    EPSS80%
    6 exploits
    Published Jan 21, 2016
  • CVE-2016-1909Critical 9.8
    Fortinet FortiAnalyzer before 5.0.12 and 5.2.x before 5.2.5; FortiSwitch 3.3.x before 3.3.3; FortiCache 3.0.x before 3.0.8; and FortiOS 4.1.x before 4.1.11, 4.2.x before 4.2.16, 4.3.x before 4.3.17 and 5.0.x before 5.0.8 have a hardcoded passphrase for the Fortimanager_Access…
    fortinet · fortios
    EPSS71%
    3 exploits
    Published Jan 15, 2016
  • CVE-2016-0854Critical 9.8
    Unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in the WebAccess Dashboard Viewer in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
    advantech · webaccess
    EPSS77%
    3 exploits
    Published Jan 15, 2016
  • CVE-2015-8279High 8.6
    Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script.
    samsung · web viewer
    EPSS51%
    1 exploit
    Published Jan 15, 2016
  • CVE-2015-8660Medium 6.7
    The ovl_setattr function in fs/overlayfs/inode.c in the Linux kernel through 4.3.3 attempts to merge distinct setattr operations, which allows local users to bypass intended access restrictions and modify the attributes of arbitrary overlay files via a crafted application.
    linux · linux kernel
    EPSS22%
    4 exploits
    Published Dec 28, 2015
Showing 1,151–1,200 of 2,494

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.