Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
2,494 vulnerabilities · highest exploit probability first
- CVE-2024-8504High 8.8An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.EPSS76%1 exploitPublished Sep 10, 2024
- CVE-2024-8503Critical 9.8An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records.EPSS79%1 exploitPublished Sep 10, 2024
- CVE-2024-8517Critical 9.8SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue.spip · spipEPSS95%1 exploitPublished Sep 6, 2024
- CVE-2024-7954Critical 9.8The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability.EPSS90%1 exploitPublished Aug 23, 2024
- CVE-2024-6782Critical 9.8Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.EPSS84%1 exploitPublished Aug 6, 2024
- CVE-2023-30625Critical 9.3rudder-server is vulnerable to SQL injectionrudderstack · rudder-serverEPSS86%1 exploitPublished Aug 5, 2024
- CVE-2023-49785Critical 9.3NextChat has full-read SSRF and XSS vulnerability in /api/cors endpointnextchat · nextchatEPSS83%1 exploitPublished Aug 5, 2024
- CVE-2024-7314Critical 9.8anji-plus AJ-Report is affected by an authentication bypass vulnerability.anji-plus · reportEPSS52%2 exploitsPublished Aug 2, 2024
- CVE-2024-20419Critical 10.0A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.cisco · smart software manager on-premEPSS81%1 exploitPublished Jul 18, 2024
- CVE-2024-29510Medium 6.3Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.artifex · ghostscriptEPSS28%1 exploitPublished Jul 4, 2024
- CVE-2024-6387High 8.1openssh: regreSSHion - race condition in SSH allows RCE/DoSopenbsd · opensshEPSS100%1 exploitPublished Jul 2, 2024
- CVE-2012-6664Critical 9.1Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a ..EPSS30%1 exploitPublished Jun 21, 2024
- CVE-2024-25600Critical 10.0Bricks <= 1.9.6 - Unauthenticated Remote Code ExecutionEPSS88%Ransomware3 exploits1 actorPublished Jun 7, 2024
- CVE-2024-3408High 9.3Authentication bypass in dtaleman · d-taleEPSS78%1 exploitPublished Jun 6, 2024
- CVE-2024-37032High 8.8Ollama does not validate the format of the digest (sha256 with 64 hex digits)ollama · ollamaEPSS90%1 exploitPublished May 31, 2024
- CVE-2024-5084Critical 9.8Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Executionhashthemes · hash formEPSS51%1 exploitPublished May 24, 2024
- CVE-2024-21683High 8.8This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.atlassian · confluence data centerEPSS88%Ransomware1 exploit1 actorPublished May 22, 2024
- CVE-2024-25641High 7.2Cacti provides an operational monitoring and fault management framework.cacti · cactiEPSS86%3 exploitsPublished May 14, 2024
- CVE-2024-4548Critical 9.8An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator.deltaww · diaenergieEPSS29%1 exploitPublished May 6, 2024
- CVE-2023-40504Critical 9.8LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability.lg · simple editorEPSS89%1 exploitPublished May 3, 2024
- CVE-2023-40498Critical 9.8LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability.lg · simple editorEPSS85%1 exploitPublished May 3, 2024
- CVE-2023-38096Critical 9.8NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability.netgear · prosafe network management systemEPSS82%1 exploitPublished May 3, 2024
- CVE-2020-14144High 7.2Arbitrary Code Execution in Giteagitea · giteaEPSS95%2 exploitsPublished Apr 22, 2024
- CVE-2024-2961High 7.3The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.gnu · glibcEPSS88%1 exploitPublished Apr 17, 2024
- CVE-2024-31997High 8.8XWiki Platform remote code execution from account through UIExtension parametersxwiki · xwikiEPSS74%1 exploitPublished Apr 10, 2024
- CVE-2024-31984High 8.8XWiki Platform: Remote code execution through space title and Solr space facetxwiki · xwikiEPSS83%1 exploitPublished Apr 10, 2024
- CVE-2024-24809High 8.5Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type.EPSS54%2 exploitsPublished Apr 10, 2024
- CVE-2024-28741High 8.8Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.EPSS78%1 exploitPublished Apr 6, 2024
- CVE-2024-3116Critical 9.8pgAdmin Remote Code Execution (RCE) vulnerabilitypgadmin · pgadmin 4EPSS66%1 exploitPublished Apr 4, 2024
- CVE-2024-2389Critical 9.8In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.progress · flowmonEPSS93%2 exploitsPublished Apr 2, 2024
- CVE-2024-25735Critical 9.1An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.wyrestorm · apollo vx20 firmwareEPSS51%2 exploitsPublished Mar 27, 2024
- CVE-2024-24725High 8.8Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.gibbonedu · gibbonEPSS51%2 exploitsPublished Mar 23, 2024
- CVE-2024-27921High 8.8Grav File Upload Path Traversalgetgrav · gravEPSS61%1 exploitPublished Mar 22, 2024
- CVE-2024-2054Critical 9.8The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.articatech · artica proxyEPSS81%2 exploitsPublished Mar 20, 2024
- CVE-2024-1800High 8.8In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.progress · telerik report serverEPSS40%1 exploitPublished Mar 20, 2024
- CVE-2024-28255Critical 9.8The JwtFilter handles the API authentication by requiring and verifying JWT tokens.open-metadata · openmetadataEPSS73%2 exploitsPublished Mar 15, 2024
- CVE-2024-28254High 8.8The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution.open-metadata · openmetadataEPSS46%1 exploitPublished Mar 15, 2024
- CVE-2024-27956Critical 9.8Automatic <= 3.92.0 - Unauthenticated SQL Injectionvalvepress · automaticEPSS94%1 exploitPublished Mar 12, 2024
- CVE-2024-2044Critical 9.4pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated userpgadmin · pgadmin 4EPSS79%1 exploitPublished Mar 7, 2024
- CVE-2023-40000Medium 6.1LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'litespeedtech · litespeed cacheEPSS55%1 exploitPublished Feb 26, 2024
- CVE-2023-47218High 8.3An OS command injection vulnerability has been reported to affect several QNAP operating system versions.qnap · qtsEPSS90%1 exploitPublished Feb 13, 2024
- CVE-2024-23759Critical 9.8Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.gambio · gambioEPSS48%1 exploitPublished Feb 12, 2024
- CVE-2023-50386High 8.8Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsapache · solrEPSS84%1 exploitPublished Feb 9, 2024
- CVE-2024-21888High 8.8A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.ivanti · connect secureEPSS85%1 exploitPublished Feb 1, 2024
- CVE-2023-52251High 8.8An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.provectus · uiEPSS87%2 exploitsPublished Jan 25, 2024
- CVE-2024-22729Critical 9.8NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.netis-systems · mw5360 firmwareEPSS71%2 exploitsPublished Jan 25, 2024
- CVE-2024-0204Critical 9.8Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.fortra · goanywhere managed file transferEPSS95%2 exploitsPublished Jan 22, 2024
- CVE-2023-50919Critical 9.8An issue was discovered on GL.iNet devices before version 4.5.0.gl-inet · gl-a1300 firmwareEPSS48%2 exploitsPublished Jan 12, 2024
- CVE-2023-31446Critical 9.8In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.cassianetworks · xc1000 firmwareEPSS61%1 exploitPublished Jan 10, 2024
- CVE-2024-0305High 7.5Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login.ncast project · ncastEPSS67%1 exploitPublished Jan 8, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-8504 | An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. | High 8.8 | 76% | 1 exploit | |
| CVE-2024-8503 | An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. | Critical 9.8 | 79% | 1 exploit | |
| CVE-2024-8517 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. spip · spip | Critical 9.8 | 95% | 1 exploit | |
| CVE-2024-7954 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. | Critical 9.8 | 90% | 1 exploit | |
| CVE-2024-6782 | Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. | Critical 9.8 | 84% | 1 exploit | |
| CVE-2023-30625 | rudder-server is vulnerable to SQL injection rudderstack · rudder-server | Critical 9.3 | 86% | 1 exploit | |
| CVE-2023-49785 | NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint nextchat · nextchat | Critical 9.3 | 83% | 1 exploit | |
| CVE-2024-7314 | anji-plus AJ-Report is affected by an authentication bypass vulnerability. anji-plus · report | Critical 9.8 | 52% | 2 exploits | |
| CVE-2024-20419 | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. cisco · smart software manager on-prem | Critical 10.0 | 81% | 1 exploit | |
| CVE-2024-29510 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. artifex · ghostscript | Medium 6.3 | 28% | 1 exploit | |
| CVE-2024-6387 | openssh: regreSSHion - race condition in SSH allows RCE/DoS openbsd · openssh | High 8.1 | 100% | 1 exploit | |
| CVE-2012-6664 | Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. | Critical 9.1 | 30% | 1 exploit | |
| CVE-2024-25600 | Bricks <= 1.9.6 - Unauthenticated Remote Code Execution | Critical 10.0 | 88% | Ransomware3 exploits1 actor | |
| CVE-2024-3408 | Authentication bypass in dtale man · d-tale | High 9.3 | 78% | 1 exploit | |
| CVE-2024-37032 | Ollama does not validate the format of the digest (sha256 with 64 hex digits) ollama · ollama | High 8.8 | 90% | 1 exploit | |
| CVE-2024-5084 | Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution hashthemes · hash form | Critical 9.8 | 51% | 1 exploit | |
| CVE-2024-21683 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. atlassian · confluence data center | High 8.8 | 88% | Ransomware1 exploit1 actor | |
| CVE-2024-25641 | Cacti provides an operational monitoring and fault management framework. cacti · cacti | High 7.2 | 86% | 3 exploits | |
| CVE-2024-4548 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. deltaww · diaenergie | Critical 9.8 | 29% | 1 exploit | |
| CVE-2023-40504 | LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-40498 | LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 85% | 1 exploit | |
| CVE-2023-38096 | NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. netgear · prosafe network management system | Critical 9.8 | 82% | 1 exploit | |
| CVE-2020-14144 | Arbitrary Code Execution in Gitea gitea · gitea | High 7.2 | 95% | 2 exploits | |
| CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. gnu · glibc | High 7.3 | 88% | 1 exploit | |
| CVE-2024-31997 | XWiki Platform remote code execution from account through UIExtension parameters xwiki · xwiki | High 8.8 | 74% | 1 exploit | |
| CVE-2024-31984 | XWiki Platform: Remote code execution through space title and Solr space facet xwiki · xwiki | High 8.8 | 83% | 1 exploit | |
| CVE-2024-24809 | Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. | High 8.5 | 54% | 2 exploits | |
| CVE-2024-28741 | Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component. | High 8.8 | 78% | 1 exploit | |
| CVE-2024-3116 | pgAdmin Remote Code Execution (RCE) vulnerability pgadmin · pgadmin 4 | Critical 9.8 | 66% | 1 exploit | |
| CVE-2024-2389 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. progress · flowmon | Critical 9.8 | 93% | 2 exploits | |
| CVE-2024-25735 | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. wyrestorm · apollo vx20 firmware | Critical 9.1 | 51% | 2 exploits | |
| CVE-2024-24725 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI. gibbonedu · gibbon | High 8.8 | 51% | 2 exploits | |
| CVE-2024-27921 | Grav File Upload Path Traversal getgrav · grav | High 8.8 | 61% | 1 exploit | |
| CVE-2024-2054 | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. articatech · artica proxy | Critical 9.8 | 81% | 2 exploits | |
| CVE-2024-1800 | In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability. progress · telerik report server | High 8.8 | 40% | 1 exploit | |
| CVE-2024-28255 | The JwtFilter handles the API authentication by requiring and verifying JWT tokens. open-metadata · openmetadata | Critical 9.8 | 73% | 2 exploits | |
| CVE-2024-28254 | The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. open-metadata · openmetadata | High 8.8 | 46% | 1 exploit | |
| CVE-2024-27956 | Automatic <= 3.92.0 - Unauthenticated SQL Injection valvepress · automatic | Critical 9.8 | 94% | 1 exploit | |
| CVE-2024-2044 | pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user pgadmin · pgadmin 4 | Critical 9.4 | 79% | 1 exploit | |
| CVE-2023-40000 | LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg' litespeedtech · litespeed cache | Medium 6.1 | 55% | 1 exploit | |
| CVE-2023-47218 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. qnap · qts | High 8.3 | 90% | 1 exploit | |
| CVE-2024-23759 | Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function. gambio · gambio | Critical 9.8 | 48% | 1 exploit | |
| CVE-2023-50386 | Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets apache · solr | High 8.8 | 84% | 1 exploit | |
| CVE-2024-21888 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator. ivanti · connect secure | High 8.8 | 85% | 1 exploit | |
| CVE-2023-52251 | An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. provectus · ui | High 8.8 | 87% | 2 exploits | |
| CVE-2024-22729 | NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. netis-systems · mw5360 firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2024-0204 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. fortra · goanywhere managed file transfer | Critical 9.8 | 95% | 2 exploits | |
| CVE-2023-50919 | An issue was discovered on GL.iNet devices before version 4.5.0. gl-inet · gl-a1300 firmware | Critical 9.8 | 48% | 2 exploits | |
| CVE-2023-31446 | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. cassianetworks · xc1000 firmware | Critical 9.8 | 61% | 1 exploit | |
| CVE-2024-0305 | Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. ncast project · ncast | High 7.5 | 67% | 1 exploit |
Showing 101–150 of 2,494
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.