Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,192 vulnerabilities · highest exploit probability first
- CVE-2023-41892Critical 9.8Craft CMS Remote Code Execution vulnerabilitycraftcms · craft cmsEPSS94%1 exploitPublished Sep 13, 2023
- CVE-2023-38408Critical 9.8openssh - security updateopenbsd · opensshEPSS80%1 exploitPublished Sep 7, 2023
- CVE-2023-39361Critical 9.8Affected versions are subject to a SQL injection discovered in graph_view.php.cacti · cactiEPSS89%1 exploitPublished Sep 6, 2023
- CVE-2023-4634Critical 9.8Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Executiondavidlingren · media library assistantEPSS86%2 exploitsPublished Sep 4, 2023
- CVE-2023-34039Critical 9.8Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation.vmware · aria operations for networksEPSS67%2 exploitsPublished Aug 30, 2023
- CVE-2023-4542Critical 9.8It has been classified as critical.dlink · dar-8000-10 firmwareEPSS85%1 exploitPublished Aug 25, 2023
- CVE-2022-24989Critical 9.8TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI.terra-master · terramaster operating systemEPSS32%3 exploitsPublished Aug 20, 2023
- CVE-2023-26469Critical 9.8In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.jorani · joraniEPSS83%3 exploitsPublished Aug 17, 2023
- CVE-2023-32560Critical 9.8An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.ivanti · avalancheEPSS99%2 exploitsPublished Aug 10, 2023
- CVE-2023-29689Critical 9.8PyroCMS remote code execution vulnerabilitypyrocms · pyrocmsEPSS53%1 exploitPublished Aug 4, 2023
- CVE-2023-4120Critical 9.8The manipulation of the argument sql leads to command injection.byzoro · smart s85fEPSS62%1 exploitPublished Aug 3, 2023
- CVE-2023-37679Critical 9.8A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.nextgen · mirth connectEPSS99%1 exploitPublished Aug 3, 2023
- CVE-2022-39986Critical 9.8RaspAP Command Injection vulnerabilityraspap · raspapEPSS99%1 exploitPublished Aug 1, 2023
- CVE-2023-34960Critical 9.8A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.chamilo · chamiloEPSS99%2 exploitsPublished Jul 31, 2023
- CVE-2023-3836Critical 9.8A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713.dahuasecurity · smart parking managementEPSS74%1 exploitPublished Jul 22, 2023
- CVE-2023-38646Critical 9.8Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level.metabase · metabaseEPSS99%1 exploitPublished Jul 21, 2023
- CVE-2023-34124Critical 9.8The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass.sonicwall · analyticsEPSS50%1 exploitPublished Jul 13, 2023
- CVE-2023-3643Critical 9.8It has been classified as critical.carel · boss mini firmwareEPSS75%1 exploitPublished Jul 12, 2023
- CVE-2023-3460Critical 9.8The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will.ultimatemember · ultimate memberEPSS72%1 exploitPublished Jul 4, 2023
- CVE-2023-2068Critical 9.8The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode.advancedfilemanager · file manager advanced shortcodeEPSS40%3 exploitsPublished Jun 27, 2023
- CVE-2023-30258Critical 9.8Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.magnussolution · magnusbillingEPSS94%2 exploitsPublished Jun 23, 2023
- CVE-2023-29711Critical 9.8An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.interlink · psg-5124 firmwareEPSS70%1 exploitPublished Jun 22, 2023
- CVE-2023-35885Critical 9.8CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.mgt-commerce · cloudpanelEPSS75%1 exploitPublished Jun 20, 2023
- CVE-2018-1160Critical 9.8Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.netatalk · netatalkEPSS87%7 exploitsPublished Jun 20, 2023
- CVE-2023-33625Critical 9.8D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function.dlink · dir-600 firmwareEPSS33%3 exploitsPublished Jun 12, 2023
- CVE-2023-29919Critical 9.8SolarView Compact <= 6.0 is vulnerable to Insecure Permissions.contec · solarview compact firmwareEPSS60%1 exploitPublished May 22, 2023
- CVE-2022-42889Critical 9.8Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.apache · commons textEPSS100%2 exploitsPublished May 18, 2023
- CVE-2023-32243Critical 9.8Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalationwpdeveloper · essential addons for elementorEPSS76%1 exploitPublished May 15, 2023
- CVE-2023-27823Critical 9.8An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.optoma · 1080pstxEPSS54%1 exploitPublished May 12, 2023
- CVE-2023-30013Critical 9.8TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg.totolink · x5000r firmwareEPSS26%2 exploitsPublished May 5, 2023
- CVE-2023-25826Critical 9.8Command injection in OpenTSDBopentsdb · opentsdbEPSS43%1 exploitPublished May 3, 2023
- CVE-2023-28503Critical 9.8Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication…rocketsoftware · unidataEPSS62%1 exploitPublished Mar 29, 2023
- CVE-2023-28502Critical 9.8Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user.rocketsoftware · unidataEPSS61%1 exploitPublished Mar 29, 2023
- CVE-2023-1133Critical 9.8Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default.deltaww · infrasuite device masterEPSS50%1 exploitPublished Mar 27, 2023
- CVE-2023-26801Critical 9.8LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.lb-link · bl-ac1900 firmwareEPSS70%1 exploitPublished Mar 26, 2023
- CVE-2022-43781Critical 9.8There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.atlassian · bitbucketEPSS98%1 exploitPublished Mar 20, 2023
- CVE-2023-28343Critical 9.8OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.apsystems · energy communication unit firmwareEPSS85%2 exploitsPublished Mar 14, 2023
- CVE-2023-26477Critical 9.8org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwikiEPSS75%1 exploitPublished Mar 3, 2023
- CVE-2023-27372Critical 9.8SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.spip · spipEPSS100%2 exploitsPublished Feb 28, 2023
- CVE-2023-26035Critical 9.8Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization.zoneminder · zoneminderEPSS80%1 exploitPublished Feb 25, 2023
- CVE-2022-39952Critical 9.8A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or…fortinet · fortinacEPSS100%1 exploitPublished Feb 17, 2023
- CVE-2022-40022Critical 9.8Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.microchip · syncserver s650 firmwareEPSS92%1 exploitPublished Feb 13, 2023
- CVE-2022-48323Critical 9.8Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue.sunlogin · sunflowerEPSS57%1 exploitPublished Feb 13, 2023
- CVE-2022-45699Critical 9.8Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.apsystems · ecu-r firmwareEPSS77%1 exploitPublished Feb 9, 2023
- CVE-2022-3229Critical 9.8Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated…unifiedremote · unified remoteEPSS66%1 exploitPublished Feb 6, 2023
- CVE-2023-23333Critical 9.8There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.contec · solarview compact firmwareEPSS99%3 exploitsPublished Feb 6, 2023
- CVE-2022-31706Critical 9.8The vRealize Log Insight contains a Directory Traversal Vulnerability.vmware · vrealize log insightEPSS87%1 exploitPublished Jan 25, 2023
- CVE-2022-31704Critical 9.8The vRealize Log Insight contains a broken access control vulnerability.vmware · vrealize log insightEPSS81%1 exploitPublished Jan 25, 2023
- CVE-2023-23488Critical 9.8The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.strangerstudios · paid memberships proEPSS92%1 exploitPublished Jan 20, 2023
- CVE-2023-0297Critical 9.8Code Injection in pyload-ngpyload · pyloadEPSS96%2 exploitsPublished Jan 14, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-41892 | Craft CMS Remote Code Execution vulnerability craftcms · craft cms | Critical 9.8 | 94% | 1 exploit | |
| CVE-2023-38408 | openssh - security update openbsd · openssh | Critical 9.8 | 80% | 1 exploit | |
| CVE-2023-39361 | Affected versions are subject to a SQL injection discovered in graph_view.php. cacti · cacti | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-4634 | Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution davidlingren · media library assistant | Critical 9.8 | 86% | 2 exploits | |
| CVE-2023-34039 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. vmware · aria operations for networks | Critical 9.8 | 67% | 2 exploits | |
| CVE-2023-4542 | It has been classified as critical. dlink · dar-8000-10 firmware | Critical 9.8 | 85% | 1 exploit | |
| CVE-2022-24989 | TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. terra-master · terramaster operating system | Critical 9.8 | 32% | 3 exploits | |
| CVE-2023-26469 | In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. jorani · jorani | Critical 9.8 | 83% | 3 exploits | |
| CVE-2023-32560 | An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. ivanti · avalanche | Critical 9.8 | 99% | 2 exploits | |
| CVE-2023-29689 | PyroCMS remote code execution vulnerability pyrocms · pyrocms | Critical 9.8 | 53% | 1 exploit | |
| CVE-2023-4120 | The manipulation of the argument sql leads to command injection. byzoro · smart s85f | Critical 9.8 | 62% | 1 exploit | |
| CVE-2023-37679 | A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server. nextgen · mirth connect | Critical 9.8 | 99% | 1 exploit | |
| CVE-2022-39986 | RaspAP Command Injection vulnerability raspap · raspap | Critical 9.8 | 99% | 1 exploit | |
| CVE-2023-34960 | A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. chamilo · chamilo | Critical 9.8 | 99% | 2 exploits | |
| CVE-2023-3836 | A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. dahuasecurity · smart parking management | Critical 9.8 | 74% | 1 exploit | |
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. metabase · metabase | Critical 9.8 | 99% | 1 exploit | |
| CVE-2023-34124 | The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. sonicwall · analytics | Critical 9.8 | 50% | 1 exploit | |
| CVE-2023-3643 | It has been classified as critical. carel · boss mini firmware | Critical 9.8 | 75% | 1 exploit | |
| CVE-2023-3460 | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. ultimatemember · ultimate member | Critical 9.8 | 72% | 1 exploit | |
| CVE-2023-2068 | The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. advancedfilemanager · file manager advanced shortcode | Critical 9.8 | 40% | 3 exploits | |
| CVE-2023-30258 | Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. magnussolution · magnusbilling | Critical 9.8 | 94% | 2 exploits | |
| CVE-2023-29711 | An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. interlink · psg-5124 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2023-35885 | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. mgt-commerce · cloudpanel | Critical 9.8 | 75% | 1 exploit | |
| CVE-2018-1160 | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. netatalk · netatalk | Critical 9.8 | 87% | 7 exploits | |
| CVE-2023-33625 | D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function. dlink · dir-600 firmware | Critical 9.8 | 33% | 3 exploits | |
| CVE-2023-29919 | SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. contec · solarview compact firmware | Critical 9.8 | 60% | 1 exploit | |
| CVE-2022-42889 | Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. apache · commons text | Critical 9.8 | 100% | 2 exploits | |
| CVE-2023-32243 | Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation wpdeveloper · essential addons for elementor | Critical 9.8 | 76% | 1 exploit | |
| CVE-2023-27823 | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. optoma · 1080pstx | Critical 9.8 | 54% | 1 exploit | |
| CVE-2023-30013 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. totolink · x5000r firmware | Critical 9.8 | 26% | 2 exploits | |
| CVE-2023-25826 | Command injection in OpenTSDB opentsdb · opentsdb | Critical 9.8 | 43% | 1 exploit | |
| CVE-2023-28503 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication… rocketsoftware · unidata | Critical 9.8 | 62% | 1 exploit | |
| CVE-2023-28502 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user. rocketsoftware · unidata | Critical 9.8 | 61% | 1 exploit | |
| CVE-2023-1133 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. deltaww · infrasuite device master | Critical 9.8 | 50% | 1 exploit | |
| CVE-2023-26801 | LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg. lb-link · bl-ac1900 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2022-43781 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. atlassian · bitbucket | Critical 9.8 | 98% | 1 exploit | |
| CVE-2023-28343 | OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php. apsystems · energy communication unit firmware | Critical 9.8 | 85% | 2 exploits | |
| CVE-2023-26477 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability xwiki · xwiki | Critical 9.8 | 75% | 1 exploit | |
| CVE-2023-27372 | SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. spip · spip | Critical 9.8 | 100% | 2 exploits | |
| CVE-2023-26035 | Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. zoneminder · zoneminder | Critical 9.8 | 80% | 1 exploit | |
| CVE-2022-39952 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or… fortinet · fortinac | Critical 9.8 | 100% | 1 exploit | |
| CVE-2022-40022 | Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. microchip · syncserver s650 firmware | Critical 9.8 | 92% | 1 exploit | |
| CVE-2022-48323 | Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. sunlogin · sunflower | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-45699 | Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter. apsystems · ecu-r firmware | Critical 9.8 | 77% | 1 exploit | |
| CVE-2022-3229 | Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated… unifiedremote · unified remote | Critical 9.8 | 66% | 1 exploit | |
| CVE-2023-23333 | There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. contec · solarview compact firmware | Critical 9.8 | 99% | 3 exploits | |
| CVE-2022-31706 | The vRealize Log Insight contains a Directory Traversal Vulnerability. vmware · vrealize log insight | Critical 9.8 | 87% | 1 exploit | |
| CVE-2022-31704 | The vRealize Log Insight contains a broken access control vulnerability. vmware · vrealize log insight | Critical 9.8 | 81% | 1 exploit | |
| CVE-2023-23488 | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route. strangerstudios · paid memberships pro | Critical 9.8 | 92% | 1 exploit | |
| CVE-2023-0297 | Code Injection in pyload-ng pyload · pyload | Critical 9.8 | 96% | 2 exploits |
Showing 101–150 of 1,192
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.