Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
2,494 vulnerabilities · highest exploit probability first
  • CVE-2012-0124Critical 10.0
    Unspecified vulnerability in HP Data Protector Express (aka DPX) 5.0.00 before build 59287 and 6.0.00 before build 11974 allows remote attackers to execute arbitrary code or cause a denial of service via unknown vectors.
    hp · data protector express
    EPSS62%
    2 exploits
    Published Mar 14, 2012
  • CVE-2012-0002Critical 9.3
    The Remote Desktop Protocol (RDP) implementation in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly process packets in memory, which allows remote attackers to…
    microsoft · windows 7
    EPSS74%
    1 exploit
    Published Mar 13, 2012
  • CVE-2012-0198Critical 9.3
    Stack-based buffer overflow in the RunAndUploadFile method in the Isig.isigCtl.1 ActiveX control in IBM Tivoli Provisioning Manager Express for Software Distribution 4.1.1 allows remote attackers to execute arbitrary code via vectors related to an Asset Information file.
    ibm · tivoli provisioning manager express for software distribution
    EPSS37%
    2 exploits
    Published Mar 6, 2012
  • CVE-2012-0201Critical 9.3
    Stack-based buffer overflow in pcspref.dll in pcsws.exe in IBM Personal Communications 5.9.x before 5.9.8 and 6.0.x before 6.0.4 might allow remote attackers to execute arbitrary code via a long profile string in a WorkStation (aka .ws) file.
    ibm · personal communications
    EPSS36%
    3 exploits
    Published Mar 2, 2012
  • CVE-2012-1196Medium 5.0
    Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a ..
    landesk · lenovo thinkmanagement console
    EPSS51%
    3 exploits
    Published Feb 17, 2012
  • CVE-2012-1195High 7.5
    Unrestricted file upload vulnerability in andesk/managementsuite/core/core.anonymous/ServerSetup.asmx in the ServerSetup web service in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension via a…
    landesk · lenovo thinkmanagement console
    EPSS69%
    3 exploits
    Published Feb 17, 2012
  • CVE-2012-0500Critical 10.0
    JDK: unspecified vulnerability fixed in 6u31 and 7u3 (Deployment)
    oracle · javafx
    EPSS58%
    3 exploits
    Published Feb 14, 2012
  • CVE-2011-3659Critical 9.3
    Mozilla: child nodes from nsDOMAttribute still accessible after removal of nodes (MFSA 2012-04)
    mozilla · firefox
    EPSS37%
    2 exploits
    Published Jan 31, 2012
  • CVE-2012-0053Medium 4.3
    protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2)…
    apache · http server
    EPSS82%
    1 exploit
    Published Jan 28, 2012
  • CVE-2012-0897Medium 6.8
    Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
    irfanview · irfanview
    EPSS52%
    2 exploits
    Published Jan 20, 2012
  • CVE-2011-4135Critical 10.0
    Multiple directory traversal vulnerabilities in lmgrd in Flexera FlexNet Publisher 11.10 (aka FlexNet License Server Manager) allow remote attackers to execute arbitrary code via vectors related to save, rename, and load operations on log files.
    flexerasoftware · flexnet publisher
    EPSS30%
    1 exploit
    Published Jan 19, 2012
  • CVE-2012-0267Critical 9.3
    The StopModule method in the NTR ActiveX control before 2.0.4.8 allows remote attackers to execute arbitrary code via a crafted lModule parameter that triggers use of an arbitrary memory address as a function pointer.
    ntrglobal · ntr activex control
    EPSS39%
    2 exploits
    Published Jan 15, 2012
  • CVE-2012-0266Critical 9.3
    Multiple stack-based buffer overflows in the NTR ActiveX control before 2.0.4.8 allow remote attackers to execute arbitrary code via (1) a long bstrUrl parameter to the StartModule method, (2) a long bstrParams parameter to the Check method, a long bstrUrl parameter to the (3)…
    ntrglobal · ntr activex control
    EPSS42%
    2 exploits
    Published Jan 15, 2012
  • CVE-2011-4789Critical 10.0
    Stack-based buffer overflow in magentservice.exe in the server in HP LoadRunner 11.00 before patch 4 allows remote attackers to execute arbitrary code via a crafted size value in a packet.
    hp · diagnostics
    EPSS64%
    2 exploits
    Published Jan 13, 2012
  • CVE-2011-4786Critical 9.3
    A certain ActiveX control in HPTicketMgr.dll in HP Easy Printer Care Software 2.5 and earlier allows remote attackers to download an arbitrary program onto a client machine, and execute this program, via unspecified vectors, a different vulnerability than CVE-2011-2404 and…
    hp · easy printer care software
    EPSS39%
    2 exploits
    Published Jan 12, 2012
  • CVE-2012-0013Critical 9.3
    Incomplete blacklist vulnerability in the Windows Packager configuration in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a…
    microsoft · windows 7
    EPSS74%
    3 exploits
    Published Jan 10, 2012
  • CVE-2012-0003High 8.1
    Unspecified vulnerability in winmm.dll in Windows Multimedia Library in Windows Media Player (WMP) in Microsoft Windows XP SP2 and SP3, Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows remote attackers to execute arbitrary code via a crafted MIDI file, aka "MIDI Remote…
    microsoft · windows xp
    EPSS70%
    2 exploits
    Published Jan 10, 2012
  • CVE-2011-5052Medium 6.8
    Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a download request.
    cocsoft · stream down
    EPSS30%
    3 exploits
    Published Jan 4, 2012
  • CVE-2011-4642Medium 4.6
    mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as…
    splunk · splunk
    EPSS29%
    3 exploits
    Published Jan 3, 2012
  • CVE-2011-4885Medium 5.0
    php: hash table collisions CPU usage DoS (oCERT-2011-003)
    php · php
    EPSS83%
    3 exploits
    Published Dec 28, 2011
  • CVE-2011-5035Medium 5.0
    GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003)
    oracle · glassfish server
    EPSS68%
    1 exploit
    Published Dec 28, 2011
  • CVE-2011-4166High 7.5
    Directory traversal vulnerability in the MPAUploader.Uploader.1.UploadFiles method in HP Managed Printing Administration before 2.6.4 allows remote attackers to create arbitrary files via crafted form data.
    hp · managed printing administration
    EPSS58%
    2 exploits
    Published Dec 27, 2011
  • CVE-2011-4862Critical 10.0
    Buffer overflow in libtelnet/encrypt.c in telnetd in FreeBSD 7.3 through 9.0, MIT Kerberos Version 5 Applications (aka krb5-appl) 1.0.2 and earlier, Heimdal 1.5.1 and earlier, GNU inetutils, and possibly other products allows remote attackers to execute arbitrary code via a long…
    gnu · inetutils
    EPSS95%
    6 exploits
    Published Dec 25, 2011
  • CVE-2011-5010Critical 10.0
    apps/a3/cfg_ethping.cgi in the Ctek SkyRouter 4200 and 4300 allows remote attackers to execute arbitrary commands via shell metacharacters in the PINGADDRESS parameter for a "u" action.
    ctekproducts · skyrouter
    EPSS66%
    3 exploits
    Published Dec 24, 2011
  • CVE-2011-5007Critical 10.0
    Stack-based buffer overflow in the CmpWebServer component in 3S CoDeSys 3.4 SP4 Patch 2 and earlier, as used on the ABB AC500 PLC and possibly other products, allows remote attackers to execute arbitrary code via a long URI to TCP port 8080.
    3ssoftware · codesys
    EPSS73%
    4 exploits
    Published Dec 24, 2011
  • CVE-2011-5003Critical 10.0
    Stack-based buffer overflow in the Phonetic Indexer (AvidPhoneticIndexer.exe) in Avid Media Composer 5.5.3 and earlier allows remote attackers to execute arbitrary code via a long request to TCP port 4659.
    avid · media composer
    EPSS62%
    2 exploits
    Published Dec 24, 2011
  • CVE-2011-5001Critical 10.0
    Stack-based buffer overflow in the CGenericScheduler::AddTask function in cmdHandlerRedAlertController.dll in CmdProcessor.exe in Trend Micro Control Manager 5.5 before Build 1613 allows remote attackers to execute arbitrary code via a crafted IPC packet to TCP port 20101.
    trend micro · control manager
    EPSS64%
    2 exploits
    Published Dec 24, 2011
  • CVE-2010-5081Critical 9.3
    Stack-based buffer overflow in Mini-Stream RM-MP3 Converter 3.1.2.1 allows remote attackers to execute arbitrary code via a long URL in a .pls file.
    mini-stream · rm-mp3 converter
    EPSS31%
    5 exploits
    Published Dec 24, 2011
  • CVE-2009-5109Critical 9.3
    Stack-based buffer overflow in Mini-Stream Ripper 3.0.1.1 allows remote attackers to execute arbitrary code via a long entry in a .pls file.
    mini-stream · ripper
    EPSS32%
    9 exploits
    Published Dec 24, 2011
  • CVE-2011-4453High 7.5
    The PageListSort function in scripts/pagelist.php in PmWiki 2.x before 2.2.35 allows remote attackers to execute arbitrary code via PHP sequences in a crafted order parameter in a pagelist directive, leading to unintended use of the PHP create_function function.
    pmwiki · pmwiki
    EPSS52%
    5 exploits
    Published Dec 22, 2011
  • CVE-2011-3658High 7.5
    Mozilla: Multiple security flaws fixed in v3.6.25 (Mac) and v9
    mozilla · firefox
    EPSS70%
    2 exploits
    Published Dec 20, 2011
  • CVE-2011-4828High 7.5
    Unrestricted file upload vulnerability in includes/inline_image_upload.php in AutoSec Tools V-CMS 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in temp/.
    autosectools · v-cms
    EPSS65%
    2 exploits
    Published Dec 15, 2011
  • CVE-2011-4825High 7.5
    Static code injection vulnerability in inc/function.base.php in Ajax File and Image Manager before 1.1, as used in tinymce before 1.4.2, phpMyFAQ 2.6 before 2.6.19 and 2.7 before 2.7.1, and possibly other products, allows remote attackers to inject arbitrary PHP code into…
    phpletter · ajax file and image manager
    EPSS39%
    7 exploits
    Published Dec 15, 2011
  • CVE-2011-3400Critical 9.3
    Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 do not properly handle OLE objects in memory, which allows remote attackers to execute arbitrary code via a crafted object in a file, aka "OLE Property Vulnerability."
    microsoft · windows xp
    EPSS71%
    2 exploits
    Published Dec 13, 2011
  • CVE-2011-2653Critical 10.0
    Directory traversal vulnerability in the rtrlet component in Novell ZENworks Asset Management (ZAM) 7.5 allows remote attackers to execute arbitrary code by uploading an executable file.
    novell · zenworks asset management
    EPSS72%
    2 exploits
    Published Dec 8, 2011
  • CVE-2011-4051Critical 10.0
    CEServer.exe in the CEServer component in the Remote Agent module in InduSoft Web Studio 6.1 and 7.0 does not require authentication, which allows remote attackers to execute arbitrary code via vectors related to creation of a file, loading a DLL, and process control.
    indusoft · web studio
    EPSS69%
    2 exploits
    Published Dec 5, 2011
  • CVE-2011-4317Medium 4.3
    The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a…
    apache · http server
    EPSS60%
    1 exploit
    Published Nov 30, 2011
  • CVE-2011-3639Medium 4.3
    The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which…
    apache · http server
    EPSS51%
    1 exploit
    Published Nov 30, 2011
  • CVE-2011-4542High 7.5
    Hastymail2 2.1.1 before RC2 allows remote attackers to execute arbitrary commands via the (1) rs or (2) rsargs[] parameter in a mailbox Drafts action to the default URI.
    hastymail · hastymail2
    EPSS24%
    2 exploits
    Published Nov 30, 2011
  • CVE-2011-4040Critical 10.0
    Buffer overflow in MiniSmtp 3.0.11818 in NJStar Communicator allows remote attackers to execute arbitrary code via a crafted packet.
    njstar · njstar communicator
    EPSS65%
    3 exploits
    Published Nov 21, 2011
  • CVE-2011-4404Medium 5.0
    The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related…
    vmware · vcenter update manager
    EPSS59%
    1 exploit
    Published Nov 19, 2011
  • CVE-2011-4075High 7.5
    The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter (aka sortby variable) in a query_engine action to cmd.php, as exploited in the wild in October 2011.
    phpldapadmin project · phpldapadmin
    EPSS52%
    4 exploits
    Published Nov 2, 2011
  • CVE-2011-3167Critical 10.0
    Unspecified vulnerability in HP OpenView Network Node Manager (OV NNM) 7.51 and 7.53 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1210.
    hp · openview network node manager
    EPSS65%
    2 exploits
    Published Nov 2, 2011
  • CVE-2011-3556High 7.5
    OpenJDK: RMI DGC server remote code execution (RMI, 7077466)
    oracle · jrockit
    EPSS76%
    2 exploits
    Published Oct 18, 2011
  • CVE-2011-3230Medium 6.8
    Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary code via a crafted web site.
    apple · safari
    EPSS49%
    2 exploits
    Published Oct 14, 2011
  • CVE-2011-1996Critical 9.3
    Microsoft Internet Explorer 6 through 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Option Element Remote Code Execution Vulnerability."
    microsoft · internet explorer
    EPSS59%
    2 exploits
    Published Oct 11, 2011
  • CVE-2011-3368Medium 5.0
    The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers…
    apache · http server
    EPSS91%
    1 exploit
    Published Oct 5, 2011
  • CVE-2011-3976Medium 6.8
    Stack-based buffer overflow in AmmSoft ScriptFTP 3.3 allows remote FTP servers to execute arbitrary code via a long filename in a response to a LIST command, as demonstrated using (1) GETLIST or (2) GETFILE in a ScriptFTP script.
    ammsoft · scriptftp
    EPSS31%
    5 exploits
    Published Oct 4, 2011
  • CVE-2011-3360Critical 9.3
    Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory.
    wireshark · wireshark
    EPSS35%
    2 exploits
    Published Sep 20, 2011
  • CVE-2011-3497Critical 10.0
    service.exe in Measuresoft ScadaPro 4.0.0 and earlier allows remote attackers to execute arbitrary DLL functions via the XF function, possibly related to an insecure exposed method.
    measuresoft · scadapro
    EPSS57%
    2 exploits
    Published Sep 16, 2011
Showing 1,601–1,650 of 2,494

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.