Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
2,494 vulnerabilities · highest exploit probability first
- CVE-2023-7102Critical 9.8Use of a Third Party library produced a vulnerability in Barracuda Networks Inc.barracuda · email security gateway 300 firmwareEPSS45%1 exploitPublished Dec 28, 2023
- CVE-2023-51467Critical 9.8The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary codeapache · ofbizEPSS96%1 exploitPublished Dec 27, 2023
- CVE-2023-51448High 8.8Cacti provides an operational monitoring and fault management framework.cacti · cactiEPSS67%2 exploitsPublished Dec 22, 2023
- CVE-2023-49085High 8.8Cacti provides an operational monitoring and fault management framework.cacti · cactiEPSS74%3 exploitsPublished Dec 22, 2023
- CVE-2023-49084High 8.8While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server.cacti · cactiEPSS64%2 exploitsPublished Dec 21, 2023
- CVE-2023-6895Critical 9.8It has been declared as critical.hikvision · intercom broadcast systemEPSS89%Ransomware1 exploit1 actorPublished Dec 17, 2023
- CVE-2023-6893High 7.5Affected by this issue is some unknown functionality of the file /php/exportrecord.php.hikvision · intercom broadcast systemEPSS70%1 exploitPublished Dec 17, 2023
- CVE-2023-50917Critical 9.8MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters.mjdm · majordomoEPSS38%1 exploitPublished Dec 15, 2023
- CVE-2023-6553Critical 9.8Backup Migration <= 1.3.7 - Unauthenticated Remote Code Executionbackupbliss · backup migrationEPSS98%2 exploitsPublished Dec 10, 2023
- CVE-2023-49070Critical 9.8Pre-auth RCE in Apache Ofbiz 18.12.09.apache · ofbizEPSS95%1 exploitPublished Dec 6, 2023
- CVE-2022-1471Critical 9.8SnakeYaml Constructor Deserialization Remote Code Executionsnakeyaml project · snakeyamlEPSS100%3 exploitsPublished Dec 6, 2023
- CVE-2023-48022Critical 9.8Ray has arbitrary code execution via jobs submission APIanyscale · rayEPSS84%1 exploitPublished Nov 28, 2023
- CVE-2023-4220Medium 6.1Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web…chamilo · chamilo lmsEPSS76%2 exploitsPublished Nov 28, 2023
- CVE-2023-43177Critical 9.8CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes.crushftp · crushftpEPSS82%1 exploitPublished Nov 17, 2023
- CVE-2023-6019Critical 9.8Ray OS Command Injection vulnerabilityray project · rayEPSS75%2 exploitsPublished Nov 16, 2023
- CVE-2023-46214High 8.8In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply.splunk · splunkEPSS89%1 exploitPublished Nov 16, 2023
- CVE-2023-46731Critical 9.8XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guestxwiki · xwikiEPSS89%1 exploitPublished Nov 8, 2023
- CVE-2023-41425Medium 6.1Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.wondercms · wondercmsEPSS54%2 exploitsPublished Nov 7, 2023
- CVE-2023-5360Critical 9.8Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Uploadroyal-elementor-addons · royal elementor addonsEPSS86%2 exploitsPublished Nov 1, 2023
- CVE-2023-45498Critical 9.8VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.vinchin · vinchin backup and recoveryEPSS20%1 exploitPublished Oct 27, 2023
- CVE-2023-46574Critical 9.8An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function.totolink · a3700r firmwareEPSS65%1 exploitPublished Oct 25, 2023
- CVE-2023-5684Critical 9.8It has been declared as critical.byzoro · smart s85f firmwareEPSS78%1 exploitPublished Oct 21, 2023
- CVE-2023-43661High 8.8Cachet vulnerable to Authenticated Remote Code Executionall-three · cachetEPSS51%1 exploitPublished Oct 16, 2023
- CVE-2023-43261High 7.5An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.milesight · ur32 firmwareEPSS64%1 exploitPublished Oct 4, 2023
- CVE-2023-43654Critical 9.8TorchServe Server-Side Request Forgery vulnerabilitypytorch · torchserveEPSS42%1 exploitPublished Oct 2, 2023
- CVE-2023-5222Critical 9.8A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0.viessmann · vitogate 300 firmwareEPSS80%2 exploitsPublished Sep 27, 2023
- CVE-2023-5151High 8.8UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231.dlink · dar-8000 firmwareEPSS81%1 exploitPublished Sep 25, 2023
- CVE-2023-38146High 8.8Windows Themes Remote Code Execution Vulnerabilitymicrosoft · windows 11 21h2EPSS37%1 exploitPublished Sep 19, 2023
- CVE-2023-42442Medium 5.3Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication.fit2cloud · jumpserverEPSS63%1 exploitPublished Sep 15, 2023
- CVE-2023-41892Critical 9.8Craft CMS Remote Code Execution vulnerabilitycraftcms · craft cmsEPSS94%1 exploitPublished Sep 13, 2023
- CVE-2023-38408Critical 9.8openssh - security updateopenbsd · opensshEPSS80%1 exploitPublished Sep 7, 2023
- CVE-2023-39265Medium 6.5Apache Superset Improper Input Validation vulnerabilityapache · supersetEPSS86%1 exploitPublished Sep 6, 2023
- CVE-2023-37941Medium 6.6Apache Superset Deserialization of Untrusted Data vulnerabilityapache · supersetEPSS35%1 exploitPublished Sep 6, 2023
- CVE-2023-39361Critical 9.8Affected versions are subject to a SQL injection discovered in graph_view.php.cacti · cactiEPSS89%1 exploitPublished Sep 6, 2023
- CVE-2023-39362High 7.2In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server.cacti · cactiEPSS85%3 exploitsPublished Sep 6, 2023
- CVE-2023-4634Critical 9.8Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Executiondavidlingren · media library assistantEPSS86%2 exploitsPublished Sep 4, 2023
- CVE-2023-34039Critical 9.8Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation.vmware · aria operations for networksEPSS67%2 exploitsPublished Aug 30, 2023
- CVE-2023-4547Medium 5.1It has been rated as problematic.spa-cart · ecommerce cmsEPSS60%2 exploitsPublished Aug 26, 2023
- CVE-2023-4542Critical 9.8It has been classified as critical.dlink · dar-8000-10 firmwareEPSS85%1 exploitPublished Aug 25, 2023
- CVE-2023-38836High 8.8File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.boidcms · boidcmsEPSS76%3 exploitsPublished Aug 21, 2023
- CVE-2022-24989Critical 9.8TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI.terra-master · terramaster operating systemEPSS32%3 exploitsPublished Aug 20, 2023
- CVE-2023-4415High 8.8It has been rated as critical.ruijienetworks · rg-ew1200g firmwareEPSS58%1 exploitPublished Aug 18, 2023
- CVE-2023-26469Critical 9.8In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.jorani · joraniEPSS83%3 exploitsPublished Aug 17, 2023
- CVE-2023-40028Medium 6.5Ghost vulnerable to arbitrary file read via symlinks in content importghost · ghostEPSS69%1 exploitPublished Aug 15, 2023
- CVE-2022-21661High 7.5wordpress - security updatewordpress · wordpressEPSS98%2 exploitsPublished Aug 14, 2023
- CVE-2023-32560Critical 9.8An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.ivanti · avalancheEPSS99%2 exploitsPublished Aug 10, 2023
- CVE-2023-29689Critical 9.8PyroCMS remote code execution vulnerabilitypyrocms · pyrocmsEPSS53%1 exploitPublished Aug 4, 2023
- CVE-2023-4120Critical 9.8The manipulation of the argument sql leads to command injection.byzoro · smart s85fEPSS62%1 exploitPublished Aug 3, 2023
- CVE-2023-37679Critical 9.8A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.nextgen · mirth connectEPSS99%1 exploitPublished Aug 3, 2023
- CVE-2023-36255High 8.8An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.eramba · erambaEPSS53%1 exploitPublished Aug 2, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-7102 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. barracuda · email security gateway 300 firmware | Critical 9.8 | 45% | 1 exploit | |
| CVE-2023-51467 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code apache · ofbiz | Critical 9.8 | 96% | 1 exploit | |
| CVE-2023-51448 | Cacti provides an operational monitoring and fault management framework. cacti · cacti | High 8.8 | 67% | 2 exploits | |
| CVE-2023-49085 | Cacti provides an operational monitoring and fault management framework. cacti · cacti | High 8.8 | 74% | 3 exploits | |
| CVE-2023-49084 | While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. cacti · cacti | High 8.8 | 64% | 2 exploits | |
| CVE-2023-6895 | It has been declared as critical. hikvision · intercom broadcast system | Critical 9.8 | 89% | Ransomware1 exploit1 actor | |
| CVE-2023-6893 | Affected by this issue is some unknown functionality of the file /php/exportrecord.php. hikvision · intercom broadcast system | High 7.5 | 70% | 1 exploit | |
| CVE-2023-50917 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. mjdm · majordomo | Critical 9.8 | 38% | 1 exploit | |
| CVE-2023-6553 | Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution backupbliss · backup migration | Critical 9.8 | 98% | 2 exploits | |
| CVE-2023-49070 | Pre-auth RCE in Apache Ofbiz 18.12.09. apache · ofbiz | Critical 9.8 | 95% | 1 exploit | |
| CVE-2022-1471 | SnakeYaml Constructor Deserialization Remote Code Execution snakeyaml project · snakeyaml | Critical 9.8 | 100% | 3 exploits | |
| CVE-2023-48022 | Ray has arbitrary code execution via jobs submission API anyscale · ray | Critical 9.8 | 84% | 1 exploit | |
| CVE-2023-4220 | Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web… chamilo · chamilo lms | Medium 6.1 | 76% | 2 exploits | |
| CVE-2023-43177 | CrushFTP prior to 10.5.1 is vulnerable to Improperly Controlled Modification of Dynamically-Determined Object Attributes. crushftp · crushftp | Critical 9.8 | 82% | 1 exploit | |
| CVE-2023-6019 | Ray OS Command Injection vulnerability ray project · ray | Critical 9.8 | 75% | 2 exploits | |
| CVE-2023-46214 | In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. splunk · splunk | High 8.8 | 89% | 1 exploit | |
| CVE-2023-46731 | XWiki Platform vulnerable to remote code execution through the section parameter in Administration as guest xwiki · xwiki | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-41425 | Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. wondercms · wondercms | Medium 6.1 | 54% | 2 exploits | |
| CVE-2023-5360 | Royal Elementor Addons and Templates <= 1.3.78 - Unauthenticated Arbitrary File Upload royal-elementor-addons · royal elementor addons | Critical 9.8 | 86% | 2 exploits | |
| CVE-2023-45498 | VinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability. vinchin · vinchin backup and recovery | Critical 9.8 | 20% | 1 exploit | |
| CVE-2023-46574 | An issue in TOTOLINK A3700R v.9.1.2u.6165_20211012 allows a remote attacker to execute arbitrary code via the FileName parameter of the UploadFirmwareFile function. totolink · a3700r firmware | Critical 9.8 | 65% | 1 exploit | |
| CVE-2023-5684 | It has been declared as critical. byzoro · smart s85f firmware | Critical 9.8 | 78% | 1 exploit | |
| CVE-2023-43661 | Cachet vulnerable to Authenticated Remote Code Execution all-three · cachet | High 8.8 | 51% | 1 exploit | |
| CVE-2023-43261 | An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. milesight · ur32 firmware | High 7.5 | 64% | 1 exploit | |
| CVE-2023-43654 | TorchServe Server-Side Request Forgery vulnerability pytorch · torchserve | Critical 9.8 | 42% | 1 exploit | |
| CVE-2023-5222 | A vulnerability classified as critical was found in Viessmann Vitogate 300 up to 2.1.3.0. viessmann · vitogate 300 firmware | Critical 9.8 | 80% | 2 exploits | |
| CVE-2023-5151 | UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. dlink · dar-8000 firmware | High 8.8 | 81% | 1 exploit | |
| CVE-2023-38146 | Windows Themes Remote Code Execution Vulnerability microsoft · windows 11 21h2 | High 8.8 | 37% | 1 exploit | |
| CVE-2023-42442 | Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. fit2cloud · jumpserver | Medium 5.3 | 63% | 1 exploit | |
| CVE-2023-41892 | Craft CMS Remote Code Execution vulnerability craftcms · craft cms | Critical 9.8 | 94% | 1 exploit | |
| CVE-2023-38408 | openssh - security update openbsd · openssh | Critical 9.8 | 80% | 1 exploit | |
| CVE-2023-39265 | Apache Superset Improper Input Validation vulnerability apache · superset | Medium 6.5 | 86% | 1 exploit | |
| CVE-2023-37941 | Apache Superset Deserialization of Untrusted Data vulnerability apache · superset | Medium 6.6 | 35% | 1 exploit | |
| CVE-2023-39361 | Affected versions are subject to a SQL injection discovered in graph_view.php. cacti · cacti | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-39362 | In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. cacti · cacti | High 7.2 | 85% | 3 exploits | |
| CVE-2023-4634 | Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution davidlingren · media library assistant | Critical 9.8 | 86% | 2 exploits | |
| CVE-2023-34039 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. vmware · aria operations for networks | Critical 9.8 | 67% | 2 exploits | |
| CVE-2023-4547 | It has been rated as problematic. spa-cart · ecommerce cms | Medium 5.1 | 60% | 2 exploits | |
| CVE-2023-4542 | It has been classified as critical. dlink · dar-8000-10 firmware | Critical 9.8 | 85% | 1 exploit | |
| CVE-2023-38836 | File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks. boidcms · boidcms | High 8.8 | 76% | 3 exploits | |
| CVE-2022-24989 | TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. terra-master · terramaster operating system | Critical 9.8 | 32% | 3 exploits | |
| CVE-2023-4415 | It has been rated as critical. ruijienetworks · rg-ew1200g firmware | High 8.8 | 58% | 1 exploit | |
| CVE-2023-26469 | In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. jorani · jorani | Critical 9.8 | 83% | 3 exploits | |
| CVE-2023-40028 | Ghost vulnerable to arbitrary file read via symlinks in content import ghost · ghost | Medium 6.5 | 69% | 1 exploit | |
| CVE-2022-21661 | wordpress - security update wordpress · wordpress | High 7.5 | 98% | 2 exploits | |
| CVE-2023-32560 | An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. ivanti · avalanche | Critical 9.8 | 99% | 2 exploits | |
| CVE-2023-29689 | PyroCMS remote code execution vulnerability pyrocms · pyrocms | Critical 9.8 | 53% | 1 exploit | |
| CVE-2023-4120 | The manipulation of the argument sql leads to command injection. byzoro · smart s85f | Critical 9.8 | 62% | 1 exploit | |
| CVE-2023-37679 | A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server. nextgen · mirth connect | Critical 9.8 | 99% | 1 exploit | |
| CVE-2023-36255 | An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL. eramba · eramba | High 8.8 | 53% | 1 exploit |
Showing 151–200 of 2,494
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.