Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,192 vulnerabilities · highest exploit probability first
- CVE-2022-40471Critical 9.8Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.phporetnom23 · clinic\'s patient management systemEPSS23%3 exploitsPublished Oct 31, 2022
- CVE-2016-20016Critical 9.8MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI.mvpower · tv-7104he firmwareEPSS86%2 exploitsPublished Oct 19, 2022
- CVE-2022-2992Critical 9.9Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitLabgitlab · gitlabEPSS86%1 exploitPublished Oct 17, 2022
- CVE-2022-2884Critical 9.9Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in GitLabgitlab · gitlabEPSS76%1 exploitPublished Oct 17, 2022
- CVE-2022-3218Critical 9.8Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.necta · wifi mouse serverEPSS74%5 exploitsPublished Sep 19, 2022
- CVE-2022-31814Critical 9.8pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header.netgate · pfblockerngEPSS92%3 exploitsPublished Sep 5, 2022
- CVE-2022-31499Critical 9.8Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo.nortekcontrol · emerge e3 firmwareEPSS65%2 exploitsPublished Aug 25, 2022
- CVE-2022-37061Critical 9.8All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection.flir · flir ax8 firmwareEPSS100%6 exploitsPublished Aug 18, 2022
- CVE-2020-9850Critical 9.8webkitgtk: Logic issue may lead to arbitrary code executionapple · icloudEPSS77%1 exploitPublished Aug 15, 2022
- CVE-2022-32429Critical 9.8An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution.megatech · msnswitch firmwareEPSS76%2 exploitsPublished Aug 10, 2022
- CVE-2022-36267Critical 9.8In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability.airspan · airspot 5410 firmwareEPSS55%3 exploitsPublished Aug 8, 2022
- CVE-2022-36446Critical 9.8software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.webmin · webminEPSS96%3 exploitsPublished Jul 25, 2022
- CVE-2022-2487Critical 9.8The manipulation of the argument start_hour leads to os command injection.wavlink · wl-wn535k2 firmwareEPSS79%1 exploitPublished Jul 20, 2022
- CVE-2022-31137Critical 9.8Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability.roxy-wi · roxy-wiEPSS91%2 exploitsPublished Jul 8, 2022
- CVE-2022-25046Critical 9.8A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.control-webpanel · webpanelEPSS57%1 exploitPublished Jul 7, 2022
- CVE-2022-31126Critical 9.8A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file.roxy-wi · roxy-wiEPSS53%1 exploitPublished Jul 6, 2022
- CVE-2022-2143Critical 9.8The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.advantech · iviewEPSS60%2 exploitsPublished Jun 29, 2022
- CVE-2022-28171Critical 9.8The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.hikvision · ds-a71024 firmwareEPSS52%2 exploitsPublished Jun 27, 2022
- CVE-2022-24562Critical 9.8In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.iobit · iotransferEPSS54%2 exploitsPublished Jun 16, 2022
- CVE-2009-3555Critical 9.8The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4…apache · http serverEPSS87%3 exploitsPublished Jun 10, 2022
- CVE-2022-29013Critical 9.8A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.razer · sila firmwareEPSS77%2 exploitsPublished Jun 8, 2022
- CVE-2021-25281Critical 9.8SaltStack Salt Improper Authentication vulnerabilitysaltstack · saltEPSS73%1 exploitPublished May 24, 2022
- CVE-2020-25592Critical 9.8SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapisaltstack · saltEPSS57%1 exploitPublished May 24, 2022
- CVE-2020-9757Critical 9.8SEOmatic for CraftCMS allows Server-Side Template Injectioncraftcms · craft cmsEPSS73%1 exploitPublished May 24, 2022
- CVE-2019-15954Critical 9.9Total.js CMS RCE Vulnerabilitytotaljs · total.js cmsEPSS79%2 exploitsPublished May 24, 2022
- CVE-2018-20434Critical 9.8LibreNMS arbitrary OS commands executionlibrenms · librenmsEPSS71%4 exploitsPublished May 24, 2022
- CVE-2014-9390Critical 9.3JGit Improper Input Validation vulnerabilityapple · xcodeEPSS76%1 exploitPublished May 17, 2022
- CVE-2014-8739Critical 9.8jQuery File Upload Plugin Unrestricted file upload vulnerabilitycreative-solutions · creative contact formEPSS92%5 exploitsPublished May 17, 2022
- CVE-2021-44790Critical 9.8A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).apache · http serverEPSS97%2 exploitsPublished May 17, 2022
- CVE-2011-3587Critical 9.3Zope Command Execution Vulnerabilityplone · ploneEPSS78%2 exploitsPublished May 17, 2022
- CVE-2013-5093Critical 9.5graphite-web is vulnerable to Remote Code Execution via renderLocalView functiongraphite project · graphiteEPSS39%1 exploitPublished May 17, 2022
- CVE-2016-5734Critical 9.8phpMyAdmin Code Injection vulnerabilityphpmyadmin · phpmyadminEPSS81%3 exploitsPublished May 17, 2022
- CVE-2014-8684Critical 9.8CodeIgniter and Kohana vulnerable to PHP Object Injectioncodeigniter · codeigniterEPSS72%2 exploitsPublished May 17, 2022
- CVE-2018-10094Critical 9.8Dolibarr SQL injection vulnerabilitydolibarr · dolibarrEPSS70%2 exploitsPublished May 14, 2022
- CVE-2008-5619Critical 10.0PHPMailer susceptible to arbitrary code executionroundcube · webmailEPSS59%2 exploitsPublished May 14, 2022
- CVE-2013-2134Critical 9.3Arbitrary code execution in Apache Struts 2apache · strutsEPSS70%1 exploitPublished May 14, 2022
- CVE-2016-9299Critical 9.8Improper Neutralization of Special Elements used in an LDAP Query in Jenkinsjenkins · jenkinsEPSS97%1 exploitPublished May 14, 2022
- CVE-2013-1966Critical 9.3Arbitrary code execution in Apache Strutsapache · strutsEPSS74%2 exploitsPublished May 14, 2022
- CVE-2016-3087Critical 9.8Apache Struts vulnerable to arbitrary remote code execution due to improper input validationapache · strutsEPSS82%3 exploitsPublished May 14, 2022
- CVE-2017-9232Critical 9.8Juju uses a UNIX domain socket without setting appropriate permissionscanonical · jujuEPSS49%1 exploitPublished May 13, 2022
- CVE-2018-7251Critical 9.8Anchor CMS Logs Credentialsanchorcms · anchorEPSS72%1 exploitPublished May 13, 2022
- CVE-2015-8103Critical 9.8Jenkins CLI Deserialization of Untrusted Data vulnerabilityjenkins · jenkinsEPSS87%4 exploitsPublished May 13, 2022
- CVE-2019-9194Critical 9.8elFinder command injection vulnerability in the PHP connectorstd42 · elfinderEPSS97%5 exploitsPublished May 13, 2022
- CVE-2017-8046Critical 9.8Remote code execution in PATCH requests in Spring Data RESTpivotal software · spring data restEPSS75%1 exploitPublished May 13, 2022
- CVE-2022-1162Critical 9.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.gitlab · gitlabEPSS76%1 exploitPublished May 5, 2022
- CVE-2021-46422Critical 9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.telesquare · sdt-cs3b1 firmwareEPSS94%3 exploitsPublished Apr 27, 2022
- CVE-2021-46442Critical 9.8In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization.dlink · dir-825 firmwareEPSS56%1 exploitPublished Apr 27, 2022
- CVE-2022-29806Critical 9.8ZoneMinder before 1.36.13 allows remote code execution via an invalid language.zoneminder · zoneminderEPSS67%2 exploitsPublished Apr 26, 2022
- CVE-2011-3923Critical 9.8Struts ParameterInterceptor vulnerability allows remote command executionapache · strutsEPSS89%2 exploitsPublished Apr 22, 2022
- CVE-2022-22956Critical 9.8VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.vmware · identity managerEPSS50%1 exploitPublished Apr 14, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-40471 | Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php oretnom23 · clinic\'s patient management system | Critical 9.8 | 23% | 3 exploits | |
| CVE-2016-20016 | MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. mvpower · tv-7104he firmware | Critical 9.8 | 86% | 2 exploits | |
| CVE-2022-2992 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitLab gitlab · gitlab | Critical 9.9 | 86% | 1 exploit | |
| CVE-2022-2884 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in GitLab gitlab · gitlab | Critical 9.9 | 76% | 1 exploit | |
| CVE-2022-3218 | Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution. necta · wifi mouse server | Critical 9.8 | 74% | 5 exploits | |
| CVE-2022-31814 | pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. netgate · pfblockerng | Critical 9.8 | 92% | 3 exploits | |
| CVE-2022-31499 | Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. nortekcontrol · emerge e3 firmware | Critical 9.8 | 65% | 2 exploits | |
| CVE-2022-37061 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. flir · flir ax8 firmware | Critical 9.8 | 100% | 6 exploits | |
| CVE-2020-9850 | webkitgtk: Logic issue may lead to arbitrary code execution apple · icloud | Critical 9.8 | 77% | 1 exploit | |
| CVE-2022-32429 | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution. megatech · msnswitch firmware | Critical 9.8 | 76% | 2 exploits | |
| CVE-2022-36267 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. airspan · airspot 5410 firmware | Critical 9.8 | 55% | 3 exploits | |
| CVE-2022-36446 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. webmin · webmin | Critical 9.8 | 96% | 3 exploits | |
| CVE-2022-2487 | The manipulation of the argument start_hour leads to os command injection. wavlink · wl-wn535k2 firmware | Critical 9.8 | 79% | 1 exploit | |
| CVE-2022-31137 | Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. roxy-wi · roxy-wi | Critical 9.8 | 91% | 2 exploits | |
| CVE-2022-25046 | A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request. control-webpanel · webpanel | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-31126 | A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. roxy-wi · roxy-wi | Critical 9.8 | 53% | 1 exploit | |
| CVE-2022-2143 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. advantech · iview | Critical 9.8 | 60% | 2 exploits | |
| CVE-2022-28171 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. hikvision · ds-a71024 firmware | Critical 9.8 | 52% | 2 exploits | |
| CVE-2022-24562 | In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution. iobit · iotransfer | Critical 9.8 | 54% | 2 exploits | |
| CVE-2009-3555 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4… apache · http server | Critical 9.8 | 87% | 3 exploits | |
| CVE-2022-29013 | A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. razer · sila firmware | Critical 9.8 | 77% | 2 exploits | |
| CVE-2021-25281 | SaltStack Salt Improper Authentication vulnerability saltstack · salt | Critical 9.8 | 73% | 1 exploit | |
| CVE-2020-25592 | SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi saltstack · salt | Critical 9.8 | 57% | 1 exploit | |
| CVE-2020-9757 | SEOmatic for CraftCMS allows Server-Side Template Injection craftcms · craft cms | Critical 9.8 | 73% | 1 exploit | |
| CVE-2019-15954 | Total.js CMS RCE Vulnerability totaljs · total.js cms | Critical 9.9 | 79% | 2 exploits | |
| CVE-2018-20434 | LibreNMS arbitrary OS commands execution librenms · librenms | Critical 9.8 | 71% | 4 exploits | |
| CVE-2014-9390 | JGit Improper Input Validation vulnerability apple · xcode | Critical 9.3 | 76% | 1 exploit | |
| CVE-2014-8739 | jQuery File Upload Plugin Unrestricted file upload vulnerability creative-solutions · creative contact form | Critical 9.8 | 92% | 5 exploits | |
| CVE-2021-44790 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). apache · http server | Critical 9.8 | 97% | 2 exploits | |
| CVE-2011-3587 | Zope Command Execution Vulnerability plone · plone | Critical 9.3 | 78% | 2 exploits | |
| CVE-2013-5093 | graphite-web is vulnerable to Remote Code Execution via renderLocalView function graphite project · graphite | Critical 9.5 | 39% | 1 exploit | |
| CVE-2016-5734 | phpMyAdmin Code Injection vulnerability phpmyadmin · phpmyadmin | Critical 9.8 | 81% | 3 exploits | |
| CVE-2014-8684 | CodeIgniter and Kohana vulnerable to PHP Object Injection codeigniter · codeigniter | Critical 9.8 | 72% | 2 exploits | |
| CVE-2018-10094 | Dolibarr SQL injection vulnerability dolibarr · dolibarr | Critical 9.8 | 70% | 2 exploits | |
| CVE-2008-5619 | PHPMailer susceptible to arbitrary code execution roundcube · webmail | Critical 10.0 | 59% | 2 exploits | |
| CVE-2013-2134 | Arbitrary code execution in Apache Struts 2 apache · struts | Critical 9.3 | 70% | 1 exploit | |
| CVE-2016-9299 | Improper Neutralization of Special Elements used in an LDAP Query in Jenkins jenkins · jenkins | Critical 9.8 | 97% | 1 exploit | |
| CVE-2013-1966 | Arbitrary code execution in Apache Struts apache · struts | Critical 9.3 | 74% | 2 exploits | |
| CVE-2016-3087 | Apache Struts vulnerable to arbitrary remote code execution due to improper input validation apache · struts | Critical 9.8 | 82% | 3 exploits | |
| CVE-2017-9232 | Juju uses a UNIX domain socket without setting appropriate permissions canonical · juju | Critical 9.8 | 49% | 1 exploit | |
| CVE-2018-7251 | Anchor CMS Logs Credentials anchorcms · anchor | Critical 9.8 | 72% | 1 exploit | |
| CVE-2015-8103 | Jenkins CLI Deserialization of Untrusted Data vulnerability jenkins · jenkins | Critical 9.8 | 87% | 4 exploits | |
| CVE-2019-9194 | elFinder command injection vulnerability in the PHP connector std42 · elfinder | Critical 9.8 | 97% | 5 exploits | |
| CVE-2017-8046 | Remote code execution in PATCH requests in Spring Data REST pivotal software · spring data rest | Critical 9.8 | 75% | 1 exploit | |
| CVE-2022-1162 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. gitlab · gitlab | Critical 9.8 | 76% | 1 exploit | |
| CVE-2021-46422 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. telesquare · sdt-cs3b1 firmware | Critical 9.8 | 94% | 3 exploits | |
| CVE-2021-46442 | In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization. dlink · dir-825 firmware | Critical 9.8 | 56% | 1 exploit | |
| CVE-2022-29806 | ZoneMinder before 1.36.13 allows remote code execution via an invalid language. zoneminder · zoneminder | Critical 9.8 | 67% | 2 exploits | |
| CVE-2011-3923 | Struts ParameterInterceptor vulnerability allows remote command execution apache · struts | Critical 9.8 | 89% | 2 exploits | |
| CVE-2022-22956 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. vmware · identity manager | Critical 9.8 | 50% | 1 exploit |
Showing 151–200 of 1,192
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.