Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,192 vulnerabilities · highest exploit probability first
- CVE-2021-46419Critical 9.1An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.telesquare · tlr-2855ks6 firmwareEPSS71%2 exploitsPublished Apr 7, 2022
- CVE-2022-28219Critical 9.8Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.zohocorp · manageengine adaudit plusEPSS97%2 exploitsPublished Apr 5, 2022
- CVE-2022-28368Critical 9.8Remote code injection in dompdf/dompdfdompdf project · dompdfEPSS83%2 exploitsPublished Apr 4, 2022
- CVE-2022-28381Critical 9.8Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.allmediaserver · allmediaserverEPSS70%3 exploitsPublished Apr 3, 2022
- CVE-2022-23881Critical 9.8ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.zzzcms · zzzphpEPSS57%1 exploitPublished Mar 23, 2022
- CVE-2022-24637Critical 9.8Improper Privilege Management in Open Web Analyticsopenwebanalytics · open web analyticsEPSS99%3 exploitsPublished Mar 19, 2022
- CVE-2022-25487Critical 9.8Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.thedigitalcraft · atomcmsEPSS54%2 exploitsPublished Mar 15, 2022
- CVE-2021-4045Critical 9.8TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root.tp-link · tapo c200 firmwareEPSS72%2 exploitsPublished Mar 10, 2022
- CVE-2022-0441Critical 9.8The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an adminstylemixthemes · masterstudy lmsEPSS85%1 exploitPublished Mar 7, 2022
- CVE-2021-4039Critical 9.8A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.zyxel · nwa1100-nh firmwareEPSS71%2 exploitsPublished Mar 2, 2022
- CVE-2021-24931Critical 9.8Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injectionays-pro · secure copy content protection and content lockingEPSS79%2 exploitsPublished Feb 15, 2022
- CVE-2018-1002105Critical 9.8Privilege Escalation in Kuberneteskubernetes · kubernetesEPSS87%2 exploitsPublished Feb 15, 2022
- CVE-2020-27955Critical 9.8Git LFS can execute a Git binary from the current directorygit large file storage project · git large file storageEPSS82%3 exploitsPublished Feb 11, 2022
- CVE-2022-20705Critical 9.8Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and…cisco · rv160 firmwareEPSS80%1 exploitPublished Feb 11, 2022
- CVE-2022-21907Critical 9.8HTTP Protocol Stack Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS93%1 exploitPublished Feb 9, 2022
- CVE-2021-1472Critical 9.8Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers.cisco · rv160 firmwareEPSS72%2 exploitsPublished Feb 3, 2022
- CVE-2021-1473Critical 9.8Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers.cisco · rv340 firmwareEPSS64%2 exploitsPublished Feb 3, 2022
- CVE-2022-24223Critical 9.8AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.thedigitalcraft · atomcmsEPSS62%3 exploitsPublished Feb 1, 2022
- CVE-2021-24762Critical 9.8The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.getperfectsurvey · perfect surveyEPSS87%2 exploitsPublished Feb 1, 2022
- CVE-2022-23178Critical 9.8An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices.crestron · hd-md4x2-4k-e firmwareEPSS75%1 exploitPublished Jan 15, 2022
- CVE-2021-43857Critical 9.3Gerapy may cause remote code executiongerapy · gerapyEPSS55%1 exploitPublished Jan 6, 2022
- CVE-2021-45428Critical 9.8TLR-2005KSH is affected by an incorrect access control vulnerability.telesquare · tlr-2005ksh firmwareEPSS57%2 exploitsPublished Jan 3, 2022
- CVE-2021-24946Critical 9.8The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issuewebnus · modern events calendar liteEPSS73%3 exploitsPublished Dec 13, 2021
- CVE-2021-44152Critical 9.8Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user.reprisesoftware · reprise license managerEPSS59%1 exploitPublished Dec 13, 2021
- CVE-2021-40859Critical 9.8Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device.auerswald · compact 5500r firmwareEPSS72%1 exploitPublished Dec 7, 2021
- CVE-2021-44427Critical 9.8SQL Injection in rosariosisrosariosis · rosariosisEPSS51%1 exploitPublished Dec 2, 2021
- CVE-2020-16152Critical 9.8The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.extremenetworks · aerohive netconfigEPSS36%2 exploitsPublished Nov 14, 2021
- CVE-2021-42847Critical 9.8Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.zohocorp · manageengine adaudit plusEPSS70%1 exploitPublished Nov 11, 2021
- CVE-2021-38294Critical 9.8Command injection leading to Remote Code Execution in Apache Stormapache · stormEPSS84%2 exploitsPublished Oct 26, 2021
- CVE-2021-20837Critical 9.8Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type…sixapart · movable typeEPSS88%2 exploitsPublished Oct 26, 2021
- CVE-2021-21809Critical 9.1Moodle command execution vulnerability exists in the default legacy spellchecker pluginmoodle · moodleEPSS24%3 exploitsPublished Oct 13, 2021
- CVE-2021-42071Critical 9.8In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.visual-tools · dvr vx16 firmwareEPSS70%1 exploitPublished Oct 7, 2021
- CVE-2021-32172Critical 9.8Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.maianscriptworld · maian cartEPSS66%3 exploitsPublished Oct 7, 2021
- CVE-2021-41649Critical 9.8An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter.online-shopping-system-advanced project · online-shopping-system-advancedEPSS52%1 exploitPublished Oct 1, 2021
- CVE-2021-20034Critical 9.1An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.sonicwall · sma 500vEPSS81%2 exploitsPublished Sep 27, 2021
- CVE-2021-33543Critical 9.8Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings.geutebrueck · g-cam ebc-2110 firmwareEPSS81%1 exploitPublished Sep 13, 2021
- CVE-2019-14931Critical 9.8An issue was discovered on Mitsubishi Electric Europe B.V.inea · me-rtu firmwareEPSS57%1 exploitPublished Sep 10, 2021
- CVE-2021-34646Critical 9.8Booster for WooCommerce <= 5.4.3 - Authentication Bypassbooster · booster for woocommerceEPSS51%1 exploitPublished Aug 31, 2021
- CVE-2021-36356Critical 9.8KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI).kramerav · viawareEPSS54%2 exploitsPublished Aug 31, 2021
- CVE-2021-37425Critical 9.1Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.altova · mobiletogether serverEPSS66%1 exploitPublished Aug 10, 2021
- CVE-2021-24499Critical 9.8The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way.amentotech · workreapEPSS60%1 exploitPublished Aug 9, 2021
- CVE-2020-35476Critical 9.8OS Command Injection in OpenTSDBopentsdb · opentsdbEPSS85%3 exploitsPublished Aug 2, 2021
- CVE-2020-7388Critical 9.8Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component.sage · adxadminEPSS69%1 exploitPublished Jul 22, 2021
- CVE-2021-35064Critical 9.8KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo.kramerav · viawareEPSS71%2 exploitsPublished Jul 12, 2021
- CVE-2021-34621Critical 9.8.properfraction · profilepressEPSS69%2 exploitsPublished Jul 7, 2021
- CVE-2018-11218Critical 9.8redis - security updateredislabs · redisEPSS59%1 exploitPublished Jul 7, 2021
- CVE-2021-34427Critical 9.8In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.eclipse · business intelligence and reporting toolsEPSS58%1 exploitPublished Jun 25, 2021
- CVE-2021-32682Critical 9.8elFinder before 2.1.59 contains multiple vulnerabilities leading to RCEstd42 · elfinderEPSS70%2 exploitsPublished Jun 16, 2021
- CVE-2021-3007Critical 9.8Remote code execution in zendframework and laminas-httpgetlaminas · laminas-httpEPSS75%1 exploitPublished Jun 8, 2021
- CVE-2021-22911Critical 9.8A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.rocket.chat · rocket.chatEPSS95%4 exploitsPublished May 27, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-46419 | An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. telesquare · tlr-2855ks6 firmware | Critical 9.1 | 71% | 2 exploits | |
| CVE-2022-28219 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. zohocorp · manageengine adaudit plus | Critical 9.8 | 97% | 2 exploits | |
| CVE-2022-28368 | Remote code injection in dompdf/dompdf dompdf project · dompdf | Critical 9.8 | 83% | 2 exploits | |
| CVE-2022-28381 | Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932. allmediaserver · allmediaserver | Critical 9.8 | 70% | 3 exploits | |
| CVE-2022-23881 | ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. zzzcms · zzzphp | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-24637 | Improper Privilege Management in Open Web Analytics openwebanalytics · open web analytics | Critical 9.8 | 99% | 3 exploits | |
| CVE-2022-25487 | Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. thedigitalcraft · atomcms | Critical 9.8 | 54% | 2 exploits | |
| CVE-2021-4045 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. tp-link · tapo c200 firmware | Critical 9.8 | 72% | 2 exploits | |
| CVE-2022-0441 | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin stylemixthemes · masterstudy lms | Critical 9.8 | 85% | 1 exploit | |
| CVE-2021-4039 | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. zyxel · nwa1100-nh firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2021-24931 | Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injection ays-pro · secure copy content protection and content locking | Critical 9.8 | 79% | 2 exploits | |
| CVE-2018-1002105 | Privilege Escalation in Kubernetes kubernetes · kubernetes | Critical 9.8 | 87% | 2 exploits | |
| CVE-2020-27955 | Git LFS can execute a Git binary from the current directory git large file storage project · git large file storage | Critical 9.8 | 82% | 3 exploits | |
| CVE-2022-20705 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and… cisco · rv160 firmware | Critical 9.8 | 80% | 1 exploit | |
| CVE-2022-21907 | HTTP Protocol Stack Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 93% | 1 exploit | |
| CVE-2021-1472 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. cisco · rv160 firmware | Critical 9.8 | 72% | 2 exploits | |
| CVE-2021-1473 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. cisco · rv340 firmware | Critical 9.8 | 64% | 2 exploits | |
| CVE-2022-24223 | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. thedigitalcraft · atomcms | Critical 9.8 | 62% | 3 exploits | |
| CVE-2021-24762 | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection. getperfectsurvey · perfect survey | Critical 9.8 | 87% | 2 exploits | |
| CVE-2022-23178 | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. crestron · hd-md4x2-4k-e firmware | Critical 9.8 | 75% | 1 exploit | |
| CVE-2021-43857 | Gerapy may cause remote code execution gerapy · gerapy | Critical 9.3 | 55% | 1 exploit | |
| CVE-2021-45428 | TLR-2005KSH is affected by an incorrect access control vulnerability. telesquare · tlr-2005ksh firmware | Critical 9.8 | 57% | 2 exploits | |
| CVE-2021-24946 | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue webnus · modern events calendar lite | Critical 9.8 | 73% | 3 exploits | |
| CVE-2021-44152 | Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. reprisesoftware · reprise license manager | Critical 9.8 | 59% | 1 exploit | |
| CVE-2021-40859 | Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device. auerswald · compact 5500r firmware | Critical 9.8 | 72% | 1 exploit | |
| CVE-2021-44427 | SQL Injection in rosariosis rosariosis · rosariosis | Critical 9.8 | 51% | 1 exploit | |
| CVE-2020-16152 | The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file. extremenetworks · aerohive netconfig | Critical 9.8 | 36% | 2 exploits | |
| CVE-2021-42847 | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. zohocorp · manageengine adaudit plus | Critical 9.8 | 70% | 1 exploit | |
| CVE-2021-38294 | Command injection leading to Remote Code Execution in Apache Storm apache · storm | Critical 9.8 | 84% | 2 exploits | |
| CVE-2021-20837 | Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type… sixapart · movable type | Critical 9.8 | 88% | 2 exploits | |
| CVE-2021-21809 | Moodle command execution vulnerability exists in the default legacy spellchecker plugin moodle · moodle | Critical 9.1 | 24% | 3 exploits | |
| CVE-2021-42071 | In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header. visual-tools · dvr vx16 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2021-32172 | Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin. maianscriptworld · maian cart | Critical 9.8 | 66% | 3 exploits | |
| CVE-2021-41649 | An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. online-shopping-system-advanced project · online-shopping-system-advanced | Critical 9.8 | 52% | 1 exploit | |
| CVE-2021-20034 | An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. sonicwall · sma 500v | Critical 9.1 | 81% | 2 exploits | |
| CVE-2021-33543 | Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. geutebrueck · g-cam ebc-2110 firmware | Critical 9.8 | 81% | 1 exploit | |
| CVE-2019-14931 | An issue was discovered on Mitsubishi Electric Europe B.V. inea · me-rtu firmware | Critical 9.8 | 57% | 1 exploit | |
| CVE-2021-34646 | Booster for WooCommerce <= 5.4.3 - Authentication Bypass booster · booster for woocommerce | Critical 9.8 | 51% | 1 exploit | |
| CVE-2021-36356 | KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). kramerav · viaware | Critical 9.8 | 54% | 2 exploits | |
| CVE-2021-37425 | Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key. altova · mobiletogether server | Critical 9.1 | 66% | 1 exploit | |
| CVE-2021-24499 | The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. amentotech · workreap | Critical 9.8 | 60% | 1 exploit | |
| CVE-2020-35476 | OS Command Injection in OpenTSDB opentsdb · opentsdb | Critical 9.8 | 85% | 3 exploits | |
| CVE-2020-7388 | Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. sage · adxadmin | Critical 9.8 | 69% | 1 exploit | |
| CVE-2021-35064 | KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. kramerav · viaware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2021-34621 | . properfraction · profilepress | Critical 9.8 | 69% | 2 exploits | |
| CVE-2018-11218 | redis - security update redislabs · redis | Critical 9.8 | 59% | 1 exploit | |
| CVE-2021-34427 | In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance. eclipse · business intelligence and reporting tools | Critical 9.8 | 58% | 1 exploit | |
| CVE-2021-32682 | elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE std42 · elfinder | Critical 9.8 | 70% | 2 exploits | |
| CVE-2021-3007 | Remote code execution in zendframework and laminas-http getlaminas · laminas-http | Critical 9.8 | 75% | 1 exploit | |
| CVE-2021-22911 | A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE. rocket.chat · rocket.chat | Critical 9.8 | 95% | 4 exploits |
Showing 201–250 of 1,192
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.