Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 19, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
401 vulnerabilities · highest exploit probability first
  • CVE-2013-3336Medium 5.0
    Unspecified vulnerability in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to read arbitrary files via unknown vectors.
    adobe · coldfusion
    EPSS74%
    1 exploit
    Published May 9, 2013
  • CVE-2013-3502Medium 6.5
    monarch_scan.cgi in the MONARCH component in GroundWork Monitor Enterprise 6.7.0 allows remote authenticated users to execute arbitrary commands, and consequently obtain sensitive information, by leveraging a JOSSO SSO cookie.
    gwos · groundwork monitor
    EPSS54%
    2 exploits
    Published May 8, 2013
  • CVE-2013-1884Medium 5.0
    The mod_dav_svn Apache HTTPD server module in Subversion 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (segmentation fault and crash) via a log REPORT request with an invalid limit, which triggers an access of an uninitialized variable.
    apache · subversion
    EPSS51%
    1 exploit
    Published May 2, 2013
  • CVE-2013-1847Medium 5.0
    The mod_dav_svn Apache HTTPD server module in Subversion 1.6.0 through 1.6.20 and 1.7.0 through 1.7.8 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an anonymous LOCK for a URL that does not exist.
    apache · subversion
    EPSS51%
    1 exploit
    Published May 2, 2013
  • CVE-2013-1428Medium 6.5
    Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.
    tinc-vpn · tinc
    EPSS61%
    2 exploits
    Published Apr 26, 2013
  • CVE-2013-3238Medium 6.0
    phpMyAdmin 3.5.x before 3.5.8 and 4.x before 4.0.0-rc3 allows remote authenticated users to execute arbitrary code via a /e\x00 sequence, which is not properly handled before making a preg_replace function call within the "Replace table prefix" feature.
    phpmyadmin · phpmyadmin
    EPSS29%
    3 exploits
    Published Apr 26, 2013
  • CVE-2013-1559Medium 4.0
    Unspecified vulnerability in the Oracle WebCenter Content component in Oracle Fusion Middleware 10.1.3.5.1 and 11.1.1.6.0 allows remote authenticated users to affect availability via unknown vectors related to Content Server.
    oracle · fusion middleware
    EPSS59%
    2 exploits
    Published Apr 17, 2013
  • CVE-2013-1892Medium 6.0
    MongoDB: Server Side JavaScript Includes allow Remote Code Execution
    mongodb · mongodb
    EPSS45%
    3 exploits
    Published Mar 24, 2013
  • CVE-2013-2492Medium 6.8
    Stack-based buffer overflow in Firebird 2.1.3 through 2.1.5 before 18514, and 2.5.1 through 2.5.3 before 26623, on Windows allows remote attackers to execute arbitrary code via a crafted packet to TCP port 3050, related to a missing size check during extraction of a group number…
    firebirdsql · firebird
    EPSS42%
    3 exploits
    Published Mar 15, 2013
  • CVE-2013-1469Medium 4.0
    Directory traversal vulnerability in install.php in Piwigo before 2.4.7 allows remote attackers to read and delete arbitrary files via a ..
    piwigo · piwigo
    EPSS56%
    4 exploits
    Published Mar 13, 2013
  • CVE-2013-0108Medium 6.8
    An ActiveX control in HscRemoteDeploy.dll in Honeywell Enterprise Buildings Integrator (EBI) R310, R400.2, R410.1, and R410.2; SymmetrE R310, R410.1, and R410.2; ComfortPoint Open Manager (aka CPO-M) Station R100; and HMIWeb Browser client packages allows remote attackers to…
    honeywell · enterprise buildings integrator
    EPSS27%
    2 exploits
    Published Feb 24, 2013
  • CVE-2012-6274Medium 5.0
    BigAntSoft BigAnt IM Message Server does not require authentication for file uploading, which allows remote attackers to create arbitrary files under AntServer\DocData\Public via unspecified vectors.
    bigantsoft · bigant im message server
    EPSS47%
    2 exploits
    Published Feb 24, 2013
  • CVE-2012-6330Medium 5.0
    The localization functionality in TWiki before 5.1.3, and Foswiki 1.0.x through 1.0.10 and 1.1.x through 1.1.6, allows remote attackers to cause a denial of service (memory consumption) via a large integer in a %MAKETEXT% macro.
    foswiki · foswiki
    EPSS36%
    2 exploits
    Published Jan 4, 2013
  • CVE-2012-4347Medium 5.0
    Multiple directory traversal vulnerabilities in the management console in Symantec Messaging Gateway (SMG) 9.5.x allow remote authenticated users to read arbitrary files via a ..
    symantec · messaging gateway
    EPSS59%
    1 exploit
    Published Dec 5, 2012
  • CVE-2012-5613Medium 6.0
    mysql: database privilege escalation using FILE privilege
    mariadb · mariadb
    EPSS32%
    5 exploits
    Published Dec 1, 2012
  • CVE-2012-4940Medium 6.4
    Multiple directory traversal vulnerabilities in the View Log Files component in Axigen Free Mail Server allow remote attackers to read or delete arbitrary files via a ..
    gecad · axigen free mail server
    EPSS85%
    1 exploit
    Published Oct 31, 2012
  • CVE-2012-3153Medium 6.4
    Unspecified vulnerability in the Oracle Reports Developer component in Oracle Fusion Middleware 11.1.1.4, 11.1.1.6, and 11.1.2.0 allows remote attackers to affect confidentiality and integrity via unknown vectors related to Servlet.
    oracle · fusion middleware
    EPSS98%
    2 exploits
    Published Oct 16, 2012
  • CVE-2012-5067Medium 5.0
    JDK: unspecified vulnerability (Deployment)
    oracle · jdk
    EPSS64%
    2 exploits
    Published Oct 16, 2012
  • CVE-2012-1153Medium 6.8
    Unrestricted file upload vulnerability in addons/uploadify/uploadify.php in appRain CMF 0.1.5 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in the uploads…
    apprain · apprain
    EPSS32%
    4 exploits
    Published Oct 6, 2012
  • CVE-2012-5002Medium 6.8
    Stack-based buffer overflow in SR10 FTP server (SR10.exe) 1.1.0.6 in Ricoh DC Software DL-10 4.5.0.1, when the Log file name option is enabled, allows remote attackers to execute arbitrary code via a long USER FTP command.
    ricoh · dl-10
    EPSS31%
    3 exploits
    Published Sep 19, 2012
  • CVE-2012-2982Medium 6.5
    file/show.cgi in Webmin 1.590 and earlier allows remote authenticated users to execute arbitrary commands via an invalid character in a pathname, as demonstrated by a | (pipe) character.
    gentoo · webmin
    EPSS62%
    2 exploits
    Published Sep 11, 2012
  • CVE-2011-5130Medium 6.8
    dev/less.php in Family Connections CMS (FCMS) 2.5.0 - 2.7.1, when register_globals is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in the argv[1] parameter.
    haudenschilt · family connections cms
    EPSS37%
    5 exploits
    Published Aug 30, 2012
  • CVE-2012-2962Medium 6.5
    SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.
    sonicwall · scrutinizer
    EPSS67%
    4 exploits
    Published Jul 30, 2012
  • CVE-2011-2657Medium 6.8
    Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a…
    novell · zenworks configuration management
    EPSS48%
    3 exploits
    Published Jul 26, 2012
  • CVE-2012-4031Medium 5.0
    Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a ..
    wangkongbao · cns-1000
    EPSS52%
    2 exploits
    Published Jul 17, 2012
  • CVE-2012-2122Medium 5.1
    mysql: incorrect type cast in check_scramble() leading to authentication bypass
    mariadb · mariadb
    EPSS97%
    1 exploit
    Published Jun 9, 2012
  • CVE-2012-2329Medium 5.0
    php: buffer overflow flaw in apache_request_headers() in PHP 5.4.x
    php · php
    EPSS62%
    2 exploits
    Published May 8, 2012
  • CVE-2012-2336Medium 5.0
    php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h
    php · php
    EPSS50%
    4 exploits
    Published May 3, 2012
  • CVE-2012-2215Medium 5.0
    Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.
    novell · zenworks configuration management
    EPSS28%
    1 exploit
    Published Apr 9, 2012
  • CVE-2011-4535Medium 6.8
    Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary…
    craig peterson · turbopower abbrevia
    EPSS27%
    3 exploits
    Published Apr 3, 2012
  • CVE-2011-4044Medium 5.8
    An unspecified ActiveX control in SVUIGrd.ocx in ARC Informatique PcVue 6.0 through 10.0, FrontVue, and PlantVue allows remote attackers to modify files via calls to unknown methods.
    arcinfo · frontvue
    EPSS27%
    3 exploits
    Published Apr 3, 2012
  • CVE-2012-1465Medium 4.3
    Stack-based buffer overflow in the HTTP Server in NetMechanica NetDecision before 4.6.1 allows remote attackers to cause a denial of service (application crash) via a long URL in an HTTP request.
    netmechanica · netdecision
    EPSS27%
    4 exploits
    Published Mar 19, 2012
  • CVE-2012-1196Medium 5.0
    Directory traversal vulnerability in the VulCore web service (WSVulnerabilityCore/VulCore.asmx) in Lenovo ThinkManagement Console 9.0.3 allows remote attackers to delete arbitrary files via a ..
    landesk · lenovo thinkmanagement console
    EPSS51%
    3 exploits
    Published Feb 17, 2012
  • CVE-2012-0053Medium 4.3
    protocol.c in the Apache HTTP Server 2.2.x through 2.2.21 does not properly restrict header information during construction of Bad Request (aka 400) error documents, which allows remote attackers to obtain the values of HTTPOnly cookies via vectors involving a (1) long or (2)…
    apache · http server
    EPSS82%
    1 exploit
    Published Jan 28, 2012
  • CVE-2012-0897Medium 6.8
    Stack-based buffer overflow in the JPEG2000 plugin in IrfanView PlugIns before 4.33 allows remote attackers to execute arbitrary code via a JPEG2000 (JP2) file with a crafted Quantization Default (QCD) marker segment.
    irfanview · irfanview
    EPSS52%
    2 exploits
    Published Jan 20, 2012
  • CVE-2011-5052Medium 6.8
    Stack-based buffer overflow in CoCSoft Stream Down 6.8.0 allows remote web servers to execute arbitrary code via a long response to a download request.
    cocsoft · stream down
    EPSS30%
    3 exploits
    Published Jan 4, 2012
  • CVE-2011-4642Medium 4.6
    mappy.py in Splunk Web in Splunk 4.2.x before 4.2.5 does not properly restrict use of the mappy command to access Python classes, which allows remote authenticated administrators to execute arbitrary code by leveraging the sys module in a request to the search application, as…
    splunk · splunk
    EPSS29%
    3 exploits
    Published Jan 3, 2012
  • CVE-2011-4885Medium 5.0
    php: hash table collisions CPU usage DoS (oCERT-2011-003)
    php · php
    EPSS83%
    3 exploits
    Published Dec 28, 2011
  • CVE-2011-5035Medium 5.0
    GlassFish: hash table collisions CPU usage DoS (oCERT-2011-003)
    oracle · glassfish server
    EPSS68%
    1 exploit
    Published Dec 28, 2011
  • CVE-2011-4317Medium 4.3
    The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a…
    apache · http server
    EPSS60%
    1 exploit
    Published Nov 30, 2011
  • CVE-2011-3639Medium 4.3
    The mod_proxy module in the Apache HTTP Server 2.0.x through 2.0.64 and 2.2.x before 2.2.18, when the Revision 1179239 patch is in place, does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which…
    apache · http server
    EPSS51%
    1 exploit
    Published Nov 30, 2011
  • CVE-2011-4404Medium 5.0
    The default configuration of the HTTP server in Jetty in vSphere Update Manager in VMware vCenter Update Manager 4.0 before Update 4 and 4.1 before Update 2 allows remote attackers to conduct directory traversal attacks and read arbitrary files via unspecified vectors, a related…
    vmware · vcenter update manager
    EPSS59%
    1 exploit
    Published Nov 19, 2011
  • CVE-2011-3230Medium 6.8
    Apple Safari before 5.1.1 on Mac OS X does not enforce an intended policy for file: URLs, which allows remote attackers to execute arbitrary code via a crafted web site.
    apple · safari
    EPSS49%
    2 exploits
    Published Oct 14, 2011
  • CVE-2011-3368Medium 5.0
    The mod_proxy module in the Apache HTTP Server 1.3.x through 1.3.42, 2.0.x through 2.0.64, and 2.2.x through 2.2.21 does not properly interact with use of (1) RewriteRule and (2) ProxyPassMatch pattern matches for configuration of a reverse proxy, which allows remote attackers…
    apache · http server
    EPSS91%
    1 exploit
    Published Oct 5, 2011
  • CVE-2011-3976Medium 6.8
    Stack-based buffer overflow in AmmSoft ScriptFTP 3.3 allows remote FTP servers to execute arbitrary code via a long filename in a response to a LIST command, as demonstrated using (1) GETLIST or (2) GETFILE in a ScriptFTP script.
    ammsoft · scriptftp
    EPSS31%
    5 exploits
    Published Oct 4, 2011
  • CVE-2011-3011Medium 5.0
    BaseServiceImpl.class in CA ARCserve D2D r15 does not properly handle sessions, which allows remote attackers to obtain credentials, and consequently execute arbitrary commands, via unspecified vectors.
    ca · arcserve d2d
    EPSS72%
    2 exploits
    Published Aug 15, 2011
  • CVE-2011-1574Medium 6.8
    Stack-based buffer overflow in the ReadS3M method in load_s3m.cpp in libmodplug before 0.8.8.2 allows remote attackers to execute arbitrary code via a crafted S3M file.
    konstanty bialkowski · libmodplug
    EPSS43%
    2 exploits
    Published May 9, 2011
  • CVE-2011-0063Medium 5.0
    The _list_file_get function in lib/Majordomo.pm in Majordomo 2 20110203 and earlier allows remote attackers to conduct directory traversal attacks and read arbitrary files via a ./.../ sequence in the "extra" parameter to the help command, which causes the regular expression to…
    mj2 · majordomo 2
    EPSS85%
    1 exploit
    Published Mar 15, 2011
  • CVE-2009-3028Medium 6.8
    The Altiris eXpress NS SC Download ActiveX control in AeXNSPkgDLLib.dll, as used in Symantec Altiris Deployment Solution 6.9.x, Notification Server 6.0.x, and Symantec Management Platform 7.0.x exposes an unsafe method, which allows remote attackers to force the download of…
    symantec · altiris deployment solution
    EPSS43%
    2 exploits
    Published Mar 7, 2011
  • CVE-2011-0762Medium 4.0
    The vsf_filename_passes_filter function in ls.c in vsftpd before 2.3.3 allows remote authenticated users to cause a denial of service (CPU consumption and process slot exhaustion) via crafted glob expressions in STAT commands in multiple FTP sessions, a different vulnerability…
    vsftpd project · vsftpd
    EPSS74%
    2 exploits
    Published Mar 2, 2011
Showing 201–250 of 401

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 19, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.