Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
2,494 vulnerabilities · highest exploit probability first
- CVE-2022-31137Critical 9.8Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability.roxy-wi · roxy-wiEPSS91%2 exploitsPublished Jul 8, 2022
- CVE-2022-33098Medium 6.1Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.magnolia-cms · magnolia cmsEPSS53%1 exploitPublished Jul 7, 2022
- CVE-2022-25046Critical 9.8A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.control-webpanel · webpanelEPSS57%1 exploitPublished Jul 7, 2022
- CVE-2022-31126Critical 9.8A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file.roxy-wi · roxy-wiEPSS53%1 exploitPublished Jul 6, 2022
- CVE-2022-2143Critical 9.8The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.advantech · iviewEPSS60%2 exploitsPublished Jun 29, 2022
- CVE-2022-28171Critical 9.8The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.hikvision · ds-a71024 firmwareEPSS52%2 exploitsPublished Jun 27, 2022
- CVE-2021-34429Medium 5.3For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.eclipse · jettyEPSS99%1 exploitPublished Jun 20, 2022
- CVE-2022-24562Critical 9.8In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.iobit · iotransferEPSS54%2 exploitsPublished Jun 16, 2022
- CVE-2022-30780High 7.5Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.lighttpd · lighttpdEPSS57%1 exploitPublished Jun 11, 2022
- CVE-2009-3555Critical 9.8The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4…apache · http serverEPSS87%3 exploitsPublished Jun 10, 2022
- CVE-2022-29013Critical 9.8A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.razer · sila firmwareEPSS77%2 exploitsPublished Jun 8, 2022
- CVE-2022-31470Medium 6.1An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and…axigen · axigen mobile webmailEPSS53%1 exploitPublished Jun 7, 2022
- CVE-2021-22145Medium 6.5Generation of Error Message Containing Sensitive Information in Elasticsearchelastic · elasticsearchEPSS76%2 exploitsPublished May 24, 2022
- CVE-2021-25282High 8.8SaltStack Salt Directory Traversal vulnerabilitysaltstack · saltEPSS92%1 exploitPublished May 24, 2022
- CVE-2021-25281Critical 9.8SaltStack Salt Improper Authentication vulnerabilitysaltstack · saltEPSS73%1 exploitPublished May 24, 2022
- CVE-2020-10770Medium 5.3Keycloak vulnerable to Server-Side Request Forgeryredhat · keycloakEPSS70%2 exploitsPublished May 24, 2022
- CVE-2020-25592Critical 9.8SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapisaltstack · saltEPSS57%1 exploitPublished May 24, 2022
- CVE-2020-25540High 7.5ThinkAdmin directory traversal vulnerabilitythinkadmin · thinkadminEPSS75%2 exploitsPublished May 24, 2022
- CVE-2020-2230Medium 5.4Jenkins Cross-site Scripting vulnerability in project naming strategyjenkins · jenkinsEPSS83%2 exploitsPublished May 24, 2022
- CVE-2020-9757Critical 9.8SEOmatic for CraftCMS allows Server-Side Template Injectioncraftcms · craft cmsEPSS73%1 exploitPublished May 24, 2022
- CVE-2020-2096Medium 6.1Reflected XSS vulnerability in Jenkins gitlab-hook Pluginjenkins · gitlab hookEPSS93%2 exploitsPublished May 24, 2022
- CVE-2019-10475Medium 6.1Jenkins build-metrics Plugin reflected cross-site scripting vulnerabilityjenkins · build-metricsEPSS58%1 exploitPublished May 24, 2022
- CVE-2019-15954Critical 9.9Total.js CMS RCE Vulnerabilitytotaljs · total.js cmsEPSS79%2 exploitsPublished May 24, 2022
- CVE-2019-14470Medium 6.1Cosenary Instagram-PHP-API contains reflected XSS vulnerabilityinstagram-php-api project · instagram-php-apiEPSS83%2 exploitsPublished May 24, 2022
- CVE-2019-14322High 7.5Pallets Werkzeug vulnerable to Path Traversalpalletsprojects · werkzeugEPSS56%1 exploitPublished May 24, 2022
- CVE-2019-13068Medium 5.4Grafana Cross-site Scripting vulnerabilitygrafana · grafanaEPSS52%1 exploitPublished May 24, 2022
- CVE-2019-12799High 8.8Shopware Insecure Deserialization Vulnerabilityshopware · shopwareEPSS54%1 exploitPublished May 24, 2022
- CVE-2018-20434Critical 9.8LibreNMS arbitrary OS commands executionlibrenms · librenmsEPSS71%4 exploitsPublished May 24, 2022
- CVE-2014-9390Critical 9.3JGit Improper Input Validation vulnerabilityapple · xcodeEPSS76%1 exploitPublished May 17, 2022
- CVE-2014-8739Critical 9.8jQuery File Upload Plugin Unrestricted file upload vulnerabilitycreative-solutions · creative contact formEPSS92%5 exploitsPublished May 17, 2022
- CVE-2021-44790Critical 9.8A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).apache · http serverEPSS97%2 exploitsPublished May 17, 2022
- CVE-2008-6505Medium 5.0Apache Struts directory traversal vulnerabilityapache · strutsEPSS73%1 exploitPublished May 17, 2022
- CVE-2010-4335High 7.5CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary codecakefoundation · cakephpEPSS55%3 exploitsPublished May 17, 2022
- CVE-2011-3587Critical 9.3Zope Command Execution Vulnerabilityplone · ploneEPSS78%2 exploitsPublished May 17, 2022
- CVE-2013-1814Medium 4.0Apache Rave information disclosure vulnerabilityapache · raveEPSS74%1 exploitPublished May 17, 2022
- CVE-2013-5093Critical 9.5graphite-web is vulnerable to Remote Code Execution via renderLocalView functiongraphite project · graphiteEPSS39%1 exploitPublished May 17, 2022
- CVE-2012-6081Medium 5.3MoinMoin Multiple unrestricted file upload vulnerabilitiesmoinmo · moinmoinEPSS35%3 exploitsPublished May 17, 2022
- CVE-2016-0709High 7.2Path Traversal in Apache Jetspeedapache · jetspeedEPSS77%2 exploitsPublished May 17, 2022
- CVE-2016-0710High 8.8Apache Jetspeed vulnerable to SQL Injectionapache · jetspeedEPSS52%3 exploitsPublished May 17, 2022
- CVE-2013-2248Medium 5.8Open redirect in Apache Strutsapache · strutsEPSS95%1 exploitPublished May 17, 2022
- CVE-2016-5734Critical 9.8phpMyAdmin Code Injection vulnerabilityphpmyadmin · phpmyadminEPSS81%3 exploitsPublished May 17, 2022
- CVE-2012-1006Medium 4.3Apache Struts Multiple Cross-site Scripting Vulnerabilitiesapache · strutsEPSS57%1 exploitPublished May 17, 2022
- CVE-2014-8684Critical 9.8CodeIgniter and Kohana vulnerable to PHP Object Injectioncodeigniter · codeigniterEPSS72%2 exploitsPublished May 17, 2022
- CVE-2022-30781High 7.5Shell command injection in giteagitea · giteaEPSS88%2 exploitsPublished May 17, 2022
- CVE-2016-0792High 8.8Jenkins allows Deserialization of Untrusted Data via an XML Filejenkins · jenkinsEPSS83%1 exploitPublished May 14, 2022
- CVE-2011-4858Medium 5.0Improper Input Validation in Apache Tomcatapache · tomcatEPSS80%1 exploitPublished May 14, 2022
- CVE-2018-10094Critical 9.8Dolibarr SQL injection vulnerabilitydolibarr · dolibarrEPSS70%2 exploitsPublished May 14, 2022
- CVE-2015-1833Medium 6.4Improper Input Validation in Apache Jackrabbitapache · jackrabbitEPSS56%2 exploitsPublished May 14, 2022
- CVE-2015-5531Medium 5.0Improper Limitation of a Pathname to a Restricted Directory in Elasticsearchelasticsearch · elasticsearchEPSS95%1 exploitPublished May 14, 2022
- CVE-2015-7611High 8.1Apache James Server OS Command Injectionapache · james serverEPSS69%2 exploitsPublished May 14, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-31137 | Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. roxy-wi · roxy-wi | Critical 9.8 | 91% | 2 exploits | |
| CVE-2022-33098 | Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. magnolia-cms · magnolia cms | Medium 6.1 | 53% | 1 exploit | |
| CVE-2022-25046 | A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request. control-webpanel · webpanel | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-31126 | A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. roxy-wi · roxy-wi | Critical 9.8 | 53% | 1 exploit | |
| CVE-2022-2143 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. advantech · iview | Critical 9.8 | 60% | 2 exploits | |
| CVE-2022-28171 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. hikvision · ds-a71024 firmware | Critical 9.8 | 52% | 2 exploits | |
| CVE-2021-34429 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. eclipse · jetty | Medium 5.3 | 99% | 1 exploit | |
| CVE-2022-24562 | In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution. iobit · iotransfer | Critical 9.8 | 54% | 2 exploits | |
| CVE-2022-30780 | Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers. lighttpd · lighttpd | High 7.5 | 57% | 1 exploit | |
| CVE-2009-3555 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4… apache · http server | Critical 9.8 | 87% | 3 exploits | |
| CVE-2022-29013 | A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. razer · sila firmware | Critical 9.8 | 77% | 2 exploits | |
| CVE-2022-31470 | An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and… axigen · axigen mobile webmail | Medium 6.1 | 53% | 1 exploit | |
| CVE-2021-22145 | Generation of Error Message Containing Sensitive Information in Elasticsearch elastic · elasticsearch | Medium 6.5 | 76% | 2 exploits | |
| CVE-2021-25282 | SaltStack Salt Directory Traversal vulnerability saltstack · salt | High 8.8 | 92% | 1 exploit | |
| CVE-2021-25281 | SaltStack Salt Improper Authentication vulnerability saltstack · salt | Critical 9.8 | 73% | 1 exploit | |
| CVE-2020-10770 | Keycloak vulnerable to Server-Side Request Forgery redhat · keycloak | Medium 5.3 | 70% | 2 exploits | |
| CVE-2020-25592 | SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi saltstack · salt | Critical 9.8 | 57% | 1 exploit | |
| CVE-2020-25540 | ThinkAdmin directory traversal vulnerability thinkadmin · thinkadmin | High 7.5 | 75% | 2 exploits | |
| CVE-2020-2230 | Jenkins Cross-site Scripting vulnerability in project naming strategy jenkins · jenkins | Medium 5.4 | 83% | 2 exploits | |
| CVE-2020-9757 | SEOmatic for CraftCMS allows Server-Side Template Injection craftcms · craft cms | Critical 9.8 | 73% | 1 exploit | |
| CVE-2020-2096 | Reflected XSS vulnerability in Jenkins gitlab-hook Plugin jenkins · gitlab hook | Medium 6.1 | 93% | 2 exploits | |
| CVE-2019-10475 | Jenkins build-metrics Plugin reflected cross-site scripting vulnerability jenkins · build-metrics | Medium 6.1 | 58% | 1 exploit | |
| CVE-2019-15954 | Total.js CMS RCE Vulnerability totaljs · total.js cms | Critical 9.9 | 79% | 2 exploits | |
| CVE-2019-14470 | Cosenary Instagram-PHP-API contains reflected XSS vulnerability instagram-php-api project · instagram-php-api | Medium 6.1 | 83% | 2 exploits | |
| CVE-2019-14322 | Pallets Werkzeug vulnerable to Path Traversal palletsprojects · werkzeug | High 7.5 | 56% | 1 exploit | |
| CVE-2019-13068 | Grafana Cross-site Scripting vulnerability grafana · grafana | Medium 5.4 | 52% | 1 exploit | |
| CVE-2019-12799 | Shopware Insecure Deserialization Vulnerability shopware · shopware | High 8.8 | 54% | 1 exploit | |
| CVE-2018-20434 | LibreNMS arbitrary OS commands execution librenms · librenms | Critical 9.8 | 71% | 4 exploits | |
| CVE-2014-9390 | JGit Improper Input Validation vulnerability apple · xcode | Critical 9.3 | 76% | 1 exploit | |
| CVE-2014-8739 | jQuery File Upload Plugin Unrestricted file upload vulnerability creative-solutions · creative contact form | Critical 9.8 | 92% | 5 exploits | |
| CVE-2021-44790 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). apache · http server | Critical 9.8 | 97% | 2 exploits | |
| CVE-2008-6505 | Apache Struts directory traversal vulnerability apache · struts | Medium 5.0 | 73% | 1 exploit | |
| CVE-2010-4335 | CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code cakefoundation · cakephp | High 7.5 | 55% | 3 exploits | |
| CVE-2011-3587 | Zope Command Execution Vulnerability plone · plone | Critical 9.3 | 78% | 2 exploits | |
| CVE-2013-1814 | Apache Rave information disclosure vulnerability apache · rave | Medium 4.0 | 74% | 1 exploit | |
| CVE-2013-5093 | graphite-web is vulnerable to Remote Code Execution via renderLocalView function graphite project · graphite | Critical 9.5 | 39% | 1 exploit | |
| CVE-2012-6081 | MoinMoin Multiple unrestricted file upload vulnerabilities moinmo · moinmoin | Medium 5.3 | 35% | 3 exploits | |
| CVE-2016-0709 | Path Traversal in Apache Jetspeed apache · jetspeed | High 7.2 | 77% | 2 exploits | |
| CVE-2016-0710 | Apache Jetspeed vulnerable to SQL Injection apache · jetspeed | High 8.8 | 52% | 3 exploits | |
| CVE-2013-2248 | Open redirect in Apache Struts apache · struts | Medium 5.8 | 95% | 1 exploit | |
| CVE-2016-5734 | phpMyAdmin Code Injection vulnerability phpmyadmin · phpmyadmin | Critical 9.8 | 81% | 3 exploits | |
| CVE-2012-1006 | Apache Struts Multiple Cross-site Scripting Vulnerabilities apache · struts | Medium 4.3 | 57% | 1 exploit | |
| CVE-2014-8684 | CodeIgniter and Kohana vulnerable to PHP Object Injection codeigniter · codeigniter | Critical 9.8 | 72% | 2 exploits | |
| CVE-2022-30781 | Shell command injection in gitea gitea · gitea | High 7.5 | 88% | 2 exploits | |
| CVE-2016-0792 | Jenkins allows Deserialization of Untrusted Data via an XML File jenkins · jenkins | High 8.8 | 83% | 1 exploit | |
| CVE-2011-4858 | Improper Input Validation in Apache Tomcat apache · tomcat | Medium 5.0 | 80% | 1 exploit | |
| CVE-2018-10094 | Dolibarr SQL injection vulnerability dolibarr · dolibarr | Critical 9.8 | 70% | 2 exploits | |
| CVE-2015-1833 | Improper Input Validation in Apache Jackrabbit apache · jackrabbit | Medium 6.4 | 56% | 2 exploits | |
| CVE-2015-5531 | Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch elasticsearch · elasticsearch | Medium 5.0 | 95% | 1 exploit | |
| CVE-2015-7611 | Apache James Server OS Command Injection apache · james server | High 8.1 | 69% | 2 exploits |
Showing 301–350 of 2,494
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.