Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
2,494 vulnerabilities · highest exploit probability first
- CVE-2016-0784Medium 6.5Apache OpenMeetings Directory Traversal vulnerabilityapache · openmeetingsEPSS56%1 exploitPublished May 14, 2022
- CVE-2016-0956High 7.5Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Postadobe · experience managerEPSS51%1 exploitPublished May 14, 2022
- CVE-2010-3863Medium 5.0Apache Shiro Path Traversal vulnerabilityapache · shiroEPSS55%1 exploitPublished May 14, 2022
- CVE-2008-5619Critical 10.0PHPMailer susceptible to arbitrary code executionroundcube · webmailEPSS59%2 exploitsPublished May 14, 2022
- CVE-2016-7190High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS67%1 exploitPublished May 14, 2022
- CVE-2016-7194High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS58%1 exploitPublished May 14, 2022
- CVE-2013-2134Critical 9.3Arbitrary code execution in Apache Struts 2apache · strutsEPSS70%1 exploitPublished May 14, 2022
- CVE-2015-1830Medium 5.0Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQapache · activemqEPSS84%3 exploitsPublished May 14, 2022
- CVE-2017-18357Medium 6.5Shopware XXE Vulnerabilityshopware · shopwareEPSS27%2 exploitsPublished May 14, 2022
- CVE-2016-9299Critical 9.8Improper Neutralization of Special Elements used in an LDAP Query in Jenkinsjenkins · jenkinsEPSS97%1 exploitPublished May 14, 2022
- CVE-2014-0112High 7.3ClassLoader manipulation in Apache Strutsapache · strutsEPSS98%3 exploitsPublished May 14, 2022
- CVE-2014-0094Medium 5.0ClassLoader manipulation in Apache Strutsapache · strutsEPSS99%3 exploitsPublished May 14, 2022
- CVE-2014-0113High 7.5ClassLoader manipulation in Apache Strutsapache · strutsEPSS78%1 exploitPublished May 14, 2022
- CVE-2013-1966Critical 9.3Arbitrary code execution in Apache Strutsapache · strutsEPSS74%2 exploitsPublished May 14, 2022
- CVE-2016-3087Critical 9.8Apache Struts vulnerable to arbitrary remote code execution due to improper input validationapache · strutsEPSS82%3 exploitsPublished May 14, 2022
- CVE-2018-8145High 7.5ChakraCore information disclosure vulnerabilitymicrosoft · chakracoreEPSS67%1 exploitPublished May 13, 2022
- CVE-2018-1000207High 7.2MODX Revolution Incorrect Access Control vulnerabilitymodx · modx revolutionEPSS64%1 exploitPublished May 13, 2022
- CVE-2017-9232Critical 9.8Juju uses a UNIX domain socket without setting appropriate permissionscanonical · jujuEPSS49%1 exploitPublished May 13, 2022
- CVE-2017-11610High 8.7Incorrect Default Permissions in Supervisorsupervisord · supervisorEPSS87%1 exploitPublished May 13, 2022
- CVE-2018-7251Critical 9.8Anchor CMS Logs Credentialsanchorcms · anchorEPSS72%1 exploitPublished May 13, 2022
- CVE-2018-10054High 8.8Improper Input Validation in Datomiccognitect · datomicEPSS34%1 exploitPublished May 13, 2022
- CVE-2015-8103Critical 9.8Jenkins CLI Deserialization of Untrusted Data vulnerabilityjenkins · jenkinsEPSS87%4 exploitsPublished May 13, 2022
- CVE-2019-10867High 8.8Pimcore Unserialize Remote Code Executionpimcore · pimcoreEPSS69%4 exploitsPublished May 13, 2022
- CVE-2017-1000119High 7.2October CMS PHP Code Executionoctobercms · octoberEPSS61%2 exploitsPublished May 13, 2022
- CVE-2019-9194Critical 9.8elFinder command injection vulnerability in the PHP connectorstd42 · elfinderEPSS97%5 exploitsPublished May 13, 2022
- CVE-2019-0567High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS80%1 exploitPublished May 13, 2022
- CVE-2019-0568High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS69%1 exploitPublished May 13, 2022
- CVE-2019-0539High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS83%3 exploitsPublished May 13, 2022
- CVE-2018-8617High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS62%1 exploitPublished May 13, 2022
- CVE-2018-8355High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS68%1 exploitPublished May 13, 2022
- CVE-2018-8291High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS69%1 exploitPublished May 13, 2022
- CVE-2018-8288High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS69%1 exploitPublished May 13, 2022
- CVE-2018-8139High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS66%1 exploitPublished May 13, 2022
- CVE-2018-8133High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS50%1 exploitPublished May 13, 2022
- CVE-2018-0980High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS66%1 exploitPublished May 13, 2022
- CVE-2018-0934High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS66%2 exploitsPublished May 13, 2022
- CVE-2018-0933High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS66%1 exploitPublished May 13, 2022
- CVE-2018-0860High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS65%1 exploitPublished May 13, 2022
- CVE-2018-0838High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS65%1 exploitPublished May 13, 2022
- CVE-2018-0837High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS65%1 exploitPublished May 13, 2022
- CVE-2018-0834High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS55%1 exploitPublished May 13, 2022
- CVE-2018-0835High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS65%1 exploitPublished May 13, 2022
- CVE-2017-7615High 8.8MantisBT allows arbitrary password resetmantisbt · mantisbtEPSS91%3 exploitsPublished May 13, 2022
- CVE-2013-2115High 8.1Code injection in Apache Strutsapache · strutsEPSS75%2 exploitsPublished May 13, 2022
- CVE-2019-1003001High 8.8Jenkins Groovy Plugin sandbox bypass vulnerabilityjenkins · pipeline\EPSS86%5 exploitsPublished May 13, 2022
- CVE-2019-1003002High 8.8Jenkins Pipeline Declarative Plugin sandbox bypass vulnerabilityjenkins · pipeline\EPSS81%5 exploitsPublished May 13, 2022
- CVE-2019-1003000High 8.8Protection Mechanism Failure in Jenkins Script Security Pluginjenkins · script securityEPSS98%7 exploitsPublished May 13, 2022
- CVE-2017-1000170High 7.5jqueryFileTree vulnerable to Directory Traversaljqueryfiletree project · jqueryfiletreeEPSS59%1 exploitPublished May 13, 2022
- CVE-2018-19422High 7.2Subrion CMS RCE Vulnerabilityintelliants · subrion cmsEPSS64%4 exploitsPublished May 13, 2022
- CVE-2017-5637High 7.5Uncontrolled Resource Consumption in Apache ZooKeeperapache · zookeeperEPSS73%1 exploitPublished May 13, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-0784 | Apache OpenMeetings Directory Traversal vulnerability apache · openmeetings | Medium 6.5 | 56% | 1 exploit | |
| CVE-2016-0956 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post adobe · experience manager | High 7.5 | 51% | 1 exploit | |
| CVE-2010-3863 | Apache Shiro Path Traversal vulnerability apache · shiro | Medium 5.0 | 55% | 1 exploit | |
| CVE-2008-5619 | PHPMailer susceptible to arbitrary code execution roundcube · webmail | Critical 10.0 | 59% | 2 exploits | |
| CVE-2016-7190 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 67% | 1 exploit | |
| CVE-2016-7194 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 58% | 1 exploit | |
| CVE-2013-2134 | Arbitrary code execution in Apache Struts 2 apache · struts | Critical 9.3 | 70% | 1 exploit | |
| CVE-2015-1830 | Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ apache · activemq | Medium 5.0 | 84% | 3 exploits | |
| CVE-2017-18357 | Shopware XXE Vulnerability shopware · shopware | Medium 6.5 | 27% | 2 exploits | |
| CVE-2016-9299 | Improper Neutralization of Special Elements used in an LDAP Query in Jenkins jenkins · jenkins | Critical 9.8 | 97% | 1 exploit | |
| CVE-2014-0112 | ClassLoader manipulation in Apache Struts apache · struts | High 7.3 | 98% | 3 exploits | |
| CVE-2014-0094 | ClassLoader manipulation in Apache Struts apache · struts | Medium 5.0 | 99% | 3 exploits | |
| CVE-2014-0113 | ClassLoader manipulation in Apache Struts apache · struts | High 7.5 | 78% | 1 exploit | |
| CVE-2013-1966 | Arbitrary code execution in Apache Struts apache · struts | Critical 9.3 | 74% | 2 exploits | |
| CVE-2016-3087 | Apache Struts vulnerable to arbitrary remote code execution due to improper input validation apache · struts | Critical 9.8 | 82% | 3 exploits | |
| CVE-2018-8145 | ChakraCore information disclosure vulnerability microsoft · chakracore | High 7.5 | 67% | 1 exploit | |
| CVE-2018-1000207 | MODX Revolution Incorrect Access Control vulnerability modx · modx revolution | High 7.2 | 64% | 1 exploit | |
| CVE-2017-9232 | Juju uses a UNIX domain socket without setting appropriate permissions canonical · juju | Critical 9.8 | 49% | 1 exploit | |
| CVE-2017-11610 | Incorrect Default Permissions in Supervisor supervisord · supervisor | High 8.7 | 87% | 1 exploit | |
| CVE-2018-7251 | Anchor CMS Logs Credentials anchorcms · anchor | Critical 9.8 | 72% | 1 exploit | |
| CVE-2018-10054 | Improper Input Validation in Datomic cognitect · datomic | High 8.8 | 34% | 1 exploit | |
| CVE-2015-8103 | Jenkins CLI Deserialization of Untrusted Data vulnerability jenkins · jenkins | Critical 9.8 | 87% | 4 exploits | |
| CVE-2019-10867 | Pimcore Unserialize Remote Code Execution pimcore · pimcore | High 8.8 | 69% | 4 exploits | |
| CVE-2017-1000119 | October CMS PHP Code Execution octobercms · october | High 7.2 | 61% | 2 exploits | |
| CVE-2019-9194 | elFinder command injection vulnerability in the PHP connector std42 · elfinder | Critical 9.8 | 97% | 5 exploits | |
| CVE-2019-0567 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 80% | 1 exploit | |
| CVE-2019-0568 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 69% | 1 exploit | |
| CVE-2019-0539 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 83% | 3 exploits | |
| CVE-2018-8617 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 62% | 1 exploit | |
| CVE-2018-8355 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 68% | 1 exploit | |
| CVE-2018-8291 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 69% | 1 exploit | |
| CVE-2018-8288 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 69% | 1 exploit | |
| CVE-2018-8139 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 66% | 1 exploit | |
| CVE-2018-8133 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 50% | 1 exploit | |
| CVE-2018-0980 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 66% | 1 exploit | |
| CVE-2018-0934 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 66% | 2 exploits | |
| CVE-2018-0933 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 66% | 1 exploit | |
| CVE-2018-0860 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 65% | 1 exploit | |
| CVE-2018-0838 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 65% | 1 exploit | |
| CVE-2018-0837 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 65% | 1 exploit | |
| CVE-2018-0834 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 55% | 1 exploit | |
| CVE-2018-0835 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 65% | 1 exploit | |
| CVE-2017-7615 | MantisBT allows arbitrary password reset mantisbt · mantisbt | High 8.8 | 91% | 3 exploits | |
| CVE-2013-2115 | Code injection in Apache Struts apache · struts | High 8.1 | 75% | 2 exploits | |
| CVE-2019-1003001 | Jenkins Groovy Plugin sandbox bypass vulnerability jenkins · pipeline\ | High 8.8 | 86% | 5 exploits | |
| CVE-2019-1003002 | Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability jenkins · pipeline\ | High 8.8 | 81% | 5 exploits | |
| CVE-2019-1003000 | Protection Mechanism Failure in Jenkins Script Security Plugin jenkins · script security | High 8.8 | 98% | 7 exploits | |
| CVE-2017-1000170 | jqueryFileTree vulnerable to Directory Traversal jqueryfiletree project · jqueryfiletree | High 7.5 | 59% | 1 exploit | |
| CVE-2018-19422 | Subrion CMS RCE Vulnerability intelliants · subrion cms | High 7.2 | 64% | 4 exploits | |
| CVE-2017-5637 | Uncontrolled Resource Consumption in Apache ZooKeeper apache · zookeeper | High 7.5 | 73% | 1 exploit |
Showing 351–400 of 2,494
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.