Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
2,494 vulnerabilities · highest exploit probability first
- CVE-2011-5034Medium 5.3Apache Geronimo Hash Collisions Cause DoSapache · geronimoEPSS81%1 exploitPublished May 13, 2022
- CVE-2018-12613High 8.8phpMyAdmin Improper Authenticationphpmyadmin · phpmyadminEPSS98%8 exploitsPublished May 13, 2022
- CVE-2017-8046Critical 9.8Remote code execution in PATCH requests in Spring Data RESTpivotal software · spring data restEPSS75%1 exploitPublished May 13, 2022
- CVE-2018-1999002High 7.5Improper Input Validation in Jenkinsjenkins · jenkinsEPSS86%2 exploitsPublished May 13, 2022
- CVE-2022-29885High 7.5Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumptionapache · tomcatEPSS73%1 exploitPublished May 13, 2022
- CVE-2022-1175Medium 6.1Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.gitlab · gitlabEPSS82%1 exploitPublished May 12, 2022
- CVE-2022-1104Medium 4.8Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scriptingcode-atlantic · popup makerEPSS56%1 exploitPublished May 10, 2022
- CVE-2022-28080High 8.8Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.event management system project · event management systemEPSS57%3 exploitsPublished May 5, 2022
- CVE-2022-1162Critical 9.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.gitlab · gitlabEPSS76%1 exploitPublished May 5, 2022
- CVE-2012-0392Medium 6.8Apache Struts's CookieInterceptor component does not use the parameter-name whitelistapache · strutsEPSS98%1 exploitPublished May 4, 2022
- CVE-2012-0394Medium 6.8Apache Struts's DebuggingInterceptor component allows remote code execution in developer modeapache · strutsEPSS73%3 exploitsPublished May 4, 2022
- CVE-2009-0580Medium 4.3Exposure of Sensitive Information in Apache Tomcatapache · tomcatEPSS94%1 exploitPublished May 2, 2022
- CVE-2008-2938Medium 4.3Apache Tomcat Directory Traversal vulnerabilityapache · tomcatEPSS100%2 exploitsPublished May 1, 2022
- CVE-2008-2370Medium 5.0Apache Tomcat Path Traversal Vulnerabilityapache · tomcatEPSS53%1 exploitPublished May 1, 2022
- CVE-2008-1232Medium 4.3Apache Tomcat Cross-site scripting (XSS) vulnerabilityapache · tomcatEPSS76%1 exploitPublished May 1, 2022
- CVE-2007-5333Medium 5.0Exposure of Sensitive Information in Apache Tomcatapache · tomcatEPSS63%1 exploitPublished May 1, 2022
- CVE-2007-2449Medium 4.3Apache Tomcat XSS Vulnerabilities in Examples Web Applicationapache · tomcatEPSS77%1 exploitPublished May 1, 2022
- CVE-2007-1355Medium 5.3Apache Tomcat Vulnerable to Cross-Site Scriptingapache · tomcatEPSS58%1 exploitPublished May 1, 2022
- CVE-2007-0450Medium 5.0Apache Tomcat Directory Traversalapache · http serverEPSS91%1 exploitPublished May 1, 2022
- CVE-2006-7196Medium 4.3Cross-site scripting in Apache Tomcatapache · tomcatEPSS72%1 exploitPublished May 1, 2022
- CVE-2021-46422Critical 9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.telesquare · sdt-cs3b1 firmwareEPSS94%3 exploitsPublished Apr 27, 2022
- CVE-2021-46442Critical 9.8In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization.dlink · dir-825 firmwareEPSS56%1 exploitPublished Apr 27, 2022
- CVE-2022-29806Critical 9.8ZoneMinder before 1.36.13 allows remote code execution via an invalid language.zoneminder · zoneminderEPSS67%2 exploitsPublished Apr 26, 2022
- CVE-2021-25094High 8.1The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory.brandexponents · tatsuEPSS83%2 exploitsPublished Apr 25, 2022
- CVE-2011-3923Critical 9.8Struts ParameterInterceptor vulnerability allows remote command executionapache · strutsEPSS89%2 exploitsPublished Apr 22, 2022
- CVE-2022-1329High 8.8The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to…elementor · website builderEPSS93%2 exploitsPublished Apr 19, 2022
- CVE-2022-22956Critical 9.8VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.vmware · identity managerEPSS50%1 exploitPublished Apr 14, 2022
- CVE-2022-22957High 7.2VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).vmware · identity managerEPSS23%1 exploitPublished Apr 14, 2022
- CVE-2021-46419Critical 9.1An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.telesquare · tlr-2855ks6 firmwareEPSS71%2 exploitsPublished Apr 7, 2022
- CVE-2021-46417High 7.5Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580.franklinfueling · colibri firmwareEPSS60%3 exploitsPublished Apr 7, 2022
- CVE-2022-28219Critical 9.8Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.zohocorp · manageengine adaudit plusEPSS97%2 exploitsPublished Apr 5, 2022
- CVE-2022-28368Critical 9.8Remote code injection in dompdf/dompdfdompdf project · dompdfEPSS83%2 exploitsPublished Apr 4, 2022
- CVE-2022-28381Critical 9.8Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.allmediaserver · allmediaserverEPSS70%3 exploitsPublished Apr 3, 2022
- CVE-2022-28379Medium 4.8jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.nginxproxymanager · nginx proxy managerEPSS71%1 exploitPublished Apr 3, 2022
- CVE-2022-23881Critical 9.8ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.zzzcms · zzzphpEPSS57%1 exploitPublished Mar 23, 2022
- CVE-2022-24637Critical 9.8Improper Privilege Management in Open Web Analyticsopenwebanalytics · open web analyticsEPSS99%3 exploitsPublished Mar 19, 2022
- CVE-2022-25487Critical 9.8Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.thedigitalcraft · atomcmsEPSS54%2 exploitsPublished Mar 15, 2022
- CVE-2021-45010High 8.8A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.prasathmani · tiny file managerEPSS70%3 exploitsPublished Mar 15, 2022
- CVE-2022-23940High 8.8SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.salesagility · suitecrmEPSS53%1 exploitPublished Mar 10, 2022
- CVE-2021-4045Critical 9.8TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root.tp-link · tapo c200 firmwareEPSS72%2 exploitsPublished Mar 10, 2022
- CVE-2022-24734High 7.2In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type php with PHP code, executed on on _Change Settings_ pages.mybb · mybbEPSS78%4 exploitsPublished Mar 9, 2022
- CVE-2022-23277High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS41%1 exploitPublished Mar 9, 2022
- CVE-2022-24716High 7.5Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials.icinga · icinga web 2EPSS89%1 exploitPublished Mar 8, 2022
- CVE-2022-0441Critical 9.8The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an adminstylemixthemes · masterstudy lmsEPSS85%1 exploitPublished Mar 7, 2022
- CVE-2021-46381High 7.5Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].dlink · dap-1620 firmwareEPSS59%2 exploitsPublished Mar 4, 2022
- CVE-2022-0824High 8.8Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.webmin · webminEPSS97%4 exploitsPublished Mar 3, 2022
- CVE-2021-4039Critical 9.8A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.zyxel · nwa1100-nh firmwareEPSS71%2 exploitsPublished Mar 2, 2022
- CVE-2021-41282High 8.8diag_routes.php in pfSense 2.5.2 allows sed data injection.pfsense · pfsenseEPSS87%2 exploitsPublished Mar 1, 2022
- CVE-2022-25305Medium 6.1The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that…veronalabs · wp statisticsEPSS79%1 exploitPublished Feb 24, 2022
- CVE-2022-25149High 7.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to…veronalabs · wp statisticsEPSS77%1 exploitPublished Feb 24, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2011-5034 | Apache Geronimo Hash Collisions Cause DoS apache · geronimo | Medium 5.3 | 81% | 1 exploit | |
| CVE-2018-12613 | phpMyAdmin Improper Authentication phpmyadmin · phpmyadmin | High 8.8 | 98% | 8 exploits | |
| CVE-2017-8046 | Remote code execution in PATCH requests in Spring Data REST pivotal software · spring data rest | Critical 9.8 | 75% | 1 exploit | |
| CVE-2018-1999002 | Improper Input Validation in Jenkins jenkins · jenkins | High 7.5 | 86% | 2 exploits | |
| CVE-2022-29885 | Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption apache · tomcat | High 7.5 | 73% | 1 exploit | |
| CVE-2022-1175 | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes. gitlab · gitlab | Medium 6.1 | 82% | 1 exploit | |
| CVE-2022-1104 | Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scripting code-atlantic · popup maker | Medium 4.8 | 56% | 1 exploit | |
| CVE-2022-28080 | Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter. event management system project · event management system | High 8.8 | 57% | 3 exploits | |
| CVE-2022-1162 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. gitlab · gitlab | Critical 9.8 | 76% | 1 exploit | |
| CVE-2012-0392 | Apache Struts's CookieInterceptor component does not use the parameter-name whitelist apache · struts | Medium 6.8 | 98% | 1 exploit | |
| CVE-2012-0394 | Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode apache · struts | Medium 6.8 | 73% | 3 exploits | |
| CVE-2009-0580 | Exposure of Sensitive Information in Apache Tomcat apache · tomcat | Medium 4.3 | 94% | 1 exploit | |
| CVE-2008-2938 | Apache Tomcat Directory Traversal vulnerability apache · tomcat | Medium 4.3 | 100% | 2 exploits | |
| CVE-2008-2370 | Apache Tomcat Path Traversal Vulnerability apache · tomcat | Medium 5.0 | 53% | 1 exploit | |
| CVE-2008-1232 | Apache Tomcat Cross-site scripting (XSS) vulnerability apache · tomcat | Medium 4.3 | 76% | 1 exploit | |
| CVE-2007-5333 | Exposure of Sensitive Information in Apache Tomcat apache · tomcat | Medium 5.0 | 63% | 1 exploit | |
| CVE-2007-2449 | Apache Tomcat XSS Vulnerabilities in Examples Web Application apache · tomcat | Medium 4.3 | 77% | 1 exploit | |
| CVE-2007-1355 | Apache Tomcat Vulnerable to Cross-Site Scripting apache · tomcat | Medium 5.3 | 58% | 1 exploit | |
| CVE-2007-0450 | Apache Tomcat Directory Traversal apache · http server | Medium 5.0 | 91% | 1 exploit | |
| CVE-2006-7196 | Cross-site scripting in Apache Tomcat apache · tomcat | Medium 4.3 | 72% | 1 exploit | |
| CVE-2021-46422 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. telesquare · sdt-cs3b1 firmware | Critical 9.8 | 94% | 3 exploits | |
| CVE-2021-46442 | In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization. dlink · dir-825 firmware | Critical 9.8 | 56% | 1 exploit | |
| CVE-2022-29806 | ZoneMinder before 1.36.13 allows remote code execution via an invalid language. zoneminder · zoneminder | Critical 9.8 | 67% | 2 exploits | |
| CVE-2021-25094 | The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. brandexponents · tatsu | High 8.1 | 83% | 2 exploits | |
| CVE-2011-3923 | Struts ParameterInterceptor vulnerability allows remote command execution apache · struts | Critical 9.8 | 89% | 2 exploits | |
| CVE-2022-1329 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to… elementor · website builder | High 8.8 | 93% | 2 exploits | |
| CVE-2022-22956 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. vmware · identity manager | Critical 9.8 | 50% | 1 exploit | |
| CVE-2022-22957 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). vmware · identity manager | High 7.2 | 23% | 1 exploit | |
| CVE-2021-46419 | An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. telesquare · tlr-2855ks6 firmware | Critical 9.1 | 71% | 2 exploits | |
| CVE-2021-46417 | Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580. franklinfueling · colibri firmware | High 7.5 | 60% | 3 exploits | |
| CVE-2022-28219 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. zohocorp · manageengine adaudit plus | Critical 9.8 | 97% | 2 exploits | |
| CVE-2022-28368 | Remote code injection in dompdf/dompdf dompdf project · dompdf | Critical 9.8 | 83% | 2 exploits | |
| CVE-2022-28381 | Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932. allmediaserver · allmediaserver | Critical 9.8 | 70% | 3 exploits | |
| CVE-2022-28379 | jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. nginxproxymanager · nginx proxy manager | Medium 4.8 | 71% | 1 exploit | |
| CVE-2022-23881 | ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. zzzcms · zzzphp | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-24637 | Improper Privilege Management in Open Web Analytics openwebanalytics · open web analytics | Critical 9.8 | 99% | 3 exploits | |
| CVE-2022-25487 | Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. thedigitalcraft · atomcms | Critical 9.8 | 54% | 2 exploits | |
| CVE-2021-45010 | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution. prasathmani · tiny file manager | High 8.8 | 70% | 3 exploits | |
| CVE-2022-23940 | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. salesagility · suitecrm | High 8.8 | 53% | 1 exploit | |
| CVE-2021-4045 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. tp-link · tapo c200 firmware | Critical 9.8 | 72% | 2 exploits | |
| CVE-2022-24734 | In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type php with PHP code, executed on on _Change Settings_ pages. mybb · mybb | High 7.2 | 78% | 4 exploits | |
| CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 41% | 1 exploit | |
| CVE-2022-24716 | Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. icinga · icinga web 2 | High 7.5 | 89% | 1 exploit | |
| CVE-2022-0441 | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin stylemixthemes · masterstudy lms | Critical 9.8 | 85% | 1 exploit | |
| CVE-2021-46381 | Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow]. dlink · dap-1620 firmware | High 7.5 | 59% | 2 exploits | |
| CVE-2022-0824 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. webmin · webmin | High 8.8 | 97% | 4 exploits | |
| CVE-2021-4039 | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. zyxel · nwa1100-nh firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2021-41282 | diag_routes.php in pfSense 2.5.2 allows sed data injection. pfsense · pfsense | High 8.8 | 87% | 2 exploits | |
| CVE-2022-25305 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that… veronalabs · wp statistics | Medium 6.1 | 79% | 1 exploit | |
| CVE-2022-25149 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to… veronalabs · wp statistics | High 7.5 | 77% | 1 exploit |
Showing 401–450 of 2,494
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.