Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,192 vulnerabilities · highest exploit probability first
- CVE-2026-66066Critical 9.5Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processingEPSS28%1 exploitPublished Jul 30, 2026
- CVE-2026-0826Critical 9.2In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.hp inc. · poly trio 8300EPSS32%1 exploitPublished Jun 1, 2026
- CVE-2024-44000Critical 9.8LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Fileslitespeedtech · litespeed cacheEPSS82%2 exploitsPublished May 13, 2026
- CVE-2024-28000Critical 9.8LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalationlitespeedtech · litespeed cacheEPSS68%1 exploitPublished May 13, 2026
- CVE-2026-34415Critical 9.3Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern.EPSS4.4%1 exploitPublished Apr 22, 2026
- CVE-2026-0740Critical 9.8Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File UploadEPSS63%1 exploitPublished Apr 7, 2026
- CVE-2026-4257Critical 9.8Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill FunctionalityEPSS33%2 exploitsPublished Mar 30, 2026
- CVE-2026-3891Critical 9.8Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File UploadEPSS30%2 exploitsPublished Mar 13, 2026
- CVE-2026-2329Critical 9.3Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflowgrandstream · gxp1610 firmwareEPSS42%2 exploitsPublished Feb 18, 2026
- CVE-2026-0769Critical 9.8Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerabilitylangflow · langflowEPSS42%1 exploitPublished Jan 23, 2026
- CVE-2026-0768Critical 9.8Langflow code Code Injection Remote Code Execution Vulnerabilitylangflow · langflowEPSS23%1 exploitPublished Jan 23, 2026
- CVE-2026-23744Critical 9.8REC in MCPJam inspector due to HTTP Endpoint exposesmcpjam · inspectorEPSS68%2 exploitsPublished Jan 16, 2026
- CVE-2025-13486Critical 9.8Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formEPSS68%1 exploitPublished Dec 5, 2025
- CVE-2025-34299Critical 9.3Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads.monstaftp · monsta ftpEPSS73%1 exploitPublished Nov 7, 2025
- CVE-2025-11749Critical 9.8AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege EscalationEPSS75%1 exploitPublished Nov 5, 2025
- CVE-2025-55315Critical 9.9Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerabilitymicrosoft · asp.net coreEPSS66%1 exploitPublished Oct 15, 2025
- CVE-2025-59528Critical 10.0Flowise has Remote Code Execution vulnerabilityflowiseai · flowiseEPSS86%2 exploitsPublished Sep 15, 2025
- CVE-2025-7441Critical 9.8StoryChief <= 1.0.42 - Unauthenticated Arbitrary File UploadEPSS50%2 exploitsPublished Aug 18, 2025
- CVE-2025-8943Critical 9.8Flowise OS command remote code executionflowiseai · flowiseEPSS75%1 exploitPublished Aug 14, 2025
- CVE-2025-34152Critical 9.4An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint.EPSS87%1 exploitPublished Aug 7, 2025
- CVE-2019-25224Critical 9.8WP Database Backup < 5.2 - Unauthenticated OS Command Injectionwpseeds · wp database backupEPSS22%1 exploitPublished Jul 25, 2025
- CVE-2025-32429Critical 9.3XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterxwiki · xwikiEPSS88%1 exploitPublished Jul 24, 2025
- CVE-2025-34117Critical 9.3A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413.EPSS21%1 exploitPublished Jul 16, 2025
- CVE-2025-34300Critical 10.0A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application.EPSS81%1 exploitPublished Jul 16, 2025
- CVE-2020-36847Critical 9.8The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension.simplefilelist · simple file listEPSS44%3 exploitsPublished Jul 12, 2025
- CVE-2025-34037Critical 10.0An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080.EPSS93%1 exploitPublished Jun 23, 2025
- CVE-2025-49132Critical 10.0Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionEPSS54%2 exploitsPublished Jun 19, 2025
- CVE-2025-44148Critical 9.8Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx componentmailenable · mailenableEPSS55%1 exploitPublished Jun 3, 2025
- CVE-2025-48827Critical 9.8vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.vbulletin · vbulletinEPSS76%1 exploitPublished May 27, 2025
- CVE-2025-47916Critical 9.8Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.invisioncommunity · invisioncommunityEPSS84%2 exploitsPublished May 16, 2025
- CVE-2024-46506Critical 10.0NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025.netalertx · netalertxEPSS62%1 exploitPublished May 13, 2025
- CVE-2025-27007Critical 9.8OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege EscalationEPSS54%2 exploitsPublished Apr 29, 2025
- CVE-2025-32969Critical 9.3org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIxwiki · xwikiEPSS80%1 exploitPublished Apr 23, 2025
- CVE-2025-32375Critical 9.8BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserializationbentoml · bentomlEPSS52%1 exploitPublished Apr 9, 2025
- CVE-2025-27520Critical 9.8BentoML Allows Remote Code Execution (RCE) via Insecure Deserializationbentoml · bentomlEPSS41%1 exploitPublished Apr 4, 2025
- CVE-2025-2294Critical 9.8Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File InclusionEPSS78%1 exploitPublished Mar 28, 2025
- CVE-2025-1974Critical 9.8ingress-nginx admission controller RCE escalationEPSS99%1 exploitPublished Mar 25, 2025
- CVE-2025-29927Critical 9.1Authorization Bypass in Next.js Middlewarevercel · next.jsEPSS99%Ransomware1 exploit1 actorPublished Mar 21, 2025
- CVE-2024-12084Critical 9.8rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handlingsamba · rsyncEPSS72%1 exploitPublished Jan 16, 2025
- CVE-2024-48760Critical 9.8An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function.gestioip · gestioipEPSS45%3 exploitsPublished Jan 14, 2025
- CVE-2024-12847Critical 9.8NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability.netgear · dgn1000 firmwareEPSS30%3 exploitsPublished Jan 10, 2025
- CVE-2024-56511Critical 9.3Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access.dataease · dataeaseEPSS50%1 exploitPublished Jan 10, 2025
- CVE-2024-55556Critical 9.8A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data.EPSS44%1 exploitPublished Jan 7, 2025
- CVE-2024-11972Critical 9.8The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk…themehunk · hunk companionEPSS59%1 exploitPublished Dec 31, 2024
- CVE-2024-42327Critical 9.9A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability.zabbix · zabbixEPSS79%1 exploitPublished Nov 27, 2024
- CVE-2024-47407Critical 10.0A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.EPSS64%1 exploitPublished Nov 22, 2024
- CVE-2024-8856Critical 9.8Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Uploadrevmakx · backup and staging by wp time capsuleEPSS94%2 exploitsPublished Nov 18, 2024
- CVE-2024-10924Critical 9.8Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypassreally-simple-plugins · really simple securityEPSS82%2 exploitsPublished Nov 13, 2024
- CVE-2024-10914Critical 9.2It has been declared as critical.dlink · dns-320 firmwareEPSS96%1 exploitPublished Nov 7, 2024
- CVE-2024-51568Critical 9.8CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.cyberpanel · cyberpanelEPSS48%2 exploitsPublished Oct 30, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-66066 | Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing | Critical 9.5 | 28% | 1 exploit | |
| CVE-2026-0826 | In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform. hp inc. · poly trio 8300 | Critical 9.2 | 32% | 1 exploit | |
| CVE-2024-44000 | LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Files litespeedtech · litespeed cache | Critical 9.8 | 82% | 2 exploits | |
| CVE-2024-28000 | LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation litespeedtech · litespeed cache | Critical 9.8 | 68% | 1 exploit | |
| CVE-2026-34415 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. | Critical 9.3 | 4.4% | 1 exploit | |
| CVE-2026-0740 | Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 63% | 1 exploit | |
| CVE-2026-4257 | Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality | Critical 9.8 | 33% | 2 exploits | |
| CVE-2026-3891 | Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 30% | 2 exploits | |
| CVE-2026-2329 | Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow grandstream · gxp1610 firmware | Critical 9.3 | 42% | 2 exploits | |
| CVE-2026-0769 | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability langflow · langflow | Critical 9.8 | 42% | 1 exploit | |
| CVE-2026-0768 | Langflow code Code Injection Remote Code Execution Vulnerability langflow · langflow | Critical 9.8 | 23% | 1 exploit | |
| CVE-2026-23744 | REC in MCPJam inspector due to HTTP Endpoint exposes mcpjam · inspector | Critical 9.8 | 68% | 2 exploits | |
| CVE-2025-13486 | Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form | Critical 9.8 | 68% | 1 exploit | |
| CVE-2025-34299 | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. monstaftp · monsta ftp | Critical 9.3 | 73% | 1 exploit | |
| CVE-2025-11749 | AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation | Critical 9.8 | 75% | 1 exploit | |
| CVE-2025-55315 | Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability microsoft · asp.net core | Critical 9.9 | 66% | 1 exploit | |
| CVE-2025-59528 | Flowise has Remote Code Execution vulnerability flowiseai · flowise | Critical 10.0 | 86% | 2 exploits | |
| CVE-2025-7441 | StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 50% | 2 exploits | |
| CVE-2025-8943 | Flowise OS command remote code execution flowiseai · flowise | Critical 9.8 | 75% | 1 exploit | |
| CVE-2025-34152 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. | Critical 9.4 | 87% | 1 exploit | |
| CVE-2019-25224 | WP Database Backup < 5.2 - Unauthenticated OS Command Injection wpseeds · wp database backup | Critical 9.8 | 22% | 1 exploit | |
| CVE-2025-32429 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter xwiki · xwiki | Critical 9.3 | 88% | 1 exploit | |
| CVE-2025-34117 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. | Critical 9.3 | 21% | 1 exploit | |
| CVE-2025-34300 | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. | Critical 10.0 | 81% | 1 exploit | |
| CVE-2020-36847 | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. simplefilelist · simple file list | Critical 9.8 | 44% | 3 exploits | |
| CVE-2025-34037 | An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. | Critical 10.0 | 93% | 1 exploit | |
| CVE-2025-49132 | Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution | Critical 10.0 | 54% | 2 exploits | |
| CVE-2025-44148 | Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component mailenable · mailenable | Critical 9.8 | 55% | 1 exploit | |
| CVE-2025-48827 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025. vbulletin · vbulletin | Critical 9.8 | 76% | 1 exploit | |
| CVE-2025-47916 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. invisioncommunity · invisioncommunity | Critical 9.8 | 84% | 2 exploits | |
| CVE-2024-46506 | NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. netalertx · netalertx | Critical 10.0 | 62% | 1 exploit | |
| CVE-2025-27007 | OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege Escalation | Critical 9.8 | 54% | 2 exploits | |
| CVE-2025-32969 | org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API xwiki · xwiki | Critical 9.3 | 80% | 1 exploit | |
| CVE-2025-32375 | BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization bentoml · bentoml | Critical 9.8 | 52% | 1 exploit | |
| CVE-2025-27520 | BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization bentoml · bentoml | Critical 9.8 | 41% | 1 exploit | |
| CVE-2025-2294 | Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion | Critical 9.8 | 78% | 1 exploit | |
| CVE-2025-1974 | ingress-nginx admission controller RCE escalation | Critical 9.8 | 99% | 1 exploit | |
| CVE-2025-29927 | Authorization Bypass in Next.js Middleware vercel · next.js | Critical 9.1 | 99% | Ransomware1 exploit1 actor | |
| CVE-2024-12084 | rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling samba · rsync | Critical 9.8 | 72% | 1 exploit | |
| CVE-2024-48760 | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. gestioip · gestioip | Critical 9.8 | 45% | 3 exploits | |
| CVE-2024-12847 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. netgear · dgn1000 firmware | Critical 9.8 | 30% | 3 exploits | |
| CVE-2024-56511 | Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. dataease · dataease | Critical 9.3 | 50% | 1 exploit | |
| CVE-2024-55556 | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. | Critical 9.8 | 44% | 1 exploit | |
| CVE-2024-11972 | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk… themehunk · hunk companion | Critical 9.8 | 59% | 1 exploit | |
| CVE-2024-42327 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. zabbix · zabbix | Critical 9.9 | 79% | 1 exploit | |
| CVE-2024-47407 | A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. | Critical 10.0 | 64% | 1 exploit | |
| CVE-2024-8856 | Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload revmakx · backup and staging by wp time capsule | Critical 9.8 | 94% | 2 exploits | |
| CVE-2024-10924 | Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass really-simple-plugins · really simple security | Critical 9.8 | 82% | 2 exploits | |
| CVE-2024-10914 | It has been declared as critical. dlink · dns-320 firmware | Critical 9.2 | 96% | 1 exploit | |
| CVE-2024-51568 | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. cyberpanel · cyberpanel | Critical 9.8 | 48% | 2 exploits |
Showing 1–50 of 1,192
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.