Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
889 vulnerabilities · highest exploit probability first
- CVE-2026-46300High 7.8kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernelEPSS2.4%2 exploitsPublished May 13, 2026
- CVE-2026-43284High 7.8kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernelEPSS94%14 exploitsPublished May 12, 2026
- CVE-2026-34413High 8.8Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to…EPSS3.1%1 exploitPublished Apr 22, 2026
- CVE-2025-15467High 8.8openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsingopenssl · opensslEPSS52%1 exploitPublished Jan 27, 2026
- CVE-2025-61678High 8.6In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter.EPSS44%1 exploitPublished Oct 14, 2025
- CVE-2025-61675High 8.6In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration…EPSS38%1 exploitPublished Oct 14, 2025
- CVE-2025-57790High 8.7A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue.commvault · commvaultEPSS27%1 exploitPublished Aug 20, 2025
- CVE-2013-10059High 8.6An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint.dlink · dir-615h firmwareEPSS27%3 exploitsPublished Aug 1, 2025
- CVE-2025-6965High 7.2There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available.sqlite · sqliteEPSS73%1 exploitPublished Jul 15, 2025
- CVE-2013-3307High 8.3Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.EPSS63%1 exploitPublished Jul 11, 2025
- CVE-2025-5961High 7.2The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.wpvivid · migration\, backup\, stagingEPSS55%1 exploitPublished Jul 3, 2025
- CVE-2025-5306High 7.0Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.artica · pandora fmsEPSS36%1 exploitPublished Jun 27, 2025
- CVE-2025-34511High 8.8Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue.sitecore · experience managerEPSS30%1 exploitPublished Jun 17, 2025
- CVE-2025-34510High 8.8Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability.sitecore · experience commerceEPSS24%1 exploitPublished Jun 17, 2025
- CVE-2025-34509High 7.5Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev.sitecore · experience managerEPSS56%2 exploitsPublished Jun 17, 2025
- CVE-2025-49619High 8.5Skyvern has a Jinja runtime leakEPSS20%1 exploitPublished Jun 7, 2025
- CVE-2025-48828High 8.1Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.vbulletin · vbulletinEPSS58%1 exploitPublished May 27, 2025
- CVE-2025-2563High 8.1The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privilegeswpeverest · user registration \& membershipEPSS49%1 exploitPublished Apr 14, 2025
- CVE-2025-3102High 8.1SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User CreationEPSS76%1 exploitPublished Apr 9, 2025
- CVE-2025-2945High 8.8pgAdmin 4 Vulnerable to Remote Code Executionpgadmin · pgadmin 4EPSS56%1 exploitPublished Apr 3, 2025
- CVE-2025-30208High 7.5Vite bypasses server.fs.deny when using ?raw??vitejs · viteEPSS75%3 exploitsPublished Mar 25, 2025
- CVE-2025-1098High 8.8ingress-nginx controller - configuration injection via unsanitized mirror annotationsEPSS82%1 exploitPublished Mar 25, 2025
- CVE-2024-12971High 8.6Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6artica · pandora fmsEPSS61%1 exploitPublished Mar 17, 2025
- CVE-2025-1094High 8.1Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns.EPSS90%1 exploitPublished Feb 13, 2025
- CVE-2025-24367High 8.7An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server.cacti · cactiEPSS54%2 exploitsPublished Jan 27, 2025
- CVE-2024-48990High 7.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.needrestart project · needrestartEPSS21%1 exploitPublished Nov 19, 2024
- CVE-2024-43425High 9.2Moodle Remote Code Execution vulnerabilitymoodle · moodleEPSS88%2 exploitsPublished Nov 7, 2024
- CVE-2024-48307High 9.3JeecgBoot SQL Injection vulnerabilityjeecg · jeecg bootEPSS50%1 exploitPublished Oct 31, 2024
- CVE-2024-37404High 8.8Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.ivanti · connect secureEPSS71%1 exploitPublished Oct 21, 2024
- CVE-2024-47076High 8.6The cfGetPrinterAttributes5 function in libcupsfilters does not sanitize IPP attributes returned from an IPP server.openprinting · libcupsfiltersEPSS80%2 exploitsPublished Sep 26, 2024
- CVE-2024-8522High 7.5LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'thimpress · learnpressEPSS63%1 exploitPublished Sep 13, 2024
- CVE-2024-8504High 8.8An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.EPSS76%1 exploitPublished Sep 10, 2024
- CVE-2024-6387High 8.1openssh: regreSSHion - race condition in SSH allows RCE/DoSopenbsd · opensshEPSS100%1 exploitPublished Jul 2, 2024
- CVE-2024-3408High 9.3Authentication bypass in dtaleman · d-taleEPSS78%1 exploitPublished Jun 6, 2024
- CVE-2024-37032High 8.8Ollama does not validate the format of the digest (sha256 with 64 hex digits)ollama · ollamaEPSS90%1 exploitPublished May 31, 2024
- CVE-2024-21683High 8.8This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.atlassian · confluence data centerEPSS88%Ransomware1 exploit1 actorPublished May 22, 2024
- CVE-2024-25641High 7.2Cacti provides an operational monitoring and fault management framework.cacti · cactiEPSS86%3 exploitsPublished May 14, 2024
- CVE-2020-14144High 7.2Arbitrary Code Execution in Giteagitea · giteaEPSS95%2 exploitsPublished Apr 22, 2024
- CVE-2024-2961High 7.3The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.gnu · glibcEPSS88%1 exploitPublished Apr 17, 2024
- CVE-2024-31997High 8.8XWiki Platform remote code execution from account through UIExtension parametersxwiki · xwikiEPSS74%1 exploitPublished Apr 10, 2024
- CVE-2024-31984High 8.8XWiki Platform: Remote code execution through space title and Solr space facetxwiki · xwikiEPSS83%1 exploitPublished Apr 10, 2024
- CVE-2024-24809High 8.5Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type.EPSS54%2 exploitsPublished Apr 10, 2024
- CVE-2024-28741High 8.8Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.EPSS78%1 exploitPublished Apr 6, 2024
- CVE-2024-24725High 8.8Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.gibbonedu · gibbonEPSS51%2 exploitsPublished Mar 23, 2024
- CVE-2024-27921High 8.8Grav File Upload Path Traversalgetgrav · gravEPSS61%1 exploitPublished Mar 22, 2024
- CVE-2024-1800High 8.8In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.progress · telerik report serverEPSS40%1 exploitPublished Mar 20, 2024
- CVE-2024-28254High 8.8The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution.open-metadata · openmetadataEPSS46%1 exploitPublished Mar 15, 2024
- CVE-2023-47218High 8.3An OS command injection vulnerability has been reported to affect several QNAP operating system versions.qnap · qtsEPSS90%1 exploitPublished Feb 13, 2024
- CVE-2023-50386High 8.8Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsapache · solrEPSS84%1 exploitPublished Feb 9, 2024
- CVE-2024-21888High 8.8A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.ivanti · connect secureEPSS85%1 exploitPublished Feb 1, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-46300 | kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel | High 7.8 | 2.4% | 2 exploits | |
| CVE-2026-43284 | kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel | High 7.8 | 94% | 14 exploits | |
| CVE-2026-34413 | Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to… | High 8.8 | 3.1% | 1 exploit | |
| CVE-2025-15467 | openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing openssl · openssl | High 8.8 | 52% | 1 exploit | |
| CVE-2025-61678 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. | High 8.6 | 44% | 1 exploit | |
| CVE-2025-61675 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration… | High 8.6 | 38% | 1 exploit | |
| CVE-2025-57790 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. commvault · commvault | High 8.7 | 27% | 1 exploit | |
| CVE-2013-10059 | An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. dlink · dir-615h firmware | High 8.6 | 27% | 3 exploits | |
| CVE-2025-6965 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. sqlite · sqlite | High 7.2 | 73% | 1 exploit | |
| CVE-2013-3307 | Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000. | High 8.3 | 63% | 1 exploit | |
| CVE-2025-5961 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. wpvivid · migration\, backup\, staging | High 7.2 | 55% | 1 exploit | |
| CVE-2025-5306 | Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. artica · pandora fms | High 7.0 | 36% | 1 exploit | |
| CVE-2025-34511 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. sitecore · experience manager | High 8.8 | 30% | 1 exploit | |
| CVE-2025-34510 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. sitecore · experience commerce | High 8.8 | 24% | 1 exploit | |
| CVE-2025-34509 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. sitecore · experience manager | High 7.5 | 56% | 2 exploits | |
| CVE-2025-49619 | Skyvern has a Jinja runtime leak | High 8.5 | 20% | 1 exploit | |
| CVE-2025-48828 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. vbulletin · vbulletin | High 8.1 | 58% | 1 exploit | |
| CVE-2025-2563 | The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges wpeverest · user registration \& membership | High 8.1 | 49% | 1 exploit | |
| CVE-2025-3102 | SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation | High 8.1 | 76% | 1 exploit | |
| CVE-2025-2945 | pgAdmin 4 Vulnerable to Remote Code Execution pgadmin · pgadmin 4 | High 8.8 | 56% | 1 exploit | |
| CVE-2025-30208 | Vite bypasses server.fs.deny when using ?raw?? vitejs · vite | High 7.5 | 75% | 3 exploits | |
| CVE-2025-1098 | ingress-nginx controller - configuration injection via unsanitized mirror annotations | High 8.8 | 82% | 1 exploit | |
| CVE-2024-12971 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 artica · pandora fms | High 8.6 | 61% | 1 exploit | |
| CVE-2025-1094 | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. | High 8.1 | 90% | 1 exploit | |
| CVE-2025-24367 | An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. cacti · cacti | High 8.7 | 54% | 2 exploits | |
| CVE-2024-48990 | Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. needrestart project · needrestart | High 7.8 | 21% | 1 exploit | |
| CVE-2024-43425 | Moodle Remote Code Execution vulnerability moodle · moodle | High 9.2 | 88% | 2 exploits | |
| CVE-2024-48307 | JeecgBoot SQL Injection vulnerability jeecg · jeecg boot | High 9.3 | 50% | 1 exploit | |
| CVE-2024-37404 | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution. ivanti · connect secure | High 8.8 | 71% | 1 exploit | |
| CVE-2024-47076 | The cfGetPrinterAttributes5 function in libcupsfilters does not sanitize IPP attributes returned from an IPP server. openprinting · libcupsfilters | High 8.6 | 80% | 2 exploits | |
| CVE-2024-8522 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' thimpress · learnpress | High 7.5 | 63% | 1 exploit | |
| CVE-2024-8504 | An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. | High 8.8 | 76% | 1 exploit | |
| CVE-2024-6387 | openssh: regreSSHion - race condition in SSH allows RCE/DoS openbsd · openssh | High 8.1 | 100% | 1 exploit | |
| CVE-2024-3408 | Authentication bypass in dtale man · d-tale | High 9.3 | 78% | 1 exploit | |
| CVE-2024-37032 | Ollama does not validate the format of the digest (sha256 with 64 hex digits) ollama · ollama | High 8.8 | 90% | 1 exploit | |
| CVE-2024-21683 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. atlassian · confluence data center | High 8.8 | 88% | Ransomware1 exploit1 actor | |
| CVE-2024-25641 | Cacti provides an operational monitoring and fault management framework. cacti · cacti | High 7.2 | 86% | 3 exploits | |
| CVE-2020-14144 | Arbitrary Code Execution in Gitea gitea · gitea | High 7.2 | 95% | 2 exploits | |
| CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. gnu · glibc | High 7.3 | 88% | 1 exploit | |
| CVE-2024-31997 | XWiki Platform remote code execution from account through UIExtension parameters xwiki · xwiki | High 8.8 | 74% | 1 exploit | |
| CVE-2024-31984 | XWiki Platform: Remote code execution through space title and Solr space facet xwiki · xwiki | High 8.8 | 83% | 1 exploit | |
| CVE-2024-24809 | Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. | High 8.5 | 54% | 2 exploits | |
| CVE-2024-28741 | Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component. | High 8.8 | 78% | 1 exploit | |
| CVE-2024-24725 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI. gibbonedu · gibbon | High 8.8 | 51% | 2 exploits | |
| CVE-2024-27921 | Grav File Upload Path Traversal getgrav · grav | High 8.8 | 61% | 1 exploit | |
| CVE-2024-1800 | In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability. progress · telerik report server | High 8.8 | 40% | 1 exploit | |
| CVE-2024-28254 | The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. open-metadata · openmetadata | High 8.8 | 46% | 1 exploit | |
| CVE-2023-47218 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. qnap · qts | High 8.3 | 90% | 1 exploit | |
| CVE-2023-50386 | Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets apache · solr | High 8.8 | 84% | 1 exploit | |
| CVE-2024-21888 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator. ivanti · connect secure | High 8.8 | 85% | 1 exploit |
Showing 1–50 of 889
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.