Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
- CVE-2025-9528Low 2.0A vulnerability was determined in Linksys E1700 1.0.0.4.003.linksys · e1700 firmwareEPSS54%2 exploitsPublished Aug 27, 2025
- CVE-2022-35919Low 2.7In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested.minio · minioEPSS52%1 exploitPublished Aug 1, 2022
- CVE-2016-3325Low 3.1Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."microsoft · edgeEPSS54%1 exploitPublished Sep 14, 2016
- CVE-2010-1157Low 2.6Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the…apache · tomcatEPSS53%1 exploitPublished Apr 23, 2010
- CVE-2006-5614Low 2.6Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote attackers to cause a denial of service (svchost.exe crash) via a malformed DNS query, which results in a null pointer dereference.microsoft · windows xpEPSS80%1 exploitPublished Oct 30, 2006
- CVE-2006-5229Low 2.6OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as…openbsd · opensshEPSS58%1 exploitPublished Oct 10, 2006
- CVE-2005-1790Low 2.6Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object…microsoft · internet explorerEPSS83%2 exploitsPublished Jun 1, 2005
- CVE-2004-1857Low 2.1Directory traversal vulnerability in setinfo.hts in HP Web Jetadmin 7.5.2546 allows remote authenticated attackers to read arbitrary files via a ..hp · web jetadminEPSS87%2 exploitsPublished Mar 24, 2004
- CVE-2003-0727Low 2.1Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions.oracle · database serverEPSS68%9 exploitsPublished Oct 20, 2003
- CVE-2000-0649Low 2.6IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.microsoft · internet information serverEPSS77%1 exploitPublished Jul 13, 2000
- CVE-2000-0402Low 2.1The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability.microsoft · sql serverEPSS91%4 exploitsPublished May 30, 2000
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-9528 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. linksys · e1700 firmware | Low 2.0 | 54% | 2 exploits | |
| CVE-2022-35919 | In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. minio · minio | Low 2.7 | 52% | 1 exploit | |
| CVE-2016-3325 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." microsoft · edge | Low 3.1 | 54% | 1 exploit | |
| CVE-2010-1157 | Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the… apache · tomcat | Low 2.6 | 53% | 1 exploit | |
| CVE-2006-5614 | Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote attackers to cause a denial of service (svchost.exe crash) via a malformed DNS query, which results in a null pointer dereference. microsoft · windows xp | Low 2.6 | 80% | 1 exploit | |
| CVE-2006-5229 | OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as… openbsd · openssh | Low 2.6 | 58% | 1 exploit | |
| CVE-2005-1790 | Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object… microsoft · internet explorer | Low 2.6 | 83% | 2 exploits | |
| CVE-2004-1857 | Directory traversal vulnerability in setinfo.hts in HP Web Jetadmin 7.5.2546 allows remote authenticated attackers to read arbitrary files via a .. hp · web jetadmin | Low 2.1 | 87% | 2 exploits | |
| CVE-2003-0727 | Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions. oracle · database server | Low 2.1 | 68% | 9 exploits | |
| CVE-2000-0649 | IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined. microsoft · internet information server | Low 2.6 | 77% | 1 exploit | |
| CVE-2000-0402 | The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability. microsoft · sql server | Low 2.1 | 91% | 4 exploits |
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.