Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
401 vulnerabilities · highest exploit probability first
- CVE-2025-57791Medium 6.9A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation.commvault · commvaultEPSS34%1 exploitPublished Aug 20, 2025
- CVE-2025-53771Medium 6.5Microsoft SharePoint Server Spoofing Vulnerabilitymicrosoft · sharepoint serverEPSS100%Ransomware1 exploit8 actorsPublished Jul 8, 2025
- CVE-2025-4901Medium 5.3A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125).dlink · di-7003g firmwareEPSS79%1 exploitPublished May 18, 2025
- CVE-2025-31650Medium 8.7Apache Tomcat Denial of Service via invalid HTTP priority headerapache · tomcatEPSS61%1 exploitPublished Apr 28, 2025
- CVE-2024-55963Medium 6.5A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart.appsmith · appsmithEPSS31%2 exploitsPublished Mar 26, 2025
- CVE-2025-29891Medium 4.8Apache Camel Message Header Injection through request parametersapache · camelEPSS76%1 exploitPublished Mar 12, 2025
- CVE-2025-27218Medium 5.3Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.EPSS65%2 exploitsPublished Feb 20, 2025
- CVE-2024-11320Medium 6.9Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.pandorafms · pandora fmsEPSS91%1 exploitPublished Nov 29, 2024
- CVE-2024-49754Medium 5.4LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.phplibrenms · librenmsEPSS72%1 exploitPublished Nov 15, 2024
- CVE-2024-9916Medium 6.9A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9.usualtool · usualtoolcmsEPSS74%1 exploitPublished Oct 13, 2024
- CVE-2024-47176Medium 5.3cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.openprinting · cups-browsedEPSS51%2 exploitsPublished Sep 26, 2024
- CVE-2024-29510Medium 6.3Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.artifex · ghostscriptEPSS28%1 exploitPublished Jul 4, 2024
- CVE-2023-40000Medium 6.1LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'litespeedtech · litespeed cacheEPSS55%1 exploitPublished Feb 26, 2024
- CVE-2023-4220Medium 6.1Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web…chamilo · chamilo lmsEPSS76%2 exploitsPublished Nov 28, 2023
- CVE-2023-41425Medium 6.1Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component.wondercms · wondercmsEPSS54%2 exploitsPublished Nov 7, 2023
- CVE-2023-42442Medium 5.3Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication.fit2cloud · jumpserverEPSS63%1 exploitPublished Sep 15, 2023
- CVE-2023-39265Medium 6.5Apache Superset Improper Input Validation vulnerabilityapache · supersetEPSS86%1 exploitPublished Sep 6, 2023
- CVE-2023-37941Medium 6.6Apache Superset Deserialization of Untrusted Data vulnerabilityapache · supersetEPSS35%1 exploitPublished Sep 6, 2023
- CVE-2023-4547Medium 5.1It has been rated as problematic.spa-cart · ecommerce cmsEPSS60%2 exploitsPublished Aug 26, 2023
- CVE-2023-40028Medium 6.5Ghost vulnerable to arbitrary file read via symlinks in content importghost · ghostEPSS69%1 exploitPublished Aug 15, 2023
- CVE-2023-2745Medium 6.1WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter.wordpress · wordpressEPSS80%1 exploitPublished May 17, 2023
- CVE-2023-22232Medium 5.3Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.adobe · connectEPSS83%2 exploitsPublished Feb 17, 2023
- CVE-2022-44268Medium 6.5ImageMagick 7.1.0-49 is vulnerable to Information Disclosure.imagemagick · imagemagickEPSS90%1 exploitPublished Feb 6, 2023
- CVE-2022-44267Medium 6.5ImageMagick 7.1.0-49 is vulnerable to Denial of Service.imagemagick · imagemagickEPSS77%1 exploitPublished Feb 6, 2023
- CVE-2022-31711Medium 5.3VMware vRealize Log Insight contains an Information Disclosure Vulnerability.vmware · vrealize log insightEPSS24%1 exploitPublished Jan 25, 2023
- CVE-2022-44793Medium 6.5net-snmp - security updatenet-snmp · net-snmpEPSS53%2 exploitsPublished Jan 16, 2023
- CVE-2022-44792Medium 6.5net-snmp - security updatenet-snmp · net-snmpEPSS52%2 exploitsPublished Jan 16, 2023
- CVE-2022-36097Medium 6.1XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formxwiki · xwikiEPSS58%1 exploitPublished Sep 16, 2022
- CVE-2022-33098Medium 6.1Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.magnolia-cms · magnolia cmsEPSS53%1 exploitPublished Jul 7, 2022
- CVE-2021-34429Medium 5.3For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.eclipse · jettyEPSS99%1 exploitPublished Jun 20, 2022
- CVE-2022-31470Medium 6.1An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and…axigen · axigen mobile webmailEPSS53%1 exploitPublished Jun 7, 2022
- CVE-2021-22145Medium 6.5Generation of Error Message Containing Sensitive Information in Elasticsearchelastic · elasticsearchEPSS76%2 exploitsPublished May 24, 2022
- CVE-2020-10770Medium 5.3Keycloak vulnerable to Server-Side Request Forgeryredhat · keycloakEPSS70%2 exploitsPublished May 24, 2022
- CVE-2020-2230Medium 5.4Jenkins Cross-site Scripting vulnerability in project naming strategyjenkins · jenkinsEPSS83%2 exploitsPublished May 24, 2022
- CVE-2020-2096Medium 6.1Reflected XSS vulnerability in Jenkins gitlab-hook Pluginjenkins · gitlab hookEPSS93%2 exploitsPublished May 24, 2022
- CVE-2019-10475Medium 6.1Jenkins build-metrics Plugin reflected cross-site scripting vulnerabilityjenkins · build-metricsEPSS58%1 exploitPublished May 24, 2022
- CVE-2019-14470Medium 6.1Cosenary Instagram-PHP-API contains reflected XSS vulnerabilityinstagram-php-api project · instagram-php-apiEPSS83%2 exploitsPublished May 24, 2022
- CVE-2019-13068Medium 5.4Grafana Cross-site Scripting vulnerabilitygrafana · grafanaEPSS52%1 exploitPublished May 24, 2022
- CVE-2008-6505Medium 5.0Apache Struts directory traversal vulnerabilityapache · strutsEPSS73%1 exploitPublished May 17, 2022
- CVE-2013-1814Medium 4.0Apache Rave information disclosure vulnerabilityapache · raveEPSS74%1 exploitPublished May 17, 2022
- CVE-2012-6081Medium 5.3MoinMoin Multiple unrestricted file upload vulnerabilitiesmoinmo · moinmoinEPSS35%3 exploitsPublished May 17, 2022
- CVE-2013-2248Medium 5.8Open redirect in Apache Strutsapache · strutsEPSS95%1 exploitPublished May 17, 2022
- CVE-2012-1006Medium 4.3Apache Struts Multiple Cross-site Scripting Vulnerabilitiesapache · strutsEPSS57%1 exploitPublished May 17, 2022
- CVE-2011-4858Medium 5.0Improper Input Validation in Apache Tomcatapache · tomcatEPSS80%1 exploitPublished May 14, 2022
- CVE-2015-1833Medium 6.4Improper Input Validation in Apache Jackrabbitapache · jackrabbitEPSS56%2 exploitsPublished May 14, 2022
- CVE-2015-5531Medium 5.0Improper Limitation of a Pathname to a Restricted Directory in Elasticsearchelasticsearch · elasticsearchEPSS95%1 exploitPublished May 14, 2022
- CVE-2016-0784Medium 6.5Apache OpenMeetings Directory Traversal vulnerabilityapache · openmeetingsEPSS56%1 exploitPublished May 14, 2022
- CVE-2010-3863Medium 5.0Apache Shiro Path Traversal vulnerabilityapache · shiroEPSS55%1 exploitPublished May 14, 2022
- CVE-2015-1830Medium 5.0Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQapache · activemqEPSS84%3 exploitsPublished May 14, 2022
- CVE-2017-18357Medium 6.5Shopware XXE Vulnerabilityshopware · shopwareEPSS27%2 exploitsPublished May 14, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-57791 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. commvault · commvault | Medium 6.9 | 34% | 1 exploit | |
| CVE-2025-53771 | Microsoft SharePoint Server Spoofing Vulnerability microsoft · sharepoint server | Medium 6.5 | 100% | Ransomware1 exploit8 actors | |
| CVE-2025-4901 | A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). dlink · di-7003g firmware | Medium 5.3 | 79% | 1 exploit | |
| CVE-2025-31650 | Apache Tomcat Denial of Service via invalid HTTP priority header apache · tomcat | Medium 8.7 | 61% | 1 exploit | |
| CVE-2024-55963 | A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. appsmith · appsmith | Medium 6.5 | 31% | 2 exploits | |
| CVE-2025-29891 | Apache Camel Message Header Injection through request parameters apache · camel | Medium 4.8 | 76% | 1 exploit | |
| CVE-2025-27218 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. | Medium 5.3 | 65% | 2 exploits | |
| CVE-2024-11320 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. pandorafms · pandora fms | Medium 6.9 | 91% | 1 exploit | |
| CVE-2024-49754 | LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php librenms · librenms | Medium 5.4 | 72% | 1 exploit | |
| CVE-2024-9916 | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. usualtool · usualtoolcms | Medium 6.9 | 74% | 1 exploit | |
| CVE-2024-47176 | cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL. openprinting · cups-browsed | Medium 5.3 | 51% | 2 exploits | |
| CVE-2024-29510 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. artifex · ghostscript | Medium 6.3 | 28% | 1 exploit | |
| CVE-2023-40000 | LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg' litespeedtech · litespeed cache | Medium 6.1 | 55% | 1 exploit | |
| CVE-2023-4220 | Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web… chamilo · chamilo lms | Medium 6.1 | 76% | 2 exploits | |
| CVE-2023-41425 | Cross Site Scripting vulnerability in Wonder CMS v.3.2.0 thru v.3.4.2 allows a remote attacker to execute arbitrary code via a crafted script uploaded to the installModule component. wondercms · wondercms | Medium 6.1 | 54% | 2 exploits | |
| CVE-2023-42442 | Starting in version 3.0.0 and prior to versions 3.5.5 and 3.6.4, session replays can download without authentication. fit2cloud · jumpserver | Medium 5.3 | 63% | 1 exploit | |
| CVE-2023-39265 | Apache Superset Improper Input Validation vulnerability apache · superset | Medium 6.5 | 86% | 1 exploit | |
| CVE-2023-37941 | Apache Superset Deserialization of Untrusted Data vulnerability apache · superset | Medium 6.6 | 35% | 1 exploit | |
| CVE-2023-4547 | It has been rated as problematic. spa-cart · ecommerce cms | Medium 5.1 | 60% | 2 exploits | |
| CVE-2023-40028 | Ghost vulnerable to arbitrary file read via symlinks in content import ghost · ghost | Medium 6.5 | 69% | 1 exploit | |
| CVE-2023-2745 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. wordpress · wordpress | Medium 6.1 | 80% | 1 exploit | |
| CVE-2023-22232 | Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. adobe · connect | Medium 5.3 | 83% | 2 exploits | |
| CVE-2022-44268 | ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. imagemagick · imagemagick | Medium 6.5 | 90% | 1 exploit | |
| CVE-2022-44267 | ImageMagick 7.1.0-49 is vulnerable to Denial of Service. imagemagick · imagemagick | Medium 6.5 | 77% | 1 exploit | |
| CVE-2022-31711 | VMware vRealize Log Insight contains an Information Disclosure Vulnerability. vmware · vrealize log insight | Medium 5.3 | 24% | 1 exploit | |
| CVE-2022-44793 | net-snmp - security update net-snmp · net-snmp | Medium 6.5 | 53% | 2 exploits | |
| CVE-2022-44792 | net-snmp - security update net-snmp · net-snmp | Medium 6.5 | 52% | 2 exploits | |
| CVE-2022-36097 | XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form xwiki · xwiki | Medium 6.1 | 58% | 1 exploit | |
| CVE-2022-33098 | Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. magnolia-cms · magnolia cms | Medium 6.1 | 53% | 1 exploit | |
| CVE-2021-34429 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. eclipse · jetty | Medium 5.3 | 99% | 1 exploit | |
| CVE-2022-31470 | An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and… axigen · axigen mobile webmail | Medium 6.1 | 53% | 1 exploit | |
| CVE-2021-22145 | Generation of Error Message Containing Sensitive Information in Elasticsearch elastic · elasticsearch | Medium 6.5 | 76% | 2 exploits | |
| CVE-2020-10770 | Keycloak vulnerable to Server-Side Request Forgery redhat · keycloak | Medium 5.3 | 70% | 2 exploits | |
| CVE-2020-2230 | Jenkins Cross-site Scripting vulnerability in project naming strategy jenkins · jenkins | Medium 5.4 | 83% | 2 exploits | |
| CVE-2020-2096 | Reflected XSS vulnerability in Jenkins gitlab-hook Plugin jenkins · gitlab hook | Medium 6.1 | 93% | 2 exploits | |
| CVE-2019-10475 | Jenkins build-metrics Plugin reflected cross-site scripting vulnerability jenkins · build-metrics | Medium 6.1 | 58% | 1 exploit | |
| CVE-2019-14470 | Cosenary Instagram-PHP-API contains reflected XSS vulnerability instagram-php-api project · instagram-php-api | Medium 6.1 | 83% | 2 exploits | |
| CVE-2019-13068 | Grafana Cross-site Scripting vulnerability grafana · grafana | Medium 5.4 | 52% | 1 exploit | |
| CVE-2008-6505 | Apache Struts directory traversal vulnerability apache · struts | Medium 5.0 | 73% | 1 exploit | |
| CVE-2013-1814 | Apache Rave information disclosure vulnerability apache · rave | Medium 4.0 | 74% | 1 exploit | |
| CVE-2012-6081 | MoinMoin Multiple unrestricted file upload vulnerabilities moinmo · moinmoin | Medium 5.3 | 35% | 3 exploits | |
| CVE-2013-2248 | Open redirect in Apache Struts apache · struts | Medium 5.8 | 95% | 1 exploit | |
| CVE-2012-1006 | Apache Struts Multiple Cross-site Scripting Vulnerabilities apache · struts | Medium 4.3 | 57% | 1 exploit | |
| CVE-2011-4858 | Improper Input Validation in Apache Tomcat apache · tomcat | Medium 5.0 | 80% | 1 exploit | |
| CVE-2015-1833 | Improper Input Validation in Apache Jackrabbit apache · jackrabbit | Medium 6.4 | 56% | 2 exploits | |
| CVE-2015-5531 | Improper Limitation of a Pathname to a Restricted Directory in Elasticsearch elasticsearch · elasticsearch | Medium 5.0 | 95% | 1 exploit | |
| CVE-2016-0784 | Apache OpenMeetings Directory Traversal vulnerability apache · openmeetings | Medium 6.5 | 56% | 1 exploit | |
| CVE-2010-3863 | Apache Shiro Path Traversal vulnerability apache · shiro | Medium 5.0 | 55% | 1 exploit | |
| CVE-2015-1830 | Improper Limitation of a Pathname to a Restricted Directory in Apache ActiveMQ apache · activemq | Medium 5.0 | 84% | 3 exploits | |
| CVE-2017-18357 | Shopware XXE Vulnerability shopware · shopware | Medium 6.5 | 27% | 2 exploits |
Showing 1–50 of 401
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.