Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2021-25114Critical 9.8The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injectionstrangerstudios · paid memberships proEPSS82%·Published Feb 7, 2022
- CVE-2021-1472Critical 9.8Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers.cisco · rv160 firmwareEPSS72%2 exploitsPublished Feb 3, 2022
- CVE-2021-1473Critical 9.8Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers.cisco · rv340 firmwareEPSS64%2 exploitsPublished Feb 3, 2022
- CVE-2022-24223Critical 9.8AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.thedigitalcraft · atomcmsEPSS62%3 exploitsPublished Feb 1, 2022
- CVE-2021-24762Critical 9.8The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.getperfectsurvey · perfect surveyEPSS87%2 exploitsPublished Feb 1, 2022
- CVE-2022-23944Critical 9.1Missing authentication in ShenYuapache · shenyuEPSS79%·Published Jan 28, 2022
- CVE-2022-23221Critical 9.8Arbitrary code execution in H2 Consoledebian · debian linuxEPSS65%·Published Jan 21, 2022
- CVE-2020-10188Critical 9.8utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.netkit telnet project · netkit telnetEPSS74%·Published Jan 19, 2022
- CVE-2021-26691Critical 9.8In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflowapache · http serverEPSS68%·Published Jan 19, 2022
- CVE-2022-23178Critical 9.8An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices.crestron · hd-md4x2-4k-e firmwareEPSS75%1 exploitPublished Jan 15, 2022
- CVE-2021-42392Critical 9.8The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.h2database · h2EPSS83%·Published Jan 10, 2022
- CVE-2021-45456Critical 9.8Command Injection in Apache Kylinapache · kylinEPSS89%·Published Jan 8, 2022
- CVE-2021-43857Critical 9.3Gerapy may cause remote code executiongerapy · gerapyEPSS55%1 exploitPublished Jan 6, 2022
- CVE-2021-45428Critical 9.8TLR-2005KSH is affected by an incorrect access control vulnerability.telesquare · tlr-2005ksh firmwareEPSS57%2 exploitsPublished Jan 3, 2022
- CVE-2021-45232Critical 9.8In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin…apache · apisix dashboardEPSS86%·Published Dec 28, 2021
- CVE-2021-24946Critical 9.8The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issuewebnus · modern events calendar liteEPSS73%3 exploitsPublished Dec 13, 2021
- CVE-2021-21351Critical 9.1In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.xstream · xstreamEPSS82%·Published Dec 13, 2021
- CVE-2021-21344Critical 9.8In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.xstream · xstreamEPSS76%·Published Dec 13, 2021
- CVE-2021-21345Critical 9.9In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream.xstream · xstreamEPSS72%·Published Dec 13, 2021
- CVE-2021-44152Critical 9.8Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user.reprisesoftware · reprise license managerEPSS59%1 exploitPublished Dec 13, 2021
- CVE-2021-40859Critical 9.8Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device.auerswald · compact 5500r firmwareEPSS72%1 exploitPublished Dec 7, 2021
- CVE-2021-42127Critical 9.8A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.ivanti · avalancheEPSS66%·Published Dec 7, 2021
- CVE-2021-44427Critical 9.8SQL Injection in rosariosisrosariosis · rosariosisEPSS51%1 exploitPublished Dec 2, 2021
- CVE-2021-43267Critical 9.8The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.linux · linux kernelEPSS58%·Published Nov 23, 2021
- CVE-2021-41950Critical 9.1A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php.montala · resourcespaceEPSS75%·Published Nov 15, 2021
- CVE-2021-41765Critical 9.8A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter.montala · resourcespaceEPSS68%·Published Nov 15, 2021
- CVE-2020-16152Critical 9.8The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.extremenetworks · aerohive netconfigEPSS36%2 exploitsPublished Nov 14, 2021
- CVE-2021-41653Critical 9.8The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.tp-link · tl-wr840n firmwareEPSS76%·Published Nov 13, 2021
- CVE-2021-42847Critical 9.8Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.zohocorp · manageengine adaudit plusEPSS70%1 exploitPublished Nov 11, 2021
- CVE-2021-41081Critical 9.8Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.zohocorp · manageengine network configuration managerEPSS64%·Published Nov 11, 2021
- CVE-2021-38294Critical 9.8Command injection leading to Remote Code Execution in Apache Stormapache · stormEPSS84%2 exploitsPublished Oct 26, 2021
- CVE-2021-40865Critical 9.8Deserialization of Untrusted Data leading to Remote Code Execution in Apache Stormapache · stormEPSS64%·Published Oct 26, 2021
- CVE-2021-20837Critical 9.8Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type…sixapart · movable typeEPSS88%2 exploitsPublished Oct 26, 2021
- CVE-2021-42342Critical 9.8In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix.embedthis · goaheadEPSS59%·Published Oct 14, 2021
- CVE-2021-40493Critical 9.8Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module.zohocorp · manageengine opmanagerEPSS50%·Published Oct 13, 2021
- CVE-2021-21809Critical 9.1Moodle command execution vulnerability exists in the default legacy spellchecker pluginmoodle · moodleEPSS24%3 exploitsPublished Oct 13, 2021
- CVE-2021-42071Critical 9.8In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.visual-tools · dvr vx16 firmwareEPSS70%1 exploitPublished Oct 7, 2021
- CVE-2021-37926Critical 9.8Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.zohocorp · manageengine admanager plusEPSS74%·Published Oct 7, 2021
- CVE-2021-37918Critical 9.8Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.zohocorp · manageengine admanager plusEPSS74%·Published Oct 7, 2021
- CVE-2021-32172Critical 9.8Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.maianscriptworld · maian cartEPSS66%3 exploitsPublished Oct 7, 2021
- CVE-2021-41649Critical 9.8An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter.online-shopping-system-advanced project · online-shopping-system-advancedEPSS52%1 exploitPublished Oct 1, 2021
- CVE-2021-41288Critical 9.8Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.zohocorp · manageengine opmanagerEPSS80%·Published Sep 30, 2021
- CVE-2021-20034Critical 9.1An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.sonicwall · sma 500vEPSS81%2 exploitsPublished Sep 27, 2021
- CVE-2021-37539Critical 9.8Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.zohocorp · manageengine admanager plusEPSS93%·Published Sep 27, 2021
- CVE-2021-41303Critical 9.8Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypassapache · shiroEPSS76%·Published Sep 20, 2021
- CVE-2021-33690Critical 9.9Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who…sap · netweaver development infrastructureEPSS69%·Published Sep 15, 2021
- CVE-2021-33543Critical 9.8Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings.geutebrueck · g-cam ebc-2110 firmwareEPSS81%1 exploitPublished Sep 13, 2021
- CVE-2019-14931Critical 9.8An issue was discovered on Mitsubishi Electric Europe B.V.inea · me-rtu firmwareEPSS57%1 exploitPublished Sep 10, 2021
- CVE-2021-28958Critical 9.8Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.zohocorp · manageengine adselfservice plusEPSS73%·Published Sep 9, 2021
- CVE-2021-34646Critical 9.8Booster for WooCommerce <= 5.4.3 - Authentication Bypassbooster · booster for woocommerceEPSS51%1 exploitPublished Aug 31, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-25114 | The Paid Memberships Pro WordPress plugin before 2.6.7 does not escape the discount_code in one of its REST route (available to unauthenticated users) before using it in a SQL statement, leading to a SQL injection strangerstudios · paid memberships pro | Critical 9.8 | 82% | · | |
| CVE-2021-1472 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. cisco · rv160 firmware | Critical 9.8 | 72% | 2 exploits | |
| CVE-2021-1473 | Multiple vulnerabilities exist in the web-based management interface of Cisco Small Business RV Series Routers. cisco · rv340 firmware | Critical 9.8 | 64% | 2 exploits | |
| CVE-2022-24223 | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. thedigitalcraft · atomcms | Critical 9.8 | 62% | 3 exploits | |
| CVE-2021-24762 | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection. getperfectsurvey · perfect survey | Critical 9.8 | 87% | 2 exploits | |
| CVE-2022-23944 | Missing authentication in ShenYu apache · shenyu | Critical 9.1 | 79% | · | |
| CVE-2022-23221 | Arbitrary code execution in H2 Console debian · debian linux | Critical 9.8 | 65% | · | |
| CVE-2020-10188 | utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions. netkit telnet project · netkit telnet | Critical 9.8 | 74% | · | |
| CVE-2021-26691 | In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow apache · http server | Critical 9.8 | 68% | · | |
| CVE-2022-23178 | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. crestron · hd-md4x2-4k-e firmware | Critical 9.8 | 75% | 1 exploit | |
| CVE-2021-42392 | The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. h2database · h2 | Critical 9.8 | 83% | · | |
| CVE-2021-45456 | Command Injection in Apache Kylin apache · kylin | Critical 9.8 | 89% | · | |
| CVE-2021-43857 | Gerapy may cause remote code execution gerapy · gerapy | Critical 9.3 | 55% | 1 exploit | |
| CVE-2021-45428 | TLR-2005KSH is affected by an incorrect access control vulnerability. telesquare · tlr-2005ksh firmware | Critical 9.8 | 57% | 2 exploits | |
| CVE-2021-45232 | In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin… apache · apisix dashboard | Critical 9.8 | 86% | · | |
| CVE-2021-24946 | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue webnus · modern events calendar lite | Critical 9.8 | 73% | 3 exploits | |
| CVE-2021-21351 | In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. xstream · xstream | Critical 9.1 | 82% | · | |
| CVE-2021-21344 | In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. xstream · xstream | Critical 9.8 | 76% | · | |
| CVE-2021-21345 | In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. xstream · xstream | Critical 9.9 | 72% | · | |
| CVE-2021-44152 | Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. reprisesoftware · reprise license manager | Critical 9.8 | 59% | 1 exploit | |
| CVE-2021-40859 | Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device. auerswald · compact 5500r firmware | Critical 9.8 | 72% | 1 exploit | |
| CVE-2021-42127 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service. ivanti · avalanche | Critical 9.8 | 66% | · | |
| CVE-2021-44427 | SQL Injection in rosariosis rosariosis · rosariosis | Critical 9.8 | 51% | 1 exploit | |
| CVE-2021-43267 | The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type. linux · linux kernel | Critical 9.8 | 58% | · | |
| CVE-2021-41950 | A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. montala · resourcespace | Critical 9.1 | 75% | · | |
| CVE-2021-41765 | A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. montala · resourcespace | Critical 9.8 | 68% | · | |
| CVE-2020-16152 | The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file. extremenetworks · aerohive netconfig | Critical 9.8 | 36% | 2 exploits | |
| CVE-2021-41653 | The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field. tp-link · tl-wr840n firmware | Critical 9.8 | 76% | · | |
| CVE-2021-42847 | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. zohocorp · manageengine adaudit plus | Critical 9.8 | 70% | 1 exploit | |
| CVE-2021-41081 | Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search. zohocorp · manageengine network configuration manager | Critical 9.8 | 64% | · | |
| CVE-2021-38294 | Command injection leading to Remote Code Execution in Apache Storm apache · storm | Critical 9.8 | 84% | 2 exploits | |
| CVE-2021-40865 | Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm apache · storm | Critical 9.8 | 64% | · | |
| CVE-2021-20837 | Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type… sixapart · movable type | Critical 9.8 | 88% | 2 exploits | |
| CVE-2021-42342 | In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. embedthis · goahead | Critical 9.8 | 59% | · | |
| CVE-2021-40493 | Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. zohocorp · manageengine opmanager | Critical 9.8 | 50% | · | |
| CVE-2021-21809 | Moodle command execution vulnerability exists in the default legacy spellchecker plugin moodle · moodle | Critical 9.1 | 24% | 3 exploits | |
| CVE-2021-42071 | In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header. visual-tools · dvr vx16 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2021-37926 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. zohocorp · manageengine admanager plus | Critical 9.8 | 74% | · | |
| CVE-2021-37918 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. zohocorp · manageengine admanager plus | Critical 9.8 | 74% | · | |
| CVE-2021-32172 | Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin. maianscriptworld · maian cart | Critical 9.8 | 66% | 3 exploits | |
| CVE-2021-41649 | An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. online-shopping-system-advanced project · online-shopping-system-advanced | Critical 9.8 | 52% | 1 exploit | |
| CVE-2021-41288 | Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. zohocorp · manageengine opmanager | Critical 9.8 | 80% | · | |
| CVE-2021-20034 | An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. sonicwall · sma 500v | Critical 9.1 | 81% | 2 exploits | |
| CVE-2021-37539 | Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. zohocorp · manageengine admanager plus | Critical 9.8 | 93% | · | |
| CVE-2021-41303 | Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass apache · shiro | Critical 9.8 | 76% | · | |
| CVE-2021-33690 | Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who… sap · netweaver development infrastructure | Critical 9.9 | 69% | · | |
| CVE-2021-33543 | Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. geutebrueck · g-cam ebc-2110 firmware | Critical 9.8 | 81% | 1 exploit | |
| CVE-2019-14931 | An issue was discovered on Mitsubishi Electric Europe B.V. inea · me-rtu firmware | Critical 9.8 | 57% | 1 exploit | |
| CVE-2021-28958 | Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password. zohocorp · manageengine adselfservice plus | Critical 9.8 | 73% | · | |
| CVE-2021-34646 | Booster for WooCommerce <= 5.4.3 - Authentication Bypass booster · booster for woocommerce | Critical 9.8 | 51% | 1 exploit |
Showing 451–500 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.