Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2021-45010High 8.8A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.prasathmani · tiny file managerEPSS70%3 exploitsPublished Mar 15, 2022
- CVE-2021-40346High 7.5An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.haproxy · haproxyEPSS59%·Published Mar 15, 2022
- CVE-2020-8625High 8.1BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features.isc · bindEPSS64%·Published Mar 11, 2022
- CVE-2022-23940High 8.8SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution.salesagility · suitecrmEPSS53%1 exploitPublished Mar 10, 2022
- CVE-2022-24734High 7.2In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type php with PHP code, executed on on _Change Settings_ pages.mybb · mybbEPSS78%4 exploitsPublished Mar 9, 2022
- CVE-2022-23277High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS41%1 exploitPublished Mar 9, 2022
- CVE-2022-24716High 7.5Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials.icinga · icinga web 2EPSS89%1 exploitPublished Mar 8, 2022
- CVE-2021-44827High 8.8There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges.tp-link · archer c20i firmwareEPSS54%·Published Mar 7, 2022
- CVE-2021-46381High 7.5Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow].dlink · dap-1620 firmwareEPSS59%2 exploitsPublished Mar 4, 2022
- CVE-2022-0824High 8.8Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990.webmin · webminEPSS97%4 exploitsPublished Mar 3, 2022
- CVE-2021-41282High 8.8diag_routes.php in pfSense 2.5.2 allows sed data injection.pfsense · pfsenseEPSS87%2 exploitsPublished Mar 1, 2022
- CVE-2021-34798High 7.5Malformed requests may cause the server to dereference a NULL pointer.apache · http serverEPSS65%·Published Mar 1, 2022
- CVE-2022-24288High 8.7OS Command injection in Apache Airflowapache · airflowEPSS78%·Published Feb 26, 2022
- CVE-2022-25149High 7.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to…veronalabs · wp statisticsEPSS77%1 exploitPublished Feb 24, 2022
- CVE-2022-25148High 7.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL…veronalabs · wp statisticsEPSS81%3 exploitsPublished Feb 24, 2022
- CVE-2022-23642High 8.8Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the gitserver service.sourcegraph · sourcegraphEPSS74%4 exploitsPublished Feb 18, 2022
- CVE-2021-44142High 8.8samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code executionEPSS74%·Published Feb 17, 2022
- CVE-2022-23307High 8.8CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw.apache · chainsawEPSS54%·Published Feb 17, 2022
- CVE-2022-0513High 7.5The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary…veronalabs · wp statisticsEPSS53%·Published Feb 16, 2022
- CVE-2020-13379High 8.2Server Side Request Forgery in Grafanagrafana · grafanaEPSS100%·Published Feb 15, 2022
- CVE-2021-27358High 7.5Denial of service in Grafanagrafana · grafanaEPSS83%·Published Feb 15, 2022
- CVE-2019-11229High 8.8Gitea Remote Code Executiongitea · giteaEPSS55%·Published Feb 15, 2022
- CVE-2022-0557High 7.2OS Command Injection in Microwebermicroweber · microweberEPSS51%2 exploitsPublished Feb 12, 2022
- CVE-2022-20707High 7.3Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and…cisco · rv340 firmwareEPSS75%1 exploitPublished Feb 11, 2022
- CVE-2020-13951High 7.5Denial of service in Apache OpenMeetingsapache · openmeetingsEPSS69%1 exploitPublished Feb 10, 2022
- CVE-2020-13935High 7.5Infinite Loop in Apache Tomcatapache · tomcatEPSS87%·Published Feb 8, 2022
- CVE-2020-13934High 7.5Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcatapache · tomcatEPSS64%·Published Feb 8, 2022
- CVE-2021-23017High 7.7nginx - security updatef5 · nginxEPSS53%1 exploitPublished Feb 1, 2022
- CVE-2022-24124High 7.5SQL Injection in Casdoorcasbin · casdoorEPSS55%1 exploitPublished Feb 1, 2022
- CVE-2022-0306High 8.8Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.google · chromeEPSS85%·Published Jan 26, 2022
- CVE-2022-23302High 8.8Deserialization of Untrusted Data in Log4j 1.xapache · log4jEPSS64%·Published Jan 21, 2022
- CVE-2022-21371High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS93%2 exploitsPublished Jan 19, 2022
- CVE-2021-44703High 7.8Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of…adobe · acrobatEPSS57%·Published Jan 17, 2022
- CVE-2021-34996High 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.commvault · commcellEPSS82%·Published Jan 13, 2022
- CVE-2021-34995High 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.commvault · commcellEPSS69%·Published Jan 13, 2022
- CVE-2021-24862High 7.2The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issuemetagauss · registrationmagicEPSS73%3 exploitsPublished Jan 10, 2022
- CVE-2021-20039High 8.8Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user.sonicwall · sma 200 firmwareEPSS79%2 exploitsPublished Jan 4, 2022
- CVE-2021-4044High 7.5Invalid handling of X509_verify_cert() internal errors in libsslopenssl · opensslEPSS50%·Published Dec 15, 2021
- CVE-2021-43829High 8.8In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature.patrowl · patrowlmanagerEPSS59%·Published Dec 14, 2021
- CVE-2021-39312High 7.5The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.trueranker · true rankerEPSS78%2 exploitsPublished Dec 14, 2021
- CVE-2021-40856High 7.5Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.auerswald · comfortel 1400 ip firmwareEPSS50%1 exploitPublished Dec 13, 2021
- CVE-2019-19609High 7.2Duplicate Advisory: OS Command Injection in Strapistrapi · strapiEPSS54%1 exploitPublished Dec 10, 2021
- CVE-2021-42132High 8.8A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.ivanti · avalancheEPSS70%·Published Dec 7, 2021
- CVE-2021-42131High 8.8A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.ivanti · avalancheEPSS67%·Published Dec 7, 2021
- CVE-2021-42130High 8.8A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution.ivanti · avalancheEPSS62%·Published Dec 7, 2021
- CVE-2021-42129High 8.8A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.ivanti · avalancheEPSS77%·Published Dec 7, 2021
- CVE-2021-42125High 8.8An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.ivanti · avalancheEPSS82%·Published Dec 7, 2021
- CVE-2021-24917High 7.5The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.wpserveur · wps hide loginEPSS72%·Published Dec 6, 2021
- CVE-2021-39316High 7.5ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversaldigitalzoomstudio · zoomsoundsEPSS66%1 exploitPublished Dec 6, 2021
- CVE-2021-38147High 7.5Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel,…wipro · holmesEPSS53%1 exploitPublished Nov 29, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-45010 | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution. prasathmani · tiny file manager | High 8.8 | 70% | 3 exploits | |
| CVE-2021-40346 | An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs. haproxy · haproxy | High 7.5 | 59% | · | |
| CVE-2020-8625 | BIND servers are vulnerable if they are running an affected version and are configured to use GSS-TSIG features. isc · bind | High 8.1 | 64% | · | |
| CVE-2022-23940 | SuiteCRM through 7.12.1 and 8.x through 8.0.1 allows Remote Code Execution. salesagility · suitecrm | High 8.8 | 53% | 1 exploit | |
| CVE-2022-24734 | In affected versions the Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type php with PHP code, executed on on _Change Settings_ pages. mybb · mybb | High 7.2 | 78% | 4 exploits | |
| CVE-2022-23277 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 41% | 1 exploit | |
| CVE-2022-24716 | Unauthenticated users can leak the contents of files of the local system accessible to the web-server user, including icingaweb2 configuration files with database credentials. icinga · icinga web 2 | High 7.5 | 89% | 1 exploit | |
| CVE-2021-44827 | There is remote authenticated OS command injection on TP-Link Archer C20i 0.9.1 3.2 v003a.0 Build 170221 Rel.55462n devices vie the X_TP_ExternalIPv6Address HTTP parameter, allowing a remote attacker to run arbitrary commands on the router with root privileges. tp-link · archer c20i firmware | High 8.8 | 54% | · | |
| CVE-2021-46381 | Local File Inclusion due to path traversal in D-Link DAP-1620 leads to unauthorized internal files reading [/etc/passwd] and [/etc/shadow]. dlink · dap-1620 firmware | High 7.5 | 59% | 2 exploits | |
| CVE-2022-0824 | Improper Access Control to Remote Code Execution in GitHub repository webmin/webmin prior to 1.990. webmin · webmin | High 8.8 | 97% | 4 exploits | |
| CVE-2021-41282 | diag_routes.php in pfSense 2.5.2 allows sed data injection. pfsense · pfsense | High 8.8 | 87% | 2 exploits | |
| CVE-2021-34798 | Malformed requests may cause the server to dereference a NULL pointer. apache · http server | High 7.5 | 65% | · | |
| CVE-2022-24288 | OS Command injection in Apache Airflow apache · airflow | High 8.7 | 78% | · | |
| CVE-2022-25149 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the IP parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL queries to… veronalabs · wp statistics | High 7.5 | 77% | 1 exploit | |
| CVE-2022-25148 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the current_page_id parameter found in the ~/includes/class-wp-statistics-hits.php file which allows attackers without authentication to inject arbitrary SQL… veronalabs · wp statistics | High 7.5 | 81% | 3 exploits | |
| CVE-2022-23642 | Sourcegraph prior to version 3.37 is vulnerable to remote code execution in the gitserver service. sourcegraph · sourcegraph | High 8.8 | 74% | 4 exploits | |
| CVE-2021-44142 | samba: Out-of-bounds heap read/write vulnerability in VFS module vfs_fruit allows code execution | High 8.8 | 74% | · | |
| CVE-2022-23307 | CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. apache · chainsaw | High 8.8 | 54% | · | |
| CVE-2022-0513 | The WP Statistics WordPress plugin is vulnerable to SQL Injection due to insufficient escaping and parameterization of the exclusion_reason parameter found in the ~/includes/class-wp-statistics-exclusion.php file which allows attackers without authentication to inject arbitrary… veronalabs · wp statistics | High 7.5 | 53% | · | |
| CVE-2020-13379 | Server Side Request Forgery in Grafana grafana · grafana | High 8.2 | 100% | · | |
| CVE-2021-27358 | Denial of service in Grafana grafana · grafana | High 7.5 | 83% | · | |
| CVE-2019-11229 | Gitea Remote Code Execution gitea · gitea | High 8.8 | 55% | · | |
| CVE-2022-0557 | OS Command Injection in Microweber microweber · microweber | High 7.2 | 51% | 2 exploits | |
| CVE-2022-20707 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and… cisco · rv340 firmware | High 7.3 | 75% | 1 exploit | |
| CVE-2020-13951 | Denial of service in Apache OpenMeetings apache · openmeetings | High 7.5 | 69% | 1 exploit | |
| CVE-2020-13935 | Infinite Loop in Apache Tomcat apache · tomcat | High 7.5 | 87% | · | |
| CVE-2020-13934 | Improper Restriction of Operations within the Bounds of a Memory Buffer in Apache Tomcat apache · tomcat | High 7.5 | 64% | · | |
| CVE-2021-23017 | nginx - security update f5 · nginx | High 7.7 | 53% | 1 exploit | |
| CVE-2022-24124 | SQL Injection in Casdoor casbin · casdoor | High 7.5 | 55% | 1 exploit | |
| CVE-2022-0306 | Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. google · chrome | High 8.8 | 85% | · | |
| CVE-2022-23302 | Deserialization of Untrusted Data in Log4j 1.x apache · log4j | High 8.8 | 64% | · | |
| CVE-2022-21371 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. oracle · weblogic server | High 7.5 | 93% | 2 exploits | |
| CVE-2021-44703 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of… adobe · acrobat | High 7.8 | 57% | · | |
| CVE-2021-34996 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. commvault · commcell | High 8.8 | 82% | · | |
| CVE-2021-34995 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. commvault · commcell | High 8.8 | 69% | · | |
| CVE-2021-24862 | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue metagauss · registrationmagic | High 7.2 | 73% | 3 exploits | |
| CVE-2021-20039 | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. sonicwall · sma 200 firmware | High 8.8 | 79% | 2 exploits | |
| CVE-2021-4044 | Invalid handling of X509_verify_cert() internal errors in libssl openssl · openssl | High 7.5 | 50% | · | |
| CVE-2021-43829 | In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. patrowl · patrowlmanager | High 8.8 | 59% | · | |
| CVE-2021-39312 | The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file. trueranker · true ranker | High 7.5 | 78% | 2 exploits | |
| CVE-2021-40856 | Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring. auerswald · comfortel 1400 ip firmware | High 7.5 | 50% | 1 exploit | |
| CVE-2019-19609 | Duplicate Advisory: OS Command Injection in Strapi strapi · strapi | High 7.2 | 54% | 1 exploit | |
| CVE-2021-42132 | A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution. ivanti · avalanche | High 8.8 | 70% | · | |
| CVE-2021-42131 | A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation. ivanti · avalanche | High 8.8 | 67% | · | |
| CVE-2021-42130 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution. ivanti · avalanche | High 8.8 | 62% | · | |
| CVE-2021-42129 | A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution. ivanti · avalanche | High 8.8 | 77% | · | |
| CVE-2021-42125 | An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files. ivanti · avalanche | High 8.8 | 82% | · | |
| CVE-2021-24917 | The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. wpserveur · wps hide login | High 7.5 | 72% | · | |
| CVE-2021-39316 | ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal digitalzoomstudio · zoomsounds | High 7.5 | 66% | 1 exploit | |
| CVE-2021-38147 | Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel,… wipro · holmes | High 7.5 | 53% | 1 exploit |
Showing 451–500 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.