Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2023-41892Critical 9.8Craft CMS Remote Code Execution vulnerabilitycraftcms · craft cmsEPSS94%1 exploitPublished Sep 13, 2023
- CVE-2023-36745High 8.0Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS80%Ransomware1 actorPublished Sep 13, 2023
- CVE-2023-36744High 8.0Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS57%·Published Sep 13, 2023
- CVE-2023-36777Medium 5.7Microsoft Exchange Server Information Disclosure Vulnerabilitymicrosoft · exchange serverEPSS52%·Published Sep 13, 2023
- CVE-2023-38408Critical 9.8openssh - security updateopenbsd · opensshEPSS80%1 exploitPublished Sep 7, 2023
- CVE-2023-39265Medium 6.5Apache Superset Improper Input Validation vulnerabilityapache · supersetEPSS86%1 exploitPublished Sep 6, 2023
- CVE-2023-37941Medium 6.6Apache Superset Deserialization of Untrusted Data vulnerabilityapache · supersetEPSS35%1 exploitPublished Sep 6, 2023
- CVE-2023-39361Critical 9.8Affected versions are subject to a SQL injection discovered in graph_view.php.cacti · cactiEPSS89%1 exploitPublished Sep 6, 2023
- CVE-2023-39362High 7.2In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server.cacti · cactiEPSS85%3 exploitsPublished Sep 6, 2023
- CVE-2023-4634Critical 9.8Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Executiondavidlingren · media library assistantEPSS86%2 exploitsPublished Sep 4, 2023
- CVE-2023-34039Critical 9.8Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation.vmware · aria operations for networksEPSS67%2 exploitsPublished Aug 30, 2023
- CVE-2023-41109Critical 9.8SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.patton · smartnode sn200 firmwareEPSS65%·Published Aug 28, 2023
- CVE-2023-4547Medium 5.1It has been rated as problematic.spa-cart · ecommerce cmsEPSS60%2 exploitsPublished Aug 26, 2023
- CVE-2023-4542Critical 9.8It has been classified as critical.dlink · dar-8000-10 firmwareEPSS85%1 exploitPublished Aug 25, 2023
- CVE-2023-41249Medium 6.1In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Stepjetbrains · teamcityEPSS56%·Published Aug 25, 2023
- CVE-2023-40176Medium 5.4XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayerxwiki · xwikiEPSS80%·Published Aug 21, 2023
- CVE-2023-38836High 8.8File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.boidcms · boidcmsEPSS76%3 exploitsPublished Aug 21, 2023
- CVE-2022-24989Critical 9.8TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI.terra-master · terramaster operating systemEPSS32%3 exploitsPublished Aug 20, 2023
- CVE-2023-4415High 8.8It has been rated as critical.ruijienetworks · rg-ew1200g firmwareEPSS58%1 exploitPublished Aug 18, 2023
- CVE-2023-2915Critical 9.1The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function.rockwellautomation · thinmanager thinserverEPSS82%·Published Aug 18, 2023
- CVE-2023-2917Critical 9.8The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability.rockwellautomation · thinmanager thinserverEPSS72%·Published Aug 18, 2023
- CVE-2023-26469Critical 9.8In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server.jorani · joraniEPSS83%3 exploitsPublished Aug 17, 2023
- CVE-2023-4347Medium 5.4LibreNMS Cross-site Scripting vulnerabilitylibrenms · librenmsEPSS70%·Published Aug 16, 2023
- CVE-2023-40028Medium 6.5Ghost vulnerable to arbitrary file read via symlinks in content importghost · ghostEPSS69%1 exploitPublished Aug 15, 2023
- CVE-2022-21661High 7.5wordpress - security updatewordpress · wordpressEPSS98%2 exploitsPublished Aug 14, 2023
- CVE-2023-32563Critical 9.8An unauthenticated attacker could achieve the code execution through a RemoteControl server.ivanti · avalancheEPSS89%·Published Aug 10, 2023
- CVE-2023-32560Critical 9.8An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.ivanti · avalancheEPSS99%2 exploitsPublished Aug 10, 2023
- CVE-2023-32782High 7.2A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor.paessler · prtg network monitorEPSS56%·Published Aug 10, 2023
- CVE-2023-39143Critical 9.8PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files.papercut · papercut mfEPSS80%Ransomware3 actorsPublished Aug 9, 2023
- CVE-2023-36899High 8.8ASP.NET Elevation of Privilege Vulnerabilitymicrosoft · .net frameworkEPSS77%·Published Aug 8, 2023
- CVE-2023-29689Critical 9.8PyroCMS remote code execution vulnerabilitypyrocms · pyrocmsEPSS53%1 exploitPublished Aug 4, 2023
- CVE-2023-4120Critical 9.8The manipulation of the argument sql leads to command injection.byzoro · smart s85fEPSS62%1 exploitPublished Aug 3, 2023
- CVE-2023-37679Critical 9.8A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server.nextgen · mirth connectEPSS99%1 exploitPublished Aug 3, 2023
- CVE-2023-36255High 8.8An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.eramba · erambaEPSS53%1 exploitPublished Aug 2, 2023
- CVE-2023-2164Medium 5.4gitlab: XSS vulnerability on user interaction with a crafted URLgitlab · gitlabEPSS66%·Published Aug 2, 2023
- CVE-2022-39986Critical 9.8RaspAP Command Injection vulnerabilityraspap · raspapEPSS99%1 exploitPublished Aug 1, 2023
- CVE-2023-34966High 7.5samba: infinite loop in mdssvc RPC service for spotlightsamba · sambaEPSS62%·Published Aug 1, 2023
- CVE-2023-34967Medium 5.3samba: type confusion in mdssvc RPC service for spotlightsamba · sambaEPSS61%·Published Aug 1, 2023
- CVE-2023-34960Critical 9.8A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name.chamilo · chamiloEPSS99%2 exploitsPublished Jul 31, 2023
- CVE-2023-38992Critical 9.8SQL injection in jeecg-bootjeecg · jeecg bootEPSS73%·Published Jul 28, 2023
- CVE-2023-3486High 7.5An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage.papercut · papercut ngEPSS79%·Published Jul 25, 2023
- CVE-2023-3836Critical 9.8A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713.dahuasecurity · smart parking managementEPSS74%1 exploitPublished Jul 22, 2023
- CVE-2023-38646Critical 9.8Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level.metabase · metabaseEPSS99%1 exploitPublished Jul 21, 2023
- CVE-2023-38204Critical 9.8Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution.adobe · coldfusionEPSS67%·Published Jul 21, 2023
- CVE-2023-3765Critical 10.0MLflow Path Traversal vulnerabilitylfprojects · mlflowEPSS68%·Published Jul 19, 2023
- CVE-2023-22047High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.oracle · peoplesoft enterpriseEPSS77%·Published Jul 18, 2023
- CVE-2023-37462High 8.8org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerabilityxwiki · xwikiEPSS92%·Published Jul 14, 2023
- CVE-2023-29452Medium 5.4Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider.zabbix · zabbixEPSS64%·Published Jul 13, 2023
- CVE-2023-34127High 8.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges.sonicwall · analyticsEPSS86%1 exploitPublished Jul 13, 2023
- CVE-2023-34133High 7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database.sonicwall · analyticsEPSS73%1 exploitPublished Jul 13, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-41892 | Craft CMS Remote Code Execution vulnerability craftcms · craft cms | Critical 9.8 | 94% | 1 exploit | |
| CVE-2023-36745 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.0 | 80% | Ransomware1 actor | |
| CVE-2023-36744 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.0 | 57% | · | |
| CVE-2023-36777 | Microsoft Exchange Server Information Disclosure Vulnerability microsoft · exchange server | Medium 5.7 | 52% | · | |
| CVE-2023-38408 | openssh - security update openbsd · openssh | Critical 9.8 | 80% | 1 exploit | |
| CVE-2023-39265 | Apache Superset Improper Input Validation vulnerability apache · superset | Medium 6.5 | 86% | 1 exploit | |
| CVE-2023-37941 | Apache Superset Deserialization of Untrusted Data vulnerability apache · superset | Medium 6.6 | 35% | 1 exploit | |
| CVE-2023-39361 | Affected versions are subject to a SQL injection discovered in graph_view.php. cacti · cacti | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-39362 | In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. cacti · cacti | High 7.2 | 85% | 3 exploits | |
| CVE-2023-4634 | Media Library Assistant <= 3.09 - Unauthenticated Local/Remote File Inclusion & Remote Code Execution davidlingren · media library assistant | Critical 9.8 | 86% | 2 exploits | |
| CVE-2023-34039 | Aria Operations for Networks contains an Authentication Bypass vulnerability due to a lack of unique cryptographic key generation. vmware · aria operations for networks | Critical 9.8 | 67% | 2 exploits | |
| CVE-2023-41109 | SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection. patton · smartnode sn200 firmware | Critical 9.8 | 65% | · | |
| CVE-2023-4547 | It has been rated as problematic. spa-cart · ecommerce cms | Medium 5.1 | 60% | 2 exploits | |
| CVE-2023-4542 | It has been classified as critical. dlink · dar-8000-10 firmware | Critical 9.8 | 85% | 1 exploit | |
| CVE-2023-41249 | In JetBrains TeamCity before 2023.05.3 reflected XSS was possible during copying Build Step jetbrains · teamcity | Medium 6.1 | 56% | · | |
| CVE-2023-40176 | XWiki Platform Stored Cross-site Scripting in the user profile via the timezone displayer xwiki · xwiki | Medium 5.4 | 80% | · | |
| CVE-2023-38836 | File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks. boidcms · boidcms | High 8.8 | 76% | 3 exploits | |
| CVE-2022-24989 | TerraMaster NAS through 4.2.30 allows remote WAN attackers to execute arbitrary code as root via the raidtype and diskstring parameters for PHP Object Instantiation to the api.php?mobile/createRaid URI. terra-master · terramaster operating system | Critical 9.8 | 32% | 3 exploits | |
| CVE-2023-4415 | It has been rated as critical. ruijienetworks · rg-ew1200g firmware | High 8.8 | 58% | 1 exploit | |
| CVE-2023-2915 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability, Due to improper input validation, a path traversal vulnerability exists when the ThinManager software processes a certain function. rockwellautomation · thinmanager thinserver | Critical 9.1 | 82% | · | |
| CVE-2023-2917 | The Rockwell Automation Thinmanager Thinserver is impacted by an improper input validation vulnerability. rockwellautomation · thinmanager thinserver | Critical 9.8 | 72% | · | |
| CVE-2023-26469 | In Jorani 1.0.0, an attacker could leverage path traversal to access files and execute code on the server. jorani · jorani | Critical 9.8 | 83% | 3 exploits | |
| CVE-2023-4347 | LibreNMS Cross-site Scripting vulnerability librenms · librenms | Medium 5.4 | 70% | · | |
| CVE-2023-40028 | Ghost vulnerable to arbitrary file read via symlinks in content import ghost · ghost | Medium 6.5 | 69% | 1 exploit | |
| CVE-2022-21661 | wordpress - security update wordpress · wordpress | High 7.5 | 98% | 2 exploits | |
| CVE-2023-32563 | An unauthenticated attacker could achieve the code execution through a RemoteControl server. ivanti · avalanche | Critical 9.8 | 89% | · | |
| CVE-2023-32560 | An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. ivanti · avalanche | Critical 9.8 | 99% | 2 exploits | |
| CVE-2023-32782 | A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. paessler · prtg network monitor | High 7.2 | 56% | · | |
| CVE-2023-39143 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. papercut · papercut mf | Critical 9.8 | 80% | Ransomware3 actors | |
| CVE-2023-36899 | ASP.NET Elevation of Privilege Vulnerability microsoft · .net framework | High 8.8 | 77% | · | |
| CVE-2023-29689 | PyroCMS remote code execution vulnerability pyrocms · pyrocms | Critical 9.8 | 53% | 1 exploit | |
| CVE-2023-4120 | The manipulation of the argument sql leads to command injection. byzoro · smart s85f | Critical 9.8 | 62% | 1 exploit | |
| CVE-2023-37679 | A remote command execution (RCE) vulnerability in NextGen Mirth Connect v4.3.0 allows attackers to execute arbitrary commands on the hosting server. nextgen · mirth connect | Critical 9.8 | 99% | 1 exploit | |
| CVE-2023-36255 | An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL. eramba · eramba | High 8.8 | 53% | 1 exploit | |
| CVE-2023-2164 | gitlab: XSS vulnerability on user interaction with a crafted URL gitlab · gitlab | Medium 5.4 | 66% | · | |
| CVE-2022-39986 | RaspAP Command Injection vulnerability raspap · raspap | Critical 9.8 | 99% | 1 exploit | |
| CVE-2023-34966 | samba: infinite loop in mdssvc RPC service for spotlight samba · samba | High 7.5 | 62% | · | |
| CVE-2023-34967 | samba: type confusion in mdssvc RPC service for spotlight samba · samba | Medium 5.3 | 61% | · | |
| CVE-2023-34960 | A command injection vulnerability in the wsConvertPpt component of Chamilo v1.11.* up to v1.11.18 allows attackers to execute arbitrary commands via a SOAP API call with a crafted PowerPoint name. chamilo · chamilo | Critical 9.8 | 99% | 2 exploits | |
| CVE-2023-38992 | SQL injection in jeecg-boot jeecg · jeecg boot | Critical 9.8 | 73% | · | |
| CVE-2023-3486 | An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. papercut · papercut ng | High 7.5 | 79% | · | |
| CVE-2023-3836 | A vulnerability classified as critical was found in Dahua Smart Park Management up to 20230713. dahuasecurity · smart parking management | Critical 9.8 | 74% | 1 exploit | |
| CVE-2023-38646 | Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. metabase · metabase | Critical 9.8 | 99% | 1 exploit | |
| CVE-2023-38204 | Adobe ColdFusion versions 2018u18 (and earlier), 2021u8 (and earlier) and 2023u2 (and earlier) are affected by a Deserialization of Untrusted Data vulnerability that could result in Arbitrary code execution. adobe · coldfusion | Critical 9.8 | 67% | · | |
| CVE-2023-3765 | MLflow Path Traversal vulnerability lfprojects · mlflow | Critical 10.0 | 68% | · | |
| CVE-2023-22047 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. oracle · peoplesoft enterprise | High 7.5 | 77% | · | |
| CVE-2023-37462 | org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability xwiki · xwiki | High 8.8 | 92% | · | |
| CVE-2023-29452 | Currently, geomap configuration (Administration -> General -> Geographical maps) allows using HTML in the field “Attribution text” when selected “Other” Tile provider. zabbix · zabbix | Medium 5.4 | 64% | · | |
| CVE-2023-34127 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. sonicwall · analytics | High 8.8 | 86% | 1 exploit | |
| CVE-2023-34133 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. sonicwall · analytics | High 7.5 | 73% | 1 exploit |
Showing 501–550 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.