Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2021-36356Critical 9.8KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI).kramerav · viawareEPSS54%2 exploitsPublished Aug 31, 2021
- CVE-2021-37538Critical 9.8Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the…smartdatasoft · smartblogEPSS74%·Published Aug 24, 2021
- CVE-2021-35393Critical 9.8Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.realtek · rtl819x jungle software development kitEPSS68%·Published Aug 16, 2021
- CVE-2021-37350Critical 9.8Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.nagios · nagios xiEPSS79%·Published Aug 16, 2021
- CVE-2021-37346Critical 9.8Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).nagios · nagios xi watchguard wizardEPSS74%·Published Aug 13, 2021
- CVE-2021-37344Critical 9.8Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).nagios · nagios xi switch wizardEPSS97%·Published Aug 13, 2021
- CVE-2021-26424Critical 9.8Windows TCP/IP Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS61%·Published Aug 12, 2021
- CVE-2021-37425Critical 9.1Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key.altova · mobiletogether serverEPSS66%1 exploitPublished Aug 10, 2021
- CVE-2021-24499Critical 9.8The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way.amentotech · workreapEPSS60%1 exploitPublished Aug 9, 2021
- CVE-2021-21805Critical 9.8An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020).advantech · r-seenetEPSS70%·Published Aug 5, 2021
- CVE-2021-24472Critical 9.8QT KenthaRadio < 2.0.2 & OnAir2 < 3.9.9.2 - Server-Side Request Forgery & Remote File Inclusionqantumthemes · kentharadioEPSS57%·Published Aug 3, 2021
- CVE-2020-35476Critical 9.8OS Command Injection in OpenTSDBopentsdb · opentsdbEPSS85%3 exploitsPublished Aug 2, 2021
- CVE-2020-7388Critical 9.8Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component.sage · adxadminEPSS69%1 exploitPublished Jul 22, 2021
- CVE-2021-33032Critical 10.0A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple…eq-3 · homematic ccu2 firmwareEPSS52%·Published Jul 22, 2021
- CVE-2021-2394Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS76%·Published Jul 21, 2021
- CVE-2021-22707Critical 9.8A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that…schneider-electric · evlink city evc1s22p4 firmwareEPSS65%·Published Jul 21, 2021
- CVE-2021-2456Critical 9.8The supported version that is affected is 12.2.1.4.0.oracle · business intelligenceEPSS81%·Published Jul 20, 2021
- CVE-2021-35064Critical 9.8KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo.kramerav · viawareEPSS71%2 exploitsPublished Jul 12, 2021
- CVE-2021-30118Critical 9.8An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated…kaseya · vsaEPSS60%·Published Jul 9, 2021
- CVE-2021-27905Critical 9.8The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core.apache · solrEPSS93%·Published Jul 9, 2021
- CVE-2021-33221Critical 9.8There are Unauthenticated API Endpoints.commscope · ruckus iot controllerEPSS56%·Published Jul 7, 2021
- CVE-2021-34621Critical 9.8.properfraction · profilepressEPSS69%2 exploitsPublished Jul 7, 2021
- CVE-2018-11218Critical 9.8redis - security updateredislabs · redisEPSS59%1 exploitPublished Jul 7, 2021
- CVE-2021-34427Critical 9.8In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.eclipse · business intelligence and reporting toolsEPSS58%1 exploitPublished Jun 25, 2021
- CVE-2021-27850Critical 9.8Remote code execution in Apache Tapestryapache · tapestryEPSS94%·Published Jun 16, 2021
- CVE-2021-32682Critical 9.8elFinder before 2.1.59 contains multiple vulnerabilities leading to RCEstd42 · elfinderEPSS70%2 exploitsPublished Jun 16, 2021
- CVE-2021-3007Critical 9.8Remote code execution in zendframework and laminas-httpgetlaminas · laminas-httpEPSS75%1 exploitPublished Jun 8, 2021
- CVE-2021-33564Critical 9.8Dragonfly contains remote code execution vulnerabilitydragonfly project · dragonflyEPSS72%·Published Jun 2, 2021
- CVE-2021-22160Critical 9.8Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlowapache · pulsarEPSS53%·Published Jun 1, 2021
- CVE-2021-24321Critical 9.8The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement,…bold-themes · belloEPSS67%·Published Jun 1, 2021
- CVE-2021-22911Critical 9.8A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.rocket.chat · rocket.chatEPSS95%4 exploitsPublished May 27, 2021
- CVE-2021-31474Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1.solarwinds · network performance monitorEPSS94%·Published May 24, 2021
- CVE-2021-32305Critical 9.8WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.websvn · websvnEPSS87%2 exploitsPublished May 18, 2021
- CVE-2020-28429Critical 9.8Command Injection in geojson2kmlgeojson2kml project · geojson2kmlEPSS63%·Published May 10, 2021
- CVE-2020-28018Critical 9.8Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.exim · eximEPSS56%·Published May 7, 2021
- CVE-2021-29203Critical 9.8The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration.hp · edgeline infrastructure managerEPSS68%·Published May 6, 2021
- CVE-2015-0235Critical 10.0Heap-based buffer overflow in the nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."gnu · glibcEPSS95%8 exploitsPublished May 5, 2021
- CVE-2021-27651Critical 9.8In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.pega · infinityEPSS54%·Published Apr 29, 2021
- CVE-2021-31856Critical 9.8A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).layer5 · mesheryEPSS75%·Published Apr 28, 2021
- CVE-2021-29441Critical 9.8In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication.alibaba · nacosEPSS83%·Published Apr 27, 2021
- CVE-2021-30128Critical 9.8Apache OFBiz has unsafe deserialization prior to 17.12.07 versionapache · ofbizEPSS81%·Published Apr 27, 2021
- CVE-2021-29200Critical 9.8Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attackapache · ofbizEPSS55%·Published Apr 27, 2021
- CVE-2021-3287Critical 9.8Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.zohocorp · manageengine opmanagerEPSS51%2 exploitsPublished Apr 26, 2021
- CVE-2019-0230Critical 9.8struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributesapache · strutsEPSS97%4 exploitsPublished Apr 21, 2021
- CVE-2017-5645Critical 9.8In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.apache · log4jEPSS90%·Published Apr 21, 2021
- CVE-2021-28480Critical 9.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS71%·Published Apr 14, 2021
- CVE-2020-24391Critical 9.8Remote code execution in mongo-expressmongo-express project · mongo-expressEPSS75%·Published Apr 13, 2021
- CVE-2011-2523Critical 9.8vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.vsftpd project · vsftpdEPSS96%3 exploitsPublished Apr 13, 2021
- CVE-2021-21425Critical 9.8In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials.getgrav · grav-plugin-adminEPSS81%2 exploitsPublished Apr 7, 2021
- CVE-2021-20078Critical 9.1Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component.zohocorp · manageengine opmanagerEPSS60%·Published Apr 1, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-36356 | KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). kramerav · viaware | Critical 9.8 | 54% | 2 exploits | |
| CVE-2021-37538 | Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the… smartdatasoft · smartblog | Critical 9.8 | 74% | · | |
| CVE-2021-35393 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. realtek · rtl819x jungle software development kit | Critical 9.8 | 68% | · | |
| CVE-2021-37350 | Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. nagios · nagios xi | Critical 9.8 | 79% | · | |
| CVE-2021-37346 | Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection). nagios · nagios xi watchguard wizard | Critical 9.8 | 74% | · | |
| CVE-2021-37344 | Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection). nagios · nagios xi switch wizard | Critical 9.8 | 97% | · | |
| CVE-2021-26424 | Windows TCP/IP Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 61% | · | |
| CVE-2021-37425 | Altova MobileTogether Server before 7.3 SP1 allows XXE attacks, such as an InfoSetChanges/Changes attack against /workflowmanagement, or reading mobiletogetherserver.cfg and then reading the certificate and private key. altova · mobiletogether server | Critical 9.1 | 66% | 1 exploit | |
| CVE-2021-24499 | The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. amentotech · workreap | Critical 9.8 | 60% | 1 exploit | |
| CVE-2021-21805 | An OS Command Injection vulnerability exists in the ping.php script functionality of Advantech R-SeeNet v 2.4.12 (20.10.2020). advantech · r-seenet | Critical 9.8 | 70% | · | |
| CVE-2021-24472 | QT KenthaRadio < 2.0.2 & OnAir2 < 3.9.9.2 - Server-Side Request Forgery & Remote File Inclusion qantumthemes · kentharadio | Critical 9.8 | 57% | · | |
| CVE-2020-35476 | OS Command Injection in OpenTSDB opentsdb · opentsdb | Critical 9.8 | 85% | 3 exploits | |
| CVE-2020-7388 | Sage X3 Unauthenticated Remote Command Execution (RCE) as SYSTEM in AdxDSrv.exe component. sage · adxadmin | Critical 9.8 | 69% | 1 exploit | |
| CVE-2021-33032 | A Remote Code Execution (RCE) vulnerability in the WebUI component of the eQ-3 HomeMatic CCU2 firmware up to and including version 2.57.5 and CCU3 firmware up to and including version 3.57.5 allows remote unauthenticated attackers to execute system commands as root via a simple… eq-3 · homematic ccu2 firmware | Critical 10.0 | 52% | · | |
| CVE-2021-2394 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. oracle · weblogic server | Critical 9.8 | 76% | · | |
| CVE-2021-22707 | A CWE-798: Use of Hard-coded Credentials vulnerability exists in EVlink City (EVC1S22P4 / EVC1S7P4 all versions prior to R8 V3.4.0.1), EVlink Parking (EVW2 / EVF2 / EV.2 all versions prior to R8 V3.4.0.1), and EVlink Smart Wallbox (EVB1A all versions prior to R8 V3.4.0.1 ) that… schneider-electric · evlink city evc1s22p4 firmware | Critical 9.8 | 65% | · | |
| CVE-2021-2456 | The supported version that is affected is 12.2.1.4.0. oracle · business intelligence | Critical 9.8 | 81% | · | |
| CVE-2021-35064 | KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. kramerav · viaware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2021-30118 | An attacker can upload files with the privilege of the Web Server process for Kaseya VSA Unified Remote Monitoring & Management (RMM) 9.5.4.2149 and subsequently use these files to execute asp commands The api /SystemTab/uploader.aspx is vulnerable to an unauthenticated… kaseya · vsa | Critical 9.8 | 60% | · | |
| CVE-2021-27905 | The ReplicationHandler (normally registered at "/replication" under a Solr core) in Apache Solr has a "masterUrl" (also "leaderUrl" alias) parameter that is used to designate another ReplicationHandler on another Solr core to replicate index data into the local core. apache · solr | Critical 9.8 | 93% | · | |
| CVE-2021-33221 | There are Unauthenticated API Endpoints. commscope · ruckus iot controller | Critical 9.8 | 56% | · | |
| CVE-2021-34621 | . properfraction · profilepress | Critical 9.8 | 69% | 2 exploits | |
| CVE-2018-11218 | redis - security update redislabs · redis | Critical 9.8 | 59% | 1 exploit | |
| CVE-2021-34427 | In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance. eclipse · business intelligence and reporting tools | Critical 9.8 | 58% | 1 exploit | |
| CVE-2021-27850 | Remote code execution in Apache Tapestry apache · tapestry | Critical 9.8 | 94% | · | |
| CVE-2021-32682 | elFinder before 2.1.59 contains multiple vulnerabilities leading to RCE std42 · elfinder | Critical 9.8 | 70% | 2 exploits | |
| CVE-2021-3007 | Remote code execution in zendframework and laminas-http getlaminas · laminas-http | Critical 9.8 | 75% | 1 exploit | |
| CVE-2021-33564 | Dragonfly contains remote code execution vulnerability dragonfly project · dragonfly | Critical 9.8 | 72% | · | |
| CVE-2021-22160 | Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow apache · pulsar | Critical 9.8 | 53% | · | |
| CVE-2021-24321 | The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement,… bold-themes · bello | Critical 9.8 | 67% | · | |
| CVE-2021-22911 | A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE. rocket.chat · rocket.chat | Critical 9.8 | 95% | 4 exploits | |
| CVE-2021-31474 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. solarwinds · network performance monitor | Critical 9.8 | 94% | · | |
| CVE-2021-32305 | WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. websvn · websvn | Critical 9.8 | 87% | 2 exploits | |
| CVE-2020-28429 | Command Injection in geojson2kml geojson2kml project · geojson2kml | Critical 9.8 | 63% | · | |
| CVE-2020-28018 | Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL. exim · exim | Critical 9.8 | 56% | · | |
| CVE-2021-29203 | The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration. hp · edgeline infrastructure manager | Critical 9.8 | 68% | · | |
| CVE-2015-0235 | Heap-based buffer overflow in the nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST." gnu · glibc | Critical 10.0 | 95% | 8 exploits | |
| CVE-2021-27651 | In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. pega · infinity | Critical 9.8 | 54% | · | |
| CVE-2021-31856 | A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go). layer5 · meshery | Critical 9.8 | 75% | · | |
| CVE-2021-29441 | In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. alibaba · nacos | Critical 9.8 | 83% | · | |
| CVE-2021-30128 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version apache · ofbiz | Critical 9.8 | 81% | · | |
| CVE-2021-29200 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack apache · ofbiz | Critical 9.8 | 55% | · | |
| CVE-2021-3287 | Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. zohocorp · manageengine opmanager | Critical 9.8 | 51% | 2 exploits | |
| CVE-2019-0230 | struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes apache · struts | Critical 9.8 | 97% | 4 exploits | |
| CVE-2017-5645 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. apache · log4j | Critical 9.8 | 90% | · | |
| CVE-2021-28480 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | Critical 9.8 | 71% | · | |
| CVE-2020-24391 | Remote code execution in mongo-express mongo-express project · mongo-express | Critical 9.8 | 75% | · | |
| CVE-2011-2523 | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. vsftpd project · vsftpd | Critical 9.8 | 96% | 3 exploits | |
| CVE-2021-21425 | In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. getgrav · grav-plugin-admin | Critical 9.8 | 81% | 2 exploits | |
| CVE-2021-20078 | Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. zohocorp · manageengine opmanager | Critical 9.1 | 60% | · |
Showing 501–550 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.