Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2021-36160High 7.5A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).apache · http serverEPSS63%·Published Nov 25, 2021
- CVE-2021-43778High 7.5GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability.glpi-project · barcodeEPSS53%1 exploitPublished Nov 24, 2021
- CVE-2021-42362High 8.8WordPress Popular Posts <= 5.3.2 - Authenticated Arbitrary File Uploadwordpress popular posts project · wordpress popular postsEPSS80%3 exploitsPublished Nov 18, 2021
- CVE-2021-3577High 8.8An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.binatoneglobal · cn28 firmwareEPSS60%·Published Nov 12, 2021
- CVE-2021-31602High 7.5The Security Model has different layers of Access Control.hitachi · vantara pentahoEPSS52%1 exploitPublished Nov 9, 2021
- CVE-2021-35215High 8.8Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5.solarwinds · orion platformEPSS70%·Published Oct 27, 2021
- CVE-2021-40344High 7.2In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image.nagios · nagios xiEPSS65%·Published Oct 27, 2021
- CVE-2021-42840High 8.8SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting.salesagility · suitecrmEPSS59%3 exploitsPublished Oct 22, 2021
- CVE-2021-39352High 7.2The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation.catchplugins · catch themes demo importEPSS56%5 exploitsPublished Oct 21, 2021
- CVE-2021-40728High 7.8Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result…adobe · acrobatEPSS55%·Published Oct 18, 2021
- CVE-2021-33035High 7.8Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets.apache · openofficeEPSS51%·Published Oct 12, 2021
- CVE-2021-40323High 9.3Cobbler before 3.3.0 allows log poisoningcobbler project · cobblerEPSS87%·Published Oct 5, 2021
- CVE-2021-40324High 8.7Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.cobbler project · cobblerEPSS69%·Published Oct 5, 2021
- CVE-2021-41291High 7.5ECOA BAS controller suffers from a path traversal content disclosure vulnerability.ecoa · riskterminatorEPSS83%·Published Sep 30, 2021
- CVE-2021-39843High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.adobe · acrobatEPSS77%·Published Sep 29, 2021
- CVE-2021-39840High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForms that could result in arbitrary code execution in the context of the current user.adobe · acrobatEPSS51%·Published Sep 29, 2021
- CVE-2021-39839High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm getItem action that could result in arbitrary code execution in the context of…adobe · acrobatEPSS65%·Published Sep 29, 2021
- CVE-2021-39838High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetCaption action that could result in arbitrary code execution in the…adobe · acrobatEPSS65%·Published Sep 29, 2021
- CVE-2021-39837High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm deleteItemAt action that could result in arbitrary code execution in the…adobe · acrobatEPSS65%·Published Sep 29, 2021
- CVE-2021-39836High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the…adobe · acrobatEPSS70%·Published Sep 29, 2021
- CVE-2021-41381High 7.5Payara Micro Community 5.2021.6 and below allows Directory Traversal.payara · micro communityEPSS53%4 exploitsPublished Sep 23, 2021
- CVE-2021-36952High 7.8Visual Studio Remote Code Execution Vulnerabilitymicrosoft · visual studio 2017EPSS51%·Published Sep 15, 2021
- CVE-2021-33554High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS59%1 exploitPublished Sep 13, 2021
- CVE-2021-33553High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS51%1 exploitPublished Sep 13, 2021
- CVE-2021-33552High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS51%1 exploitPublished Sep 13, 2021
- CVE-2021-33551High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS51%1 exploitPublished Sep 13, 2021
- CVE-2021-33550High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS59%1 exploitPublished Sep 13, 2021
- CVE-2021-33549High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS67%2 exploitsPublished Sep 13, 2021
- CVE-2021-33548High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS59%1 exploitPublished Sep 13, 2021
- CVE-2021-33544High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS96%1 exploitPublished Sep 13, 2021
- CVE-2021-35217High 8.8Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI.solarwinds · patch managerEPSS73%·Published Sep 8, 2021
- CVE-2021-28560High 8.8Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability.adobe · acrobatEPSS67%·Published Sep 2, 2021
- CVE-2021-35218High 8.8Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution.solarwinds · orion platformEPSS76%·Published Sep 1, 2021
- CVE-2021-35216High 8.8Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module.solarwinds · patch managerEPSS81%·Published Sep 1, 2021
- CVE-2021-35392High 7.5Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.realtek · rtl819x jungle software development kitEPSS83%·Published Aug 16, 2021
- CVE-2021-37343High 8.8A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.nagios · nagios xiEPSS24%2 exploitsPublished Aug 13, 2021
- CVE-2021-34478High 7.8Microsoft Office Remote Code Execution Vulnerabilitymicrosoft · officeEPSS52%·Published Aug 12, 2021
- CVE-2021-32610High 7.1Directory Traversal in Archive_Tarphp · archive tarEPSS73%·Published Aug 9, 2021
- CVE-2021-33256High 8.8A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user.zohocorp · manageengine adselfservice plusEPSS79%·Published Aug 9, 2021
- CVE-2021-32706High 8.8Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics.pi-hole · pi-holeEPSS60%1 exploitPublished Aug 4, 2021
- CVE-2021-34847High 7.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893.foxit · pdf readerEPSS62%·Published Aug 4, 2021
- CVE-2021-34833High 7.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893.foxit · pdf readerEPSS96%·Published Aug 4, 2021
- CVE-2021-36754High 7.5PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception.powerdns · authoritative serverEPSS65%·Published Jul 27, 2021
- CVE-2021-2400High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.oracle · bi publisherEPSS83%·Published Jul 21, 2021
- CVE-2021-34501High 8.8Microsoft Excel Remote Code Execution Vulnerabilitymicrosoft · excelEPSS52%·Published Jul 14, 2021
- CVE-2021-28639High 7.8Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability.adobe · acrobat reader dcEPSS66%·Published Jul 14, 2021
- CVE-2021-28640High 7.3Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability.adobe · acrobat reader dcEPSS53%·Published Jul 14, 2021
- CVE-2021-28635High 7.8Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a use-after-free vulnerability.adobe · acrobat reader dcEPSS51%·Published Jul 14, 2021
- CVE-2021-26690High 7.5Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Serviceapache · http serverEPSS65%·Published Jul 12, 2021
- CVE-2020-35452High 7.3Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest.apache · http serverEPSS55%·Published Jul 12, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-36160 | A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). apache · http server | High 7.5 | 63% | · | |
| CVE-2021-43778 | GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. glpi-project · barcode | High 7.5 | 53% | 1 exploit | |
| CVE-2021-42362 | WordPress Popular Posts <= 5.3.2 - Authenticated Arbitrary File Upload wordpress popular posts project · wordpress popular posts | High 8.8 | 80% | 3 exploits | |
| CVE-2021-3577 | An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device. binatoneglobal · cn28 firmware | High 8.8 | 60% | · | |
| CVE-2021-31602 | The Security Model has different layers of Access Control. hitachi · vantara pentaho | High 7.5 | 52% | 1 exploit | |
| CVE-2021-35215 | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. solarwinds · orion platform | High 8.8 | 70% | · | |
| CVE-2021-40344 | In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. nagios · nagios xi | High 7.2 | 65% | · | |
| CVE-2021-42840 | SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. salesagility · suitecrm | High 8.8 | 59% | 3 exploits | |
| CVE-2021-39352 | The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. catchplugins · catch themes demo import | High 7.2 | 56% | 5 exploits | |
| CVE-2021-40728 | Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result… adobe · acrobat | High 7.8 | 55% | · | |
| CVE-2021-33035 | Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. apache · openoffice | High 7.8 | 51% | · | |
| CVE-2021-40323 | Cobbler before 3.3.0 allows log poisoning cobbler project · cobbler | High 9.3 | 87% | · | |
| CVE-2021-40324 | Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. cobbler project · cobbler | High 8.7 | 69% | · | |
| CVE-2021-41291 | ECOA BAS controller suffers from a path traversal content disclosure vulnerability. ecoa · riskterminator | High 7.5 | 83% | · | |
| CVE-2021-39843 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. adobe · acrobat | High 7.8 | 77% | · | |
| CVE-2021-39840 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForms that could result in arbitrary code execution in the context of the current user. adobe · acrobat | High 7.8 | 51% | · | |
| CVE-2021-39839 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm getItem action that could result in arbitrary code execution in the context of… adobe · acrobat | High 7.8 | 65% | · | |
| CVE-2021-39838 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetCaption action that could result in arbitrary code execution in the… adobe · acrobat | High 7.8 | 65% | · | |
| CVE-2021-39837 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm deleteItemAt action that could result in arbitrary code execution in the… adobe · acrobat | High 7.8 | 65% | · | |
| CVE-2021-39836 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the… adobe · acrobat | High 7.8 | 70% | · | |
| CVE-2021-41381 | Payara Micro Community 5.2021.6 and below allows Directory Traversal. payara · micro community | High 7.5 | 53% | 4 exploits | |
| CVE-2021-36952 | Visual Studio Remote Code Execution Vulnerability microsoft · visual studio 2017 | High 7.8 | 51% | · | |
| CVE-2021-33554 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 59% | 1 exploit | |
| CVE-2021-33553 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 51% | 1 exploit | |
| CVE-2021-33552 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 51% | 1 exploit | |
| CVE-2021-33551 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 51% | 1 exploit | |
| CVE-2021-33550 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 59% | 1 exploit | |
| CVE-2021-33549 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 67% | 2 exploits | |
| CVE-2021-33548 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 59% | 1 exploit | |
| CVE-2021-33544 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 96% | 1 exploit | |
| CVE-2021-35217 | Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. solarwinds · patch manager | High 8.8 | 73% | · | |
| CVE-2021-28560 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability. adobe · acrobat | High 8.8 | 67% | · | |
| CVE-2021-35218 | Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. solarwinds · orion platform | High 8.8 | 76% | · | |
| CVE-2021-35216 | Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. solarwinds · patch manager | High 8.8 | 81% | · | |
| CVE-2021-35392 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. realtek · rtl819x jungle software development kit | High 7.5 | 83% | · | |
| CVE-2021-37343 | A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios. nagios · nagios xi | High 8.8 | 24% | 2 exploits | |
| CVE-2021-34478 | Microsoft Office Remote Code Execution Vulnerability microsoft · office | High 7.8 | 52% | · | |
| CVE-2021-32610 | Directory Traversal in Archive_Tar php · archive tar | High 7.1 | 73% | · | |
| CVE-2021-33256 | A CSV injection vulnerability on the login panel of ManageEngine ADSelfService Plus Version: 6.1 Build No: 6101 can be exploited by an unauthenticated user. zohocorp · manageengine adselfservice plus | High 8.8 | 79% | · | |
| CVE-2021-32706 | Pi-hole's Web interface provides a central location to manage a Pi-hole instance and review performance statistics. pi-hole · pi-hole | High 8.8 | 60% | 1 exploit | |
| CVE-2021-34847 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. foxit · pdf reader | High 7.8 | 62% | · | |
| CVE-2021-34833 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Foxit PDF Reader 11.0.0.49893. foxit · pdf reader | High 7.8 | 96% | · | |
| CVE-2021-36754 | PowerDNS Authoritative Server 4.5.0 before 4.5.1 allows anybody to crash the process by sending a specific query (QTYPE 65535) that causes an out-of-bounds exception. powerdns · authoritative server | High 7.5 | 65% | · | |
| CVE-2021-2400 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. oracle · bi publisher | High 7.5 | 83% | · | |
| CVE-2021-34501 | Microsoft Excel Remote Code Execution Vulnerability microsoft · excel | High 8.8 | 52% | · | |
| CVE-2021-28639 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. adobe · acrobat reader dc | High 7.8 | 66% | · | |
| CVE-2021-28640 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Use-after-free vulnerability. adobe · acrobat reader dc | High 7.3 | 53% | · | |
| CVE-2021-28635 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a use-after-free vulnerability. adobe · acrobat reader dc | High 7.8 | 51% | · | |
| CVE-2021-26690 | Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Cookie header handled by mod_session can cause a NULL pointer dereference and crash, leading to a possible Denial Of Service apache · http server | High 7.5 | 65% | · | |
| CVE-2020-35452 | Apache HTTP Server versions 2.4.0 to 2.4.46 A specially crafted Digest nonce can cause a stack overflow in mod_auth_digest. apache · http server | High 7.3 | 55% | · |
Showing 501–550 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.