Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2023-34124Critical 9.8The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass.sonicwall · analyticsEPSS50%1 exploitPublished Jul 13, 2023
- CVE-2023-3643Critical 9.8It has been classified as critical.carel · boss mini firmwareEPSS75%1 exploitPublished Jul 12, 2023
- CVE-2023-37582Critical 9.8RocketMQ NameServer component Code Injection vulnerabilityapache · rocketmqEPSS90%·Published Jul 12, 2023
- CVE-2023-36824High 8.8In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution.redis · redisEPSS77%·Published Jul 11, 2023
- CVE-2023-24488Medium 6.1Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scriptingcitrix · gatewayEPSS81%·Published Jul 11, 2023
- CVE-2023-1183Medium 5.5An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker.libreoffice · libreofficeEPSS65%·Published Jul 10, 2023
- CVE-2023-22249Low 4.8Magento Open Source allows Cross-Site Scripting (XSS)adobe · commerceEPSS58%·Published Jul 6, 2023
- CVE-2022-24697Critical 9.8Apache Kylin vulnerable to remote code executionapache · kylinEPSS85%·Published Jul 6, 2023
- CVE-2023-36969High 8.8CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.cmsmadesimple · cms made simpleEPSS49%1 exploitPublished Jul 6, 2023
- CVE-2023-36934Critical 9.1In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated…progress · moveit transferEPSS95%·Published Jul 6, 2023
- CVE-2023-36932High 8.1In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an…progress · moveit transferEPSS81%·Published Jul 6, 2023
- CVE-2023-36933High 7.5In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception.progress · moveit transferEPSS72%·Published Jul 6, 2023
- CVE-2023-36808Critical 9.8Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack.glpi-project · glpiEPSS52%·Published Jul 5, 2023
- CVE-2023-35924Critical 9.8Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack.glpi-project · glpiEPSS52%·Published Jul 5, 2023
- CVE-2023-3460Critical 9.8The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will.ultimatemember · ultimate memberEPSS72%1 exploitPublished Jul 4, 2023
- CVE-2023-36469High 8.8XWiki Platform vulnerable to Code injection through NotificationRSSServicexwiki · xwikiEPSS82%·Published Jun 30, 2023
- CVE-2023-3450High 7.2The manipulation leads to os command injection.ruijie · rg-bcr860 firmwareEPSS51%1 exploitPublished Jun 28, 2023
- CVE-2023-2068Critical 9.8The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode.advancedfilemanager · file manager advanced shortcodeEPSS40%3 exploitsPublished Jun 27, 2023
- CVE-2023-3420High 8.8Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.google · chromeEPSS56%·Published Jun 26, 2023
- CVE-2023-32521Critical 9.1A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files.trendmicro · mobile securityEPSS67%·Published Jun 26, 2023
- CVE-2023-30258Critical 9.8Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.magnussolution · magnusbillingEPSS94%2 exploitsPublished Jun 23, 2023
- CVE-2023-29711Critical 9.8An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.interlink · psg-5124 firmwareEPSS70%1 exploitPublished Jun 22, 2023
- CVE-2023-35166High 8.8XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanelxwiki · xwikiEPSS62%·Published Jun 20, 2023
- CVE-2023-35885Critical 9.8CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.mgt-commerce · cloudpanelEPSS75%1 exploitPublished Jun 20, 2023
- CVE-2023-35150High 8.0XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation applicationxwiki · xwikiEPSS78%·Published Jun 20, 2023
- CVE-2018-1160Critical 9.8Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.netatalk · netatalkEPSS87%7 exploitsPublished Jun 20, 2023
- CVE-2023-35813Critical 9.8Multiple Sitecore products allow remote code execution.sitecore · experience commerceEPSS87%·Published Jun 17, 2023
- CVE-2023-35708Critical 9.8In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain…progress · moveit transferEPSS97%·Published Jun 16, 2023
- CVE-2023-32031High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS81%·Published Jun 15, 2023
- CVE-2023-32029High 7.8Microsoft Excel Remote Code Execution Vulnerabilitymicrosoft · excelEPSS54%·Published Jun 14, 2023
- CVE-2023-3224Critical 9.2nuxt Code Injection vulnerabilitynuxt · nuxtEPSS59%·Published Jun 13, 2023
- CVE-2023-34468High 8.8Apache NiFi vulnerable to Code Injectionapache · nifiEPSS62%1 exploitPublished Jun 12, 2023
- CVE-2023-33625Critical 9.8D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function.dlink · dir-600 firmwareEPSS33%3 exploitsPublished Jun 12, 2023
- CVE-2023-34096High 8.8In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system.thruk · thrukEPSS63%6 exploitsPublished Jun 8, 2023
- CVE-2023-20888High 8.8Aria Operations for Networks contains an authenticated deserialization vulnerability.vmware · vrealize network insightEPSS82%·Published Jun 8, 2023
- CVE-2023-20889High 7.5Aria Operations for Networks contains an information disclosure vulnerability.vmware · vrealize network insightEPSS79%·Published Jun 8, 2023
- CVE-2023-0921Medium 4.3A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage.gitlab · gitlabEPSS84%·Published Jun 7, 2023
- CVE-2023-2442Medium 5.4A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims.gitlab · gitlabEPSS96%·Published Jun 7, 2023
- CVE-2023-34220Medium 5.4In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possiblejetbrains · teamcityEPSS61%·Published Jun 2, 2023
- CVE-2023-34225Medium 5.4In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possiblejetbrains · teamcityEPSS61%·Published Jun 2, 2023
- CVE-2023-32707High 8.8In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing…splunk · splunk cloud platformEPSS79%2 exploitsPublished Jun 1, 2023
- CVE-2023-28651Medium 4.8Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3.contec · conprosys hmi systemEPSS62%·Published May 31, 2023
- CVE-2023-2249High 8.8wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contentsgvectors · wpforo forumEPSS61%·Published May 31, 2023
- CVE-2023-2650Medium 6.5Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow.openssl · opensslEPSS75%·Published May 30, 2023
- CVE-2023-30253High 8.8Dolibarr vulnerable to remote code execution via uppercase manipulationdolibarr · dolibarr erp\/crmEPSS82%1 exploitPublished May 30, 2023
- CVE-2023-2948Medium 6.1Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1.open-emr · openemrEPSS97%·Published May 28, 2023
- CVE-2023-2947Medium 4.8Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1.open-emr · openemrEPSS90%·Published May 27, 2023
- CVE-2023-2928High 8.8It has been declared as critical.dedecms · dedecmsEPSS51%·Published May 27, 2023
- CVE-2023-2825High 7.5An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.gitlab · gitlabEPSS72%·Published May 24, 2023
- CVE-2023-2732Critical 9.8MStore API <= 3.9.2 - Authentication Bypassinspireui · mstore apiEPSS67%·Published May 23, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-34124 | The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. sonicwall · analytics | Critical 9.8 | 50% | 1 exploit | |
| CVE-2023-3643 | It has been classified as critical. carel · boss mini firmware | Critical 9.8 | 75% | 1 exploit | |
| CVE-2023-37582 | RocketMQ NameServer component Code Injection vulnerability apache · rocketmq | Critical 9.8 | 90% | · | |
| CVE-2023-36824 | In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. redis · redis | High 8.8 | 77% | · | |
| CVE-2023-24488 | Cross site scripting vulnerability in Citrix ADC and Citrix Gateway in allows and attacker to perform cross site scripting citrix · gateway | Medium 6.1 | 81% | · | |
| CVE-2023-1183 | An attacker can craft an odb containing a "database/script" file with a SCRIPT command where the contents of the file could be written to a new file whose location was determined by the attacker. libreoffice · libreoffice | Medium 5.5 | 65% | · | |
| CVE-2023-22249 | Magento Open Source allows Cross-Site Scripting (XSS) adobe · commerce | Low 4.8 | 58% | · | |
| CVE-2022-24697 | Apache Kylin vulnerable to remote code execution apache · kylin | Critical 9.8 | 85% | · | |
| CVE-2023-36969 | CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. cmsmadesimple · cms made simple | High 8.8 | 49% | 1 exploit | |
| CVE-2023-36934 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated… progress · moveit transfer | Critical 9.1 | 95% | · | |
| CVE-2023-36932 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an… progress · moveit transfer | High 8.1 | 81% | · | |
| CVE-2023-36933 | In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. progress · moveit transfer | High 7.5 | 72% | · | |
| CVE-2023-36808 | Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. glpi-project · glpi | Critical 9.8 | 52% | · | |
| CVE-2023-35924 | Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. glpi-project · glpi | Critical 9.8 | 52% | · | |
| CVE-2023-3460 | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. ultimatemember · ultimate member | Critical 9.8 | 72% | 1 exploit | |
| CVE-2023-36469 | XWiki Platform vulnerable to Code injection through NotificationRSSService xwiki · xwiki | High 8.8 | 82% | · | |
| CVE-2023-3450 | The manipulation leads to os command injection. ruijie · rg-bcr860 firmware | High 7.2 | 51% | 1 exploit | |
| CVE-2023-2068 | The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. advancedfilemanager · file manager advanced shortcode | Critical 9.8 | 40% | 3 exploits | |
| CVE-2023-3420 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. google · chrome | High 8.8 | 56% | · | |
| CVE-2023-32521 | A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files. trendmicro · mobile security | Critical 9.1 | 67% | · | |
| CVE-2023-30258 | Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. magnussolution · magnusbilling | Critical 9.8 | 94% | 2 exploits | |
| CVE-2023-29711 | An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. interlink · psg-5124 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2023-35166 | XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanel xwiki · xwiki | High 8.8 | 62% | · | |
| CVE-2023-35885 | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. mgt-commerce · cloudpanel | Critical 9.8 | 75% | 1 exploit | |
| CVE-2023-35150 | XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application xwiki · xwiki | High 8.0 | 78% | · | |
| CVE-2018-1160 | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. netatalk · netatalk | Critical 9.8 | 87% | 7 exploits | |
| CVE-2023-35813 | Multiple Sitecore products allow remote code execution. sitecore · experience commerce | Critical 9.8 | 87% | · | |
| CVE-2023-35708 | In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain… progress · moveit transfer | Critical 9.8 | 97% | · | |
| CVE-2023-32031 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 81% | · | |
| CVE-2023-32029 | Microsoft Excel Remote Code Execution Vulnerability microsoft · excel | High 7.8 | 54% | · | |
| CVE-2023-3224 | nuxt Code Injection vulnerability nuxt · nuxt | Critical 9.2 | 59% | · | |
| CVE-2023-34468 | Apache NiFi vulnerable to Code Injection apache · nifi | High 8.8 | 62% | 1 exploit | |
| CVE-2023-33625 | D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function. dlink · dir-600 firmware | Critical 9.8 | 33% | 3 exploits | |
| CVE-2023-34096 | In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. thruk · thruk | High 8.8 | 63% | 6 exploits | |
| CVE-2023-20888 | Aria Operations for Networks contains an authenticated deserialization vulnerability. vmware · vrealize network insight | High 8.8 | 82% | · | |
| CVE-2023-20889 | Aria Operations for Networks contains an information disclosure vulnerability. vmware · vrealize network insight | High 7.5 | 79% | · | |
| CVE-2023-0921 | A lack of length validation in GitLab CE/EE affecting all versions from 8.3 before 15.10.8, 15.11 before 15.11.7, and 16.0 before 16.0.2 allows an authenticated attacker to create a large Issue description via GraphQL which, when repeatedly requested, saturates CPU usage. gitlab · gitlab | Medium 4.3 | 84% | · | |
| CVE-2023-2442 | A specially crafted merge request could lead to a stored XSS on the client side which allows attackers to perform arbitrary actions on behalf of victims. gitlab · gitlab | Medium 5.4 | 96% | · | |
| CVE-2023-34220 | In JetBrains TeamCity before 2023.05 stored XSS in the Commit Status Publisher window was possible jetbrains · teamcity | Medium 5.4 | 61% | · | |
| CVE-2023-34225 | In JetBrains TeamCity before 2023.05 stored XSS in the NuGet feed page was possible jetbrains · teamcity | Medium 5.4 | 61% | · | |
| CVE-2023-32707 | In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing… splunk · splunk cloud platform | High 8.8 | 79% | 2 exploits | |
| CVE-2023-28651 | Cross-site scripting vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. contec · conprosys hmi system | Medium 4.8 | 62% | · | |
| CVE-2023-2249 | wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents gvectors · wpforo forum | High 8.8 | 61% | · | |
| CVE-2023-2650 | Issue summary: Processing some specially crafted ASN.1 object identifiers or data containing them may be very slow. openssl · openssl | Medium 6.5 | 75% | · | |
| CVE-2023-30253 | Dolibarr vulnerable to remote code execution via uppercase manipulation dolibarr · dolibarr erp\/crm | High 8.8 | 82% | 1 exploit | |
| CVE-2023-2948 | Cross-site Scripting (XSS) - Generic in GitHub repository openemr/openemr prior to 7.0.1. open-emr · openemr | Medium 6.1 | 97% | · | |
| CVE-2023-2947 | Cross-site Scripting (XSS) - Stored in GitHub repository openemr/openemr prior to 7.0.1. open-emr · openemr | Medium 4.8 | 90% | · | |
| CVE-2023-2928 | It has been declared as critical. dedecms · dedecms | High 8.8 | 51% | · | |
| CVE-2023-2825 | An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups. gitlab · gitlab | High 7.5 | 72% | · | |
| CVE-2023-2732 | MStore API <= 3.9.2 - Authentication Bypass inspireui · mstore api | Critical 9.8 | 67% | · |
Showing 551–600 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.