Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2021-22992Critical 9.8On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy…f5 · big-ip access policy managerEPSS73%·Published Mar 31, 2021
- CVE-2020-7774Critical 9.8Prototype Pollution in y18ny18n project · y18nEPSS69%·Published Mar 29, 2021
- CVE-2021-21346Critical 9.8XStream is vulnerable to an Arbitrary Code Execution attackxstream · xstreamEPSS76%·Published Mar 22, 2021
- CVE-2021-26295Critical 9.8Apache OFBiz has unsafe deserialization prior to 17.12.06.apache · ofbizEPSS98%2 exploitsPublished Mar 22, 2021
- CVE-2021-21978Critical 9.8VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability.vmware · view plannerEPSS99%2 exploitsPublished Mar 5, 2021
- CVE-2021-26120Critical 9.8PHP Code Injection by malicious function name in smartysmarty · smartyEPSS82%·Published Feb 26, 2021
- CVE-2021-27670Critical 9.8Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.appspace · appspaceEPSS61%1 exploitPublished Feb 24, 2021
- CVE-2016-2842Critical 9.8The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly…openssl · opensslEPSS54%·Published Feb 24, 2021
- CVE-2015-7501Critical 9.8Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform…redhat · data gridEPSS86%·Published Feb 23, 2021
- CVE-2021-26747Critical 9.8Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution.netis-systems · wf2411 firmwareEPSS55%1 exploitPublished Feb 18, 2021
- CVE-2020-27868Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395.qognify · ocularisEPSS82%·Published Feb 11, 2021
- CVE-2021-21307Critical 9.8In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit.lucee · lucee serverEPSS89%3 exploitsPublished Feb 11, 2021
- CVE-2021-22652Critical 9.8Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution.advantech · iviewEPSS37%2 exploitsPublished Feb 11, 2021
- CVE-2020-28871Critical 9.8Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload.monitorr · monitorrEPSS86%3 exploitsPublished Feb 9, 2021
- CVE-2020-13117Critical 9.8Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request.wavlink · wn575a4 firmwareEPSS69%·Published Feb 9, 2021
- CVE-2021-3122Critical 9.8CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020…ncr · command center agentEPSS87%1 exploitPublished Feb 7, 2021
- CVE-2020-28653Critical 9.8Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet.zohocorp · manageengine opmanagerEPSS79%2 exploitsPublished Feb 3, 2021
- CVE-2020-17523Critical 9.8shiro: Authentication bypass through specially crafted HTTP requestapache · shiroEPSS86%·Published Feb 2, 2021
- CVE-2021-3378Critical 9.8FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp.fortilogger · fortiloggerEPSS98%5 exploitsPublished Feb 1, 2021
- CVE-2020-14756Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence.oracle · coherenceEPSS75%·Published Jan 20, 2021
- CVE-2021-21242Critical 9.8In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution.onedev project · onedevEPSS74%·Published Jan 15, 2021
- CVE-2021-21243Critical 9.8In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body.onedev project · onedevEPSS54%·Published Jan 15, 2021
- CVE-2020-35131Critical 9.8Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI.agentejo · cockpitEPSS50%1 exploitPublished Jan 8, 2021
- CVE-2018-10933Critical 9.1libssh - security updatelibssh · libsshEPSS92%3 exploitsPublished Jan 8, 2021
- CVE-2020-35951Critical 9.9It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control.expresstech · quiz and survey masterEPSS76%·Published Jan 1, 2021
- CVE-2020-35848Critical 9.8Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.agentejo · cockpitEPSS75%2 exploitsPublished Dec 29, 2020
- CVE-2020-35847Critical 9.8Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.agentejo · cockpitEPSS98%4 exploitsPublished Dec 29, 2020
- CVE-2020-35846Critical 9.8Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.agentejo · cockpitEPSS93%2 exploitsPublished Dec 29, 2020
- CVE-2020-35729Critical 9.8KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.klogserver · klog serverEPSS88%8 exploitsPublished Dec 27, 2020
- CVE-2020-28188Critical 9.8Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.terra-master · tosEPSS96%1 exploitPublished Dec 24, 2020
- CVE-2020-35665Critical 9.8An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.terra-master · terramaster operating systemEPSS78%2 exploitsPublished Dec 23, 2020
- CVE-2020-7200Critical 9.8A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6.hp · systems insight managerEPSS82%2 exploitsPublished Dec 18, 2020
- CVE-2020-8466Critical 9.8A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.trendmicro · interscan web security virtual applianceEPSS64%·Published Dec 17, 2020
- CVE-2020-35489Critical 10.0The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.rocklobster · contact form 7EPSS89%·Published Dec 17, 2020
- CVE-2020-25110Critical 9.8The length byte of a domain name in a DNS query/response is not checked, and is used for internal memory operations.ethernut · nut\/osEPSS54%·Published Dec 11, 2020
- CVE-2020-25109Critical 9.8The number of DNS queries/responses (set in a DNS header) is not checked against the data present.ethernut · nut\/osEPSS54%·Published Dec 11, 2020
- CVE-2020-25108Critical 9.8The DNS response data length is not checked (it can be set to an arbitrary value from a packet).ethernut · nut\/osEPSS54%·Published Dec 11, 2020
- CVE-2020-25107Critical 9.8There is no check on whether a domain name has '\0' termination.ethernut · nut\/osEPSS54%·Published Dec 11, 2020
- CVE-2020-24336Critical 9.8The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane.contiki-ng · contiki-ngEPSS59%·Published Dec 11, 2020
- CVE-2020-17132Critical 9.1Microsoft Exchange Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS90%1 exploitPublished Dec 9, 2020
- CVE-2020-29597Critical 9.8IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability.incomcms project · incomcmsEPSS71%3 exploitsPublished Dec 7, 2020
- CVE-2020-11984Critical 9.8Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCEapache · http serverEPSS90%1 exploitPublished Dec 4, 2020
- CVE-2020-29279Critical 9.8PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.74cms · 74cmsEPSS53%1 exploitPublished Dec 2, 2020
- CVE-2020-28578Critical 9.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.trendmicro · interscan web security virtual applianceEPSS73%·Published Nov 18, 2020
- CVE-2020-27131Critical 9.8Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device.cisco · security managerEPSS88%·Published Nov 17, 2020
- CVE-2020-27130Critical 9.1A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information.cisco · security managerEPSS66%·Published Nov 17, 2020
- CVE-2020-13638Critical 9.8lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.rconfig · rconfigEPSS77%·Published Nov 13, 2020
- CVE-2020-24719Critical 9.8Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack.couchbase · couchbase serverEPSS23%1 exploitPublished Nov 12, 2020
- CVE-2020-28347Critical 9.8tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter.tp-link · ac1750 firmwareEPSS75%5 exploitsPublished Nov 8, 2020
- CVE-2020-26214Critical 9.3LDAP authentication bypass with empty passwordalerta project · alertaEPSS66%·Published Nov 6, 2020
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-22992 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy… f5 · big-ip access policy manager | Critical 9.8 | 73% | · | |
| CVE-2020-7774 | Prototype Pollution in y18n y18n project · y18n | Critical 9.8 | 69% | · | |
| CVE-2021-21346 | XStream is vulnerable to an Arbitrary Code Execution attack xstream · xstream | Critical 9.8 | 76% | · | |
| CVE-2021-26295 | Apache OFBiz has unsafe deserialization prior to 17.12.06. apache · ofbiz | Critical 9.8 | 98% | 2 exploits | |
| CVE-2021-21978 | VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. vmware · view planner | Critical 9.8 | 99% | 2 exploits | |
| CVE-2021-26120 | PHP Code Injection by malicious function name in smarty smarty · smarty | Critical 9.8 | 82% | · | |
| CVE-2021-27670 | Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. appspace · appspace | Critical 9.8 | 61% | 1 exploit | |
| CVE-2016-2842 | The doapr_outch function in crypto/bio/b_print.c in OpenSSL 1.0.1 before 1.0.1s and 1.0.2 before 1.0.2g does not verify that a certain memory allocation succeeds, which allows remote attackers to cause a denial of service (out-of-bounds write or memory consumption) or possibly… openssl · openssl | Critical 9.8 | 54% | · | |
| CVE-2015-7501 | Red Hat JBoss A-MQ 6.x; BPM Suite (BPMS) 6.x; BRMS 6.x and 5.x; Data Grid (JDG) 6.x; Data Virtualization (JDV) 6.x and 5.x; Enterprise Application Platform 6.x, 5.x, and 4.3.x; Fuse 6.x; Fuse Service Works (FSW) 6.x; Operations Network (JBoss ON) 3.x; Portal 6.x; SOA Platform… redhat · data grid | Critical 9.8 | 86% | · | |
| CVE-2021-26747 | Netis WF2780 2.3.40404 and WF2411 1.1.29629 devices allow Shell Metacharacter Injection into the ping command, leading to remote code execution. netis-systems · wf2411 firmware | Critical 9.8 | 55% | 1 exploit | |
| CVE-2020-27868 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Qognify Ocularis 5.9.0.395. qognify · ocularis | Critical 9.8 | 82% | · | |
| CVE-2021-21307 | In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.96 there is an unauthenticated remote code exploit. lucee · lucee server | Critical 9.8 | 89% | 3 exploits | |
| CVE-2021-22652 | Access to the Advantech iView versions prior to v5.7.03.6112 configuration are missing authentication, which may allow an unauthorized attacker to change the configuration and obtain code execution. advantech · iview | Critical 9.8 | 37% | 2 exploits | |
| CVE-2020-28871 | Remote code execution in Monitorr v1.7.6m in upload.php allows an unauthorized person to execute arbitrary code on the server-side via an insecure file upload. monitorr · monitorr | Critical 9.8 | 86% | 3 exploits | |
| CVE-2020-13117 | Wavlink WN575A4, WN579X3, and WN530G3A devices through 2020-05-15 allow unauthenticated remote users to inject commands via the key parameter in a login request. wavlink · wn575a4 firmware | Critical 9.8 | 69% | · | |
| CVE-2021-3122 | CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter (within an XML document sent to port 8089) that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020… ncr · command center agent | Critical 9.8 | 87% | 1 exploit | |
| CVE-2020-28653 | Zoho ManageEngine OpManager Stable build before 125203 (and Released build before 125233) allows Remote Code Execution via the Smart Update Manager (SUM) servlet. zohocorp · manageengine opmanager | Critical 9.8 | 79% | 2 exploits | |
| CVE-2020-17523 | shiro: Authentication bypass through specially crafted HTTP request apache · shiro | Critical 9.8 | 86% | · | |
| CVE-2021-3378 | FortiLogger 4.4.2.2 is affected by Arbitrary File Upload by sending a "Content-Type: image/png" header to Config/SaveUploadedHotspotLogoFile and then visiting Assets/temp/hotspot/img/logohotspot.asp. fortilogger · fortilogger | Critical 9.8 | 98% | 5 exploits | |
| CVE-2020-14756 | Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP, T3 to compromise Oracle Coherence. oracle · coherence | Critical 9.8 | 75% | · | |
| CVE-2021-21242 | In OneDev before version 4.0.3, there is a critical vulnerability which can lead to pre-auth remote code execution. onedev project · onedev | Critical 9.8 | 74% | · | |
| CVE-2021-21243 | In OneDev before version 4.0.3, a Kubernetes REST endpoint exposes two methods that deserialize untrusted data from the request body. onedev project · onedev | Critical 9.8 | 54% | · | |
| CVE-2020-35131 | Cockpit before 0.6.1 allows an attacker to inject custom PHP code and achieve Remote Command Execution via registerCriteriaFunction in lib/MongoLite/Database.php, as demonstrated by values in JSON data to the /auth/check or /auth/requestreset URI. agentejo · cockpit | Critical 9.8 | 50% | 1 exploit | |
| CVE-2018-10933 | libssh - security update libssh · libssh | Critical 9.1 | 92% | 3 exploits | |
| CVE-2020-35951 | It allows users to delete arbitrary files such as wp-config.php file, which could effectively take a site offline and allow an attacker to reinstall with a WordPress instance under their control. expresstech · quiz and survey master | Critical 9.9 | 76% | · | |
| CVE-2020-35848 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. agentejo · cockpit | Critical 9.8 | 75% | 2 exploits | |
| CVE-2020-35847 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. agentejo · cockpit | Critical 9.8 | 98% | 4 exploits | |
| CVE-2020-35846 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. agentejo · cockpit | Critical 9.8 | 93% | 2 exploits | |
| CVE-2020-35729 | KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter. klogserver · klog server | Critical 9.8 | 88% | 8 exploits | |
| CVE-2020-28188 | Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter. terra-master · tos | Critical 9.8 | 96% | 1 exploit | |
| CVE-2020-35665 | An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation. terra-master · terramaster operating system | Critical 9.8 | 78% | 2 exploits | |
| CVE-2020-7200 | A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. hp · systems insight manager | Critical 9.8 | 82% | 2 exploits | |
| CVE-2020-8466 | A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password. trendmicro · interscan web security virtual appliance | Critical 9.8 | 64% | · | |
| CVE-2020-35489 | The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters. rocklobster · contact form 7 | Critical 10.0 | 89% | · | |
| CVE-2020-25110 | The length byte of a domain name in a DNS query/response is not checked, and is used for internal memory operations. ethernut · nut\/os | Critical 9.8 | 54% | · | |
| CVE-2020-25109 | The number of DNS queries/responses (set in a DNS header) is not checked against the data present. ethernut · nut\/os | Critical 9.8 | 54% | · | |
| CVE-2020-25108 | The DNS response data length is not checked (it can be set to an arbitrary value from a packet). ethernut · nut\/os | Critical 9.8 | 54% | · | |
| CVE-2020-25107 | There is no check on whether a domain name has '\0' termination. ethernut · nut\/os | Critical 9.8 | 54% | · | |
| CVE-2020-24336 | The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. contiki-ng · contiki-ng | Critical 9.8 | 59% | · | |
| CVE-2020-17132 | Microsoft Exchange Remote Code Execution Vulnerability microsoft · exchange server | Critical 9.1 | 90% | 1 exploit | |
| CVE-2020-29597 | IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. incomcms project · incomcms | Critical 9.8 | 71% | 3 exploits | |
| CVE-2020-11984 | Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE apache · http server | Critical 9.8 | 90% | 1 exploit | |
| CVE-2020-29279 | PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution. 74cms · 74cms | Critical 9.8 | 53% | 1 exploit | |
| CVE-2020-28578 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. trendmicro · interscan web security virtual appliance | Critical 9.8 | 73% | · | |
| CVE-2020-27131 | Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. cisco · security manager | Critical 9.8 | 88% | · | |
| CVE-2020-27130 | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. cisco · security manager | Critical 9.1 | 66% | · | |
| CVE-2020-13638 | lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. rconfig · rconfig | Critical 9.8 | 77% | · | |
| CVE-2020-24719 | Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. couchbase · couchbase server | Critical 9.8 | 23% | 1 exploit | |
| CVE-2020-28347 | tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. tp-link · ac1750 firmware | Critical 9.8 | 75% | 5 exploits | |
| CVE-2020-26214 | LDAP authentication bypass with empty password alerta project · alerta | Critical 9.3 | 66% | · |
Showing 551–600 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.