Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2021-31618High 7.5Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well.apache · http serverEPSS51%·Published Jul 12, 2021
- CVE-2021-30117High 8.8The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId.kaseya · vsaEPSS72%·Published Jul 9, 2021
- CVE-2021-24145High 7.2Modern Events Calendar Lite <= 5.16.4 - Authenticated Arbitrary File Upload leading to Remote Code Executionwebnus · modern events calendar liteEPSS87%4 exploitsPublished Jul 5, 2021
- CVE-2021-24347High 8.8SP Project & Document Manager <= 4.21 - Authenticated Shell Uploadsmartypantsplugins · sp project \& document managerEPSS54%3 exploitsPublished Jun 15, 2021
- CVE-2021-20081High 7.2Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges.zohocorp · manageengine servicedesk plusEPSS52%·Published Jun 10, 2021
- CVE-2021-33393High 8.8lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account.ipfire · ipfireEPSS59%4 exploitsPublished Jun 9, 2021
- CVE-2021-3277High 7.2Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.nagios · nagios xiEPSS55%·Published Jun 7, 2021
- CVE-2020-8450High 7.3squid3 - security updatesquid-cache · squidEPSS72%·Published Jun 7, 2021
- CVE-2021-3490High 7.8The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution.linux · linux kernelEPSS27%2 exploitsPublished Jun 4, 2021
- CVE-2021-22123High 8.8An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page.fortinet · fortiwebEPSS84%·Published Jun 1, 2021
- CVE-2021-29492High 8.3Envoy does not decode escaped slash sequences %2F and %5C in HTTP URL paths in versions 1.18.2 and before.envoyproxy · envoyEPSS66%·Published May 28, 2021
- CVE-2021-22908High 8.8A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user.ivanti · connect secureEPSS69%·Published May 27, 2021
- CVE-2021-24307High 8.8The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host.aioseo · all in one seoEPSS53%·Published May 24, 2021
- CVE-2021-29505High 8.8XStream is vulnerable to a Remote Command Execution attackxstream · xstreamEPSS77%·Published May 18, 2021
- CVE-2021-32819High 8.8Insecure template handling in Squirrellysquirrelly · squirrellyEPSS58%·Published May 17, 2021
- CVE-2021-31213High 7.8Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerabilitymicrosoft · remoteEPSS53%·Published May 11, 2021
- CVE-2021-31195High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS74%·Published May 11, 2021
- CVE-2021-31181High 8.8Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint enterprise serverEPSS29%2 exploitsPublished May 11, 2021
- CVE-2021-28474High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS51%·Published May 11, 2021
- CVE-2021-27068High 8.8Visual Studio Remote Code Execution Vulnerabilitymicrosoft · visual studio 2019EPSS54%·Published May 11, 2021
- CVE-2021-28966High 7.5Tempfile on Windows path traversal vulnerabilityruby-lang · rubyEPSS58%·Published May 6, 2021
- CVE-2017-16944High 7.5The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the…exim · eximEPSS63%1 exploitPublished May 5, 2021
- CVE-2020-28019High 7.5Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences.exim · eximEPSS62%·Published May 5, 2021
- CVE-2020-8277High 7.5A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses.nodejs · node.jsEPSS54%·Published May 3, 2021
- CVE-2021-29442High 7.5Authentication bypass for specific endpointalibaba · nacosEPSS66%2 exploitsPublished Apr 27, 2021
- CVE-2020-5791High 7.2Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.nagios · nagios xiEPSS79%4 exploitsPublished Apr 21, 2021
- CVE-2019-0232High 8.1tomcat: Remote Code Execution on Windowsapache · tomcatEPSS100%2 exploitsPublished Apr 21, 2021
- CVE-2021-2190High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline.oracle · sales offlineEPSS93%·Published Apr 21, 2021
- CVE-2021-2198High 8.2Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management.oracle · knowledge managementEPSS80%·Published Apr 21, 2021
- CVE-2019-0233High 7.5struts2: access permission override when performing a file upload leads to DoSapache · strutsEPSS66%·Published Apr 21, 2021
- CVE-2020-1967High 7.5Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension.openssl · opensslEPSS53%·Published Apr 21, 2021
- CVE-2021-27030High 7.8A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system.autodesk · fbx reviewEPSS60%·Published Apr 19, 2021
- CVE-2021-3017High 7.5The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.intelbras · win 300 firmwareEPSS63%·Published Apr 14, 2021
- CVE-2021-28482High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS83%Ransomware1 actorPublished Apr 14, 2021
- CVE-2021-28472High 7.8Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerabilitymicrosoft · vscode-mavenEPSS62%·Published Apr 13, 2021
- CVE-2021-28165High 7.5Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resourceseclipse · jettyEPSS54%·Published Apr 6, 2021
- CVE-2021-24155High 7.2The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.backup-guard · backup guardEPSS84%4 exploitsPublished Apr 5, 2021
- CVE-2020-9490High 7.5Apache HTTP Server versions 2.4.20 to 2.4.43.apache · http serverEPSS89%·Published Apr 5, 2021
- CVE-2021-27273High 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26.netgear · prosafe network management systemEPSS66%·Published Mar 30, 2021
- CVE-2021-27276High 7.1This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26.netgear · prosafe network management systemEPSS73%·Published Mar 29, 2021
- CVE-2021-27275High 8.3This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26.netgear · prosafe network management systemEPSS74%·Published Mar 29, 2021
- CVE-2021-27272High 7.1This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26.netgear · prosafe network management systemEPSS75%·Published Mar 29, 2021
- CVE-2021-29156High 7.5ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.forgerock · openamEPSS77%1 exploitPublished Mar 25, 2021
- CVE-2021-21341High 7.5XStream can cause a Denial of Service.xstream · xstreamEPSS78%·Published Mar 22, 2021
- CVE-2021-27084High 7.8Visual Studio Code Java Extension Pack Remote Code Execution Vulnerabilitymicrosoft · visual studio codeEPSS62%·Published Mar 11, 2021
- CVE-2021-27083High 7.8Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerabilitymicrosoft · remote developmentEPSS62%·Published Mar 11, 2021
- CVE-2021-21300High 7.5In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS…git-scm · gitEPSS89%2 exploitsPublished Mar 9, 2021
- CVE-2021-21480High 8.8SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment).sap · manufacturing integration and intelligenceEPSS52%·Published Mar 9, 2021
- CVE-2021-24086High 7.5Windows TCP/IP Denial of Service Vulnerabilitymicrosoft · windows 10EPSS59%·Published Feb 25, 2021
- CVE-2016-6304High 7.5Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.openssl · opensslEPSS63%·Published Feb 24, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-31618 | Apache HTTP Server protocol handler for the HTTP/2 protocol checks received request headers against the size limitations as configured for the server and used for the HTTP/1 protocol as well. apache · http server | High 7.5 | 51% | · | |
| CVE-2021-30117 | The API call /InstallTab/exportFldr.asp is vulnerable to a semi-authenticated boolean-based blind SQL injection in the parameter fldrId. kaseya · vsa | High 8.8 | 72% | · | |
| CVE-2021-24145 | Modern Events Calendar Lite <= 5.16.4 - Authenticated Arbitrary File Upload leading to Remote Code Execution webnus · modern events calendar lite | High 7.2 | 87% | 4 exploits | |
| CVE-2021-24347 | SP Project & Document Manager <= 4.21 - Authenticated Shell Upload smartypantsplugins · sp project \& document manager | High 8.8 | 54% | 3 exploits | |
| CVE-2021-20081 | Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges. zohocorp · manageengine servicedesk plus | High 7.2 | 52% | · | |
| CVE-2021-33393 | lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. ipfire · ipfire | High 8.8 | 59% | 4 exploits | |
| CVE-2021-3277 | Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files. nagios · nagios xi | High 7.2 | 55% | · | |
| CVE-2020-8450 | squid3 - security update squid-cache · squid | High 7.3 | 72% | · | |
| CVE-2021-3490 | The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. linux · linux kernel | High 7.8 | 27% | 2 exploits | |
| CVE-2021-22123 | An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page. fortinet · fortiweb | High 8.8 | 84% | · | |
| CVE-2021-29492 | Envoy does not decode escaped slash sequences %2F and %5C in HTTP URL paths in versions 1.18.2 and before. envoyproxy · envoy | High 8.3 | 66% | · | |
| CVE-2021-22908 | A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. ivanti · connect secure | High 8.8 | 69% | · | |
| CVE-2021-24307 | The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. aioseo · all in one seo | High 8.8 | 53% | · | |
| CVE-2021-29505 | XStream is vulnerable to a Remote Command Execution attack xstream · xstream | High 8.8 | 77% | · | |
| CVE-2021-32819 | Insecure template handling in Squirrelly squirrelly · squirrelly | High 8.8 | 58% | · | |
| CVE-2021-31213 | Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability microsoft · remote | High 7.8 | 53% | · | |
| CVE-2021-31195 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 74% | · | |
| CVE-2021-31181 | Microsoft SharePoint Remote Code Execution Vulnerability microsoft · sharepoint enterprise server | High 8.8 | 29% | 2 exploits | |
| CVE-2021-28474 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 51% | · | |
| CVE-2021-27068 | Visual Studio Remote Code Execution Vulnerability microsoft · visual studio 2019 | High 8.8 | 54% | · | |
| CVE-2021-28966 | Tempfile on Windows path traversal vulnerability ruby-lang · ruby | High 7.5 | 58% | · | |
| CVE-2017-16944 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the… exim · exim | High 7.5 | 63% | 1 exploit | |
| CVE-2020-28019 | Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. exim · exim | High 7.5 | 62% | · | |
| CVE-2020-8277 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. nodejs · node.js | High 7.5 | 54% | · | |
| CVE-2021-29442 | Authentication bypass for specific endpoint alibaba · nacos | High 7.5 | 66% | 2 exploits | |
| CVE-2020-5791 | Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user. nagios · nagios xi | High 7.2 | 79% | 4 exploits | |
| CVE-2019-0232 | tomcat: Remote Code Execution on Windows apache · tomcat | High 8.1 | 100% | 2 exploits | |
| CVE-2021-2190 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline. oracle · sales offline | High 7.5 | 93% | · | |
| CVE-2021-2198 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. oracle · knowledge management | High 8.2 | 80% | · | |
| CVE-2019-0233 | struts2: access permission override when performing a file upload leads to DoS apache · struts | High 7.5 | 66% | · | |
| CVE-2020-1967 | Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. openssl · openssl | High 7.5 | 53% | · | |
| CVE-2021-27030 | A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system. autodesk · fbx review | High 7.8 | 60% | · | |
| CVE-2021-3017 | The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code. intelbras · win 300 firmware | High 7.5 | 63% | · | |
| CVE-2021-28482 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 83% | Ransomware1 actor | |
| CVE-2021-28472 | Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability microsoft · vscode-maven | High 7.8 | 62% | · | |
| CVE-2021-28165 | Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources eclipse · jetty | High 7.5 | 54% | · | |
| CVE-2021-24155 | The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE. backup-guard · backup guard | High 7.2 | 84% | 4 exploits | |
| CVE-2020-9490 | Apache HTTP Server versions 2.4.20 to 2.4.43. apache · http server | High 7.5 | 89% | · | |
| CVE-2021-27273 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. netgear · prosafe network management system | High 8.8 | 66% | · | |
| CVE-2021-27276 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. netgear · prosafe network management system | High 7.1 | 73% | · | |
| CVE-2021-27275 | This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. netgear · prosafe network management system | High 8.3 | 74% | · | |
| CVE-2021-27272 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. netgear · prosafe network management system | High 7.1 | 75% | · | |
| CVE-2021-29156 | ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. forgerock · openam | High 7.5 | 77% | 1 exploit | |
| CVE-2021-21341 | XStream can cause a Denial of Service. xstream · xstream | High 7.5 | 78% | · | |
| CVE-2021-27084 | Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability microsoft · visual studio code | High 7.8 | 62% | · | |
| CVE-2021-27083 | Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability microsoft · remote development | High 7.8 | 62% | · | |
| CVE-2021-21300 | In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS… git-scm · git | High 7.5 | 89% | 2 exploits | |
| CVE-2021-21480 | SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). sap · manufacturing integration and intelligence | High 8.8 | 52% | · | |
| CVE-2021-24086 | Windows TCP/IP Denial of Service Vulnerability microsoft · windows 10 | High 7.5 | 59% | · | |
| CVE-2016-6304 | Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions. openssl · openssl | High 7.5 | 63% | · |
Showing 551–600 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.