Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2023-29919Critical 9.8SolarView Compact <= 6.0 is vulnerable to Insecure Permissions.contec · solarview compact firmwareEPSS60%1 exploitPublished May 22, 2023
- CVE-2022-42889Critical 9.8Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.apache · commons textEPSS100%2 exploitsPublished May 18, 2023
- CVE-2023-25762Medium 5.4jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Pluginjenkins · pipeline\EPSS81%·Published May 18, 2023
- CVE-2023-2766High 7.5The manipulation leads to files or directories accessible.weaver · e-officeEPSS54%1 exploitPublished May 17, 2023
- CVE-2023-0210High 7.5A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.linux · linux kernelEPSS72%·Published May 17, 2023
- CVE-2023-2745Medium 6.1WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter.wordpress · wordpressEPSS80%1 exploitPublished May 17, 2023
- CVE-2023-32985Medium 4.3Jenkins Sidebar Link Plugin vulnerable to Path Traversaljenkins · sidebar linkEPSS72%·Published May 16, 2023
- CVE-2023-32986High 8.8Jenkins File Parameter Plugin arbitrary file write vulnerabilityjenkins · file parametersEPSS61%·Published May 16, 2023
- CVE-2023-32068Medium 6.1org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerabilityxwiki · xwikiEPSS55%·Published May 15, 2023
- CVE-2023-32243Critical 9.8Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalationwpdeveloper · essential addons for elementorEPSS76%1 exploitPublished May 15, 2023
- CVE-2023-1698Critical 9.8In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.wago · compact controller 100 firmwareEPSS82%·Published May 15, 2023
- CVE-2023-27823Critical 9.8An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.optoma · 1080pstxEPSS54%1 exploitPublished May 12, 2023
- CVE-2023-28128High 7.2An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.ivanti · avalancheEPSS85%1 exploitPublished May 9, 2023
- CVE-2023-28127High 7.5A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure.ivanti · avalancheEPSS59%·Published May 9, 2023
- CVE-2023-28126Medium 5.9An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.ivanti · avalancheEPSS67%·Published May 9, 2023
- CVE-2023-32071Critical 9.0XWiki Platform vulnerable to RXSS via editor parameter - importinline templatexwiki · xwikiEPSS70%·Published May 9, 2023
- CVE-2023-29325High 7.5Windows OLE Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS84%·Published May 9, 2023
- CVE-2023-24950Medium 6.5Microsoft SharePoint Server Spoofing Vulnerabilitymicrosoft · sharepoint serverEPSS67%·Published May 9, 2023
- CVE-2023-24941Critical 9.8Windows Network File System Remote Code Execution Vulnerabilitymicrosoft · windows server 2012EPSS95%·Published May 9, 2023
- CVE-2023-30013Critical 9.8TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg.totolink · x5000r firmwareEPSS26%2 exploitsPublished May 5, 2023
- CVE-2023-31099High 8.8Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.zohocorp · manageengine opmanagerEPSS82%·Published May 4, 2023
- CVE-2023-25826Critical 9.8Command injection in OpenTSDBopentsdb · opentsdbEPSS43%1 exploitPublished May 3, 2023
- CVE-2023-25652High 7.5Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the…git-scm · gitEPSS52%·Published May 2, 2023
- CVE-2023-32007High 8.7Apache Spark UI vulnerable to Command Injectionapache · sparkEPSS76%·Published May 2, 2023
- CVE-2023-28384High 8.8mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.myscada · myproEPSS45%1 exploitPublished Apr 27, 2023
- CVE-2023-29489Medium 6.1XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669.cpanel · cpanelEPSS66%·Published Apr 27, 2023
- CVE-2023-28770High 7.5The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from…zyxel · dx5401-b0 firmwareEPSS58%1 exploitPublished Apr 27, 2023
- CVE-2023-0992Medium 6.1Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scriptinggetshieldsecurity · shield securityEPSS93%·Published Apr 24, 2023
- CVE-2023-29525High 8.8XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministrationxwiki · xwikiEPSS78%·Published Apr 20, 2023
- CVE-2023-29524High 8.8XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheetxwiki · xwikiEPSS76%1 exploitPublished Apr 20, 2023
- CVE-2023-29516High 8.8XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelectorxwiki · xwikiEPSS66%·Published Apr 20, 2023
- CVE-2023-20864Critical 9.8VMware Aria Operations for Logs contains a deserialization vulnerability.vmware · aria operations for logsEPSS70%·Published Apr 20, 2023
- CVE-2023-30547Critical 10.0vm2 Sandbox Escape vulnerabilityvm2 project · vm2EPSS73%·Published Apr 20, 2023
- CVE-2023-22621Critical 10.0Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Pluginstrapi · strapiEPSS71%·Published Apr 19, 2023
- CVE-2023-21931High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS82%1 exploitPublished Apr 19, 2023
- CVE-2023-29084High 7.2Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.zohocorp · manageengine admanager plusEPSS98%1 exploitPublished Apr 14, 2023
- CVE-2023-21554Critical 9.8Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607EPSS95%·Published Apr 14, 2023
- CVE-2023-2034High 8.8froxlor/froxlor vulnerable to unrestricted upload of file with dangerous typefroxlor · froxlorEPSS71%·Published Apr 14, 2023
- CVE-2023-29509High 8.8org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwikiEPSS76%·Published Apr 12, 2023
- CVE-2023-28121Critical 9.8An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator.automattic · woocommerce paymentsEPSS87%·Published Apr 12, 2023
- CVE-2023-28302High 7.5Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 1607EPSS93%·Published Apr 11, 2023
- CVE-2023-21769High 7.5Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 1607EPSS89%·Published Apr 11, 2023
- CVE-2023-27179High 7.5GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.gdidees · gdidees cmsEPSS61%1 exploitPublished Apr 11, 2023
- CVE-2023-28341Medium 6.1Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page.zohocorp · manageengine applications managerEPSS99%·Published Apr 11, 2023
- CVE-2023-26067High 8.1Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).lexmark · cslbl firmwareEPSS38%1 exploitPublished Apr 10, 2023
- CVE-2023-29017Critical 9.8vm2 vulnerable to sandbox escapevm2 project · vm2EPSS63%·Published Apr 7, 2023
- CVE-2023-28342High 7.5Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.zohocorp · manageengine adselfservice plusEPSS78%·Published Apr 6, 2023
- CVE-2023-25076Critical 9.8A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba).sniproxy project · sniproxyEPSS66%·Published Mar 30, 2023
- CVE-2023-28503Critical 9.8Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication…rocketsoftware · unidataEPSS62%1 exploitPublished Mar 29, 2023
- CVE-2023-28502Critical 9.8Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user.rocketsoftware · unidataEPSS61%1 exploitPublished Mar 29, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-29919 | SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. contec · solarview compact firmware | Critical 9.8 | 60% | 1 exploit | |
| CVE-2022-42889 | Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. apache · commons text | Critical 9.8 | 100% | 2 exploits | |
| CVE-2023-25762 | jenkins-2-plugins/pipeline-build-step: Stored XSS vulnerability in Pipeline: Build Step Plugin jenkins · pipeline\ | Medium 5.4 | 81% | · | |
| CVE-2023-2766 | The manipulation leads to files or directories accessible. weaver · e-office | High 7.5 | 54% | 1 exploit | |
| CVE-2023-0210 | A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems. linux · linux kernel | High 7.5 | 72% | · | |
| CVE-2023-2745 | WordPress Core is vulnerable to Directory Traversal in versions up to, and including, 6.2, via the ‘wp_lang’ parameter. wordpress · wordpress | Medium 6.1 | 80% | 1 exploit | |
| CVE-2023-32985 | Jenkins Sidebar Link Plugin vulnerable to Path Traversal jenkins · sidebar link | Medium 4.3 | 72% | · | |
| CVE-2023-32986 | Jenkins File Parameter Plugin arbitrary file write vulnerability jenkins · file parameters | High 8.8 | 61% | · | |
| CVE-2023-32068 | org.xwiki.platform:xwiki-platform-oldcore Open Redirect vulnerability xwiki · xwiki | Medium 6.1 | 55% | · | |
| CVE-2023-32243 | Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation wpdeveloper · essential addons for elementor | Critical 9.8 | 76% | 1 exploit | |
| CVE-2023-1698 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise. wago · compact controller 100 firmware | Critical 9.8 | 82% | · | |
| CVE-2023-27823 | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. optoma · 1080pstx | Critical 9.8 | 54% | 1 exploit | |
| CVE-2023-28128 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. ivanti · avalanche | High 7.2 | 85% | 1 exploit | |
| CVE-2023-28127 | A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure. ivanti · avalanche | High 7.5 | 59% | · | |
| CVE-2023-28126 | An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message. ivanti · avalanche | Medium 5.9 | 67% | · | |
| CVE-2023-32071 | XWiki Platform vulnerable to RXSS via editor parameter - importinline template xwiki · xwiki | Critical 9.0 | 70% | · | |
| CVE-2023-29325 | Windows OLE Remote Code Execution Vulnerability microsoft · windows 10 1507 | High 7.5 | 84% | · | |
| CVE-2023-24950 | Microsoft SharePoint Server Spoofing Vulnerability microsoft · sharepoint server | Medium 6.5 | 67% | · | |
| CVE-2023-24941 | Windows Network File System Remote Code Execution Vulnerability microsoft · windows server 2012 | Critical 9.8 | 95% | · | |
| CVE-2023-30013 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. totolink · x5000r firmware | Critical 9.8 | 26% | 2 exploits | |
| CVE-2023-31099 | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers. zohocorp · manageengine opmanager | High 8.8 | 82% | · | |
| CVE-2023-25826 | Command injection in OpenTSDB opentsdb · opentsdb | Critical 9.8 | 43% | 1 exploit | |
| CVE-2023-25652 | Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the… git-scm · git | High 7.5 | 52% | · | |
| CVE-2023-32007 | Apache Spark UI vulnerable to Command Injection apache · spark | High 8.7 | 76% | · | |
| CVE-2023-28384 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. myscada · mypro | High 8.8 | 45% | 1 exploit | |
| CVE-2023-29489 | XSS can occur on the cpsrvd error page via an invalid webcall ID, aka SEC-669. cpanel · cpanel | Medium 6.1 | 66% | · | |
| CVE-2023-28770 | The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from… zyxel · dx5401-b0 firmware | High 7.5 | 58% | 1 exploit | |
| CVE-2023-0992 | Shield Security <= 17.0.17 - Unauthenticated Stored Cross-Site Scripting getshieldsecurity · shield security | Medium 6.1 | 93% | · | |
| CVE-2023-29525 | XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration xwiki · xwiki | High 8.8 | 78% | · | |
| CVE-2023-29524 | XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheet xwiki · xwiki | High 8.8 | 76% | 1 exploit | |
| CVE-2023-29516 | XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelector xwiki · xwiki | High 8.8 | 66% | · | |
| CVE-2023-20864 | VMware Aria Operations for Logs contains a deserialization vulnerability. vmware · aria operations for logs | Critical 9.8 | 70% | · | |
| CVE-2023-30547 | vm2 Sandbox Escape vulnerability vm2 project · vm2 | Critical 10.0 | 73% | · | |
| CVE-2023-22621 | Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin strapi · strapi | Critical 10.0 | 71% | · | |
| CVE-2023-21931 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. oracle · weblogic server | High 7.5 | 82% | 1 exploit | |
| CVE-2023-29084 | Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. zohocorp · manageengine admanager plus | High 7.2 | 98% | 1 exploit | |
| CVE-2023-21554 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability microsoft · windows 10 1607 | Critical 9.8 | 95% | · | |
| CVE-2023-2034 | froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type froxlor · froxlor | High 8.8 | 71% | · | |
| CVE-2023-29509 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability xwiki · xwiki | High 8.8 | 76% | · | |
| CVE-2023-28121 | An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. automattic · woocommerce payments | Critical 9.8 | 87% | · | |
| CVE-2023-28302 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability microsoft · windows 10 1607 | High 7.5 | 93% | · | |
| CVE-2023-21769 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability microsoft · windows 10 1607 | High 7.5 | 89% | · | |
| CVE-2023-27179 | GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php. gdidees · gdidees cms | High 7.5 | 61% | 1 exploit | |
| CVE-2023-28341 | Stored Cross site scripting (XSS) vulnerability in Zoho ManageEngine Applications Manager through 16340 allows an unauthenticated user to inject malicious javascript on the incorrect login details page. zohocorp · manageengine applications manager | Medium 6.1 | 99% | · | |
| CVE-2023-26067 | Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). lexmark · cslbl firmware | High 8.1 | 38% | 1 exploit | |
| CVE-2023-29017 | vm2 vulnerable to sandbox escape vm2 project · vm2 | Critical 9.8 | 63% | · | |
| CVE-2023-28342 | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. zohocorp · manageengine adselfservice plus | High 7.5 | 78% | · | |
| CVE-2023-25076 | A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). sniproxy project · sniproxy | Critical 9.8 | 66% | · | |
| CVE-2023-28503 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication… rocketsoftware · unidata | Critical 9.8 | 62% | 1 exploit | |
| CVE-2023-28502 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user. rocketsoftware · unidata | Critical 9.8 | 61% | 1 exploit |
Showing 601–650 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.