Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
1,642 vulnerabilities · highest exploit probability first
  • CVE-2020-24881Critical 9.8
    SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.
    enhancesoft · osticket
    EPSS73%
    2 exploits
    Published Nov 2, 2020
  • CVE-2020-11854Critical 9.8
    Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance…
    microfocus · application performance management
    EPSS74%
    1 exploit
    Published Oct 27, 2020
  • CVE-2020-27615Critical 9.8
    The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.
    loginizer · loginizer
    EPSS52%
    ·
    Published Oct 21, 2020
  • CVE-2020-14841Critical 9.8
    Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server.
    oracle · weblogic server
    EPSS52%
    ·
    Published Oct 21, 2020
  • CVE-2019-17444Critical 9.8
    Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them.
    jfrog · artifactory
    EPSS69%
    ·
    Published Oct 12, 2020
  • CVE-2020-26948Critical 9.8
    Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.
    emby · emby
    EPSS87%
    ·
    Published Oct 10, 2020
  • CVE-2020-15175Critical 9.1
    In GLPI before version 9.5.2, the ​pluginimage.send.php​ endpoint allows a user to specify an image from a plugin.
    glpi-project · glpi
    EPSS72%
    ·
    Published Oct 7, 2020
  • CVE-2020-12124Critical 9.8
    A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.
    wavlink · wn530h4 firmware
    EPSS75%
    ·
    Published Oct 2, 2020
  • CVE-2020-36708Critical 9.8
    Epsilon Framework Themes (Various Versions) - Function Injection
    colorlib · activello
    EPSS65%
    ·
    Published Sep 30, 2020
  • CVE-2020-11698Critical 9.8
    Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to inject commands into the file snmpd.conf that would allow executing commands on the target server.
    titanhq · spamtitan
    EPSS73%
    4 exploits
    Published Sep 17, 2020
  • CVE-2020-15148Critical 10.0
    Unsafe deserialization in Yii 2
    yiiframework · yii
    EPSS78%
    ·
    Published Sep 15, 2020
  • CVE-2020-24186Critical 10.0
    A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.
    gvectors · wpdiscuz
    EPSS95%
    6 exploits
    Published Aug 24, 2020
  • CVE-2020-17456Critical 9.8
    SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.
    seowonintech · slc-130 firmware
    EPSS74%
    1 exploit
    Published Aug 19, 2020
  • CVE-2020-17506Critical 9.8
    Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.
    articatech · web proxy
    EPSS94%
    4 exploits
    Published Aug 12, 2020
  • CVE-2020-7357Critical 9.9
    Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials.
    cayintech · cms
    EPSS32%
    1 exploit
    Published Aug 6, 2020
  • CVE-2020-13151Critical 9.8
    Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query.
    aerospike · aerospike server
    EPSS87%
    4 exploits
    Published Aug 5, 2020
  • CVE-2020-15922Critical 9.8
    There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges.
    midasolutions · eframework
    EPSS57%
    2 exploits
    Published Jul 23, 2020
  • CVE-2020-15920Critical 9.8
    There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges.
    midasolutions · eframework
    EPSS98%
    4 exploits
    Published Jul 23, 2020
  • CVE-2020-15893Critical 9.8
    An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02.
    dlink · dir-816l firmware
    EPSS21%
    1 exploit
    Published Jul 22, 2020
  • CVE-2020-14092Critical 9.8
    The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.
    ithemes · paypal pro
    EPSS95%
    ·
    Published Jul 2, 2020
  • CVE-2020-13382Critical 9.1
    openSIS through 7.4 has Incorrect Access Control.
    os4ed · opensis
    EPSS53%
    3 exploits
    Published Jul 1, 2020
  • CVE-2020-13381Critical 9.8
    openSIS through 7.4 allows SQL Injection.
    os4ed · opensis
    EPSS59%
    2 exploits
    Published Jul 1, 2020
  • CVE-2020-13160Critical 9.8
    AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.
    anydesk · anydesk
    EPSS81%
    4 exploits
    Published Jun 9, 2020
  • CVE-2020-12800Critical 9.8
    The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.
    codedropz · drag and drop multiple file upload - contact form 7
    EPSS79%
    2 exploits
    Published Jun 8, 2020
  • CVE-2020-10546Critical 9.8
    rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection.
    rconfig · rconfig
    EPSS87%
    1 exploit
    Published Jun 4, 2020
  • CVE-2020-7115Critical 9.8
    The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass.
    arubanetworks · clearpass policy manager
    EPSS65%
    2 exploits
    Published Jun 3, 2020
  • CVE-2020-8606Critical 9.8
    A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.
    trendmicro · interscan web security virtual appliance
    EPSS73%
    3 exploits
    Published May 27, 2020
  • CVE-2020-13167Critical 9.8
    Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.
    netsweeper · netsweeper
    EPSS95%
    1 exploit
    Published May 19, 2020
  • CVE-2020-13166Critical 9.8
    The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.
    mylittletools · mylittleadmin
    EPSS78%
    3 exploits
    Published May 19, 2020
  • CVE-2020-11532Critical 9.8
    Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server.
    zohocorp · manageengine datasecurity plus
    EPSS77%
    1 exploit
    Published May 8, 2020
  • CVE-2020-11530Critical 9.8
    A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin.
    idangero · chop slider
    EPSS96%
    3 exploits
    Published May 8, 2020
  • CVE-2020-12720Critical 9.8
    vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.
    vbulletin · vbulletin
    EPSS89%
    1 exploit
    Published May 7, 2020
  • CVE-2020-4429Critical 9.8
    IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account.
    ibm · data risk manager
    EPSS72%
    2 exploits
    Published May 7, 2020
  • CVE-2020-3187Critical 9.1
    A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to…
    cisco · firepower threat defense
    EPSS97%
    2 exploits
    Published May 6, 2020
  • CVE-2020-7136Critical 9.8
    A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access.
    hpe · smart update manager
    EPSS81%
    ·
    Published Apr 30, 2020
  • CVE-2019-5620Critical 9.8
    ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.
    hitachienergy · microscada pro sys600
    EPSS71%
    1 exploit
    Published Apr 29, 2020
  • CVE-2020-9294Critical 9.8
    An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.
    fortinet · fortimail
    EPSS78%
    ·
    Published Apr 27, 2020
  • CVE-2020-10915Critical 9.8
    This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.
    veeam · one
    EPSS87%
    1 exploit
    Published Apr 22, 2020
  • CVE-2020-10914Critical 9.8
    This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.
    veeam · one
    EPSS48%
    1 exploit
    Published Apr 22, 2020
  • CVE-2020-3250Critical 9.8
    Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.
    cisco · ucs director
    EPSS61%
    1 exploit
    Published Apr 15, 2020
  • CVE-2020-3248Critical 9.8
    Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.
    cisco · ucs director
    EPSS74%
    ·
    Published Apr 15, 2020
  • CVE-2020-3247Critical 9.8
    Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.
    cisco · ucs director
    EPSS76%
    ·
    Published Apr 15, 2020
  • CVE-2020-3243Critical 9.8
    Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.
    cisco · ucs director
    EPSS88%
    1 exploit
    Published Apr 15, 2020
  • CVE-2020-2950Critical 9.8
    Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.
    oracle · business intelligence
    EPSS71%
    ·
    Published Apr 15, 2020
  • CVE-2020-11455Critical 9.8
    LimeSurvey before 4.1.12+200324 contains a path traversal vulnerability in application/controllers/admin/LimeSurveyFileManager.php.
    limesurvey · limesurvey
    EPSS97%
    2 exploits
    Published Apr 1, 2020
  • CVE-2020-10879Critical 9.8
    rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.
    rconfig · rconfig
    EPSS84%
    1 exploit
    Published Mar 23, 2020
  • CVE-2020-10220Critical 9.8
    The web interface is prone to a SQL injection via the commands.inc.php searchColumn parameter.
    rconfig · rconfig
    EPSS100%
    4 exploits
    Published Mar 7, 2020
  • CVE-2016-10045Critical 9.8
    Remote code execution in PHPMailer
    phpmailer project · phpmailer
    EPSS98%
    5 exploits
    Published Mar 5, 2020
  • CVE-2020-9465Critical 9.8
    The eonweb web interface is prone to a SQL injection, allowing an unauthenticated attacker to perform various tasks such as authentication bypass via the user_id field in a cookie.
    eyesofnetwork · eyesofnetwork
    EPSS82%
    2 exploits
    Published Feb 28, 2020
  • CVE-2020-8794Critical 9.8
    OpenSMTPD before 6.6.4 allows remote code execution because of an out-of-bounds read in mta_io in mta_session.c for multi-line replies.
    opensmtpd · opensmtpd
    EPSS89%
    4 exploits
    Published Feb 25, 2020
Showing 601–650 of 1,642

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.