Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2021-3407High 7.8Double free of object during linearization may lead to memory corruption and other potential consequences.artifex · mupdfEPSS50%·Published Feb 23, 2021
- CVE-2021-27212High 7.5In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp.openldap · openldapEPSS66%·Published Feb 14, 2021
- CVE-2020-27871High 7.2This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1.solarwinds · orion platformEPSS91%·Published Feb 10, 2021
- CVE-2020-13548High 8.8In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution.foxitsoftware · foxit readerEPSS66%·Published Feb 10, 2021
- CVE-2021-26914High 8.1NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject.netmotionsoftware · netmotion mobilityEPSS78%2 exploitsPublished Feb 8, 2021
- CVE-2020-36228High 7.5openldap - security updateopenldap · openldapEPSS85%·Published Feb 8, 2021
- CVE-2020-36221High 7.5openldap - security updateopenldap · openldapEPSS85%·Published Feb 8, 2021
- CVE-2020-36227High 7.5openldap - security updateopenldap · openldapEPSS77%·Published Feb 8, 2021
- CVE-2020-36222High 7.5openldap - security updateopenldap · openldapEPSS77%·Published Feb 8, 2021
- CVE-2020-36243High 8.8The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php.open-emr · openemrEPSS64%·Published Feb 7, 2021
- CVE-2020-13580High 7.8An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application.softmaker · planmaker 2021EPSS71%·Published Feb 4, 2021
- CVE-2020-13579High 7.8An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application.softmaker · planmaker 2021EPSS71%·Published Feb 4, 2021
- CVE-2021-25646High 8.8druid: Authenticated javascript code injectionapache · druidEPSS99%2 exploitsPublished Feb 2, 2021
- CVE-2020-4888High 8.8IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function.ibm · qradar security information and event managerEPSS62%·Published Jan 28, 2021
- CVE-2021-2109High 7.2Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS70%2 exploitsPublished Jan 25, 2021
- CVE-2020-25681High 8.1A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data.thekelleys · dnsmasqEPSS81%·Published Jan 21, 2021
- CVE-2020-25682High 8.1A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data.thekelleys · dnsmasqEPSS71%·Published Jan 21, 2021
- CVE-2020-27858High 7.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5.arcserve · d2dEPSS74%·Published Jan 20, 2021
- CVE-2021-2114High 8.2Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications Calendar.oracle · common applications calendarEPSS59%·Published Jan 20, 2021
- CVE-2020-19364High 8.8OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php.open-emr · openemrEPSS71%1 exploitPublished Jan 19, 2021
- CVE-2020-35578High 7.2Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands.nagios · nagios xiEPSS82%4 exploitsPublished Jan 18, 2021
- CVE-2020-13557High 8.8A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527.foxitsoftware · foxit readerEPSS70%·Published Dec 22, 2020
- CVE-2020-26258High 7.7Server-Side Forgery Request can be activated unmarshalling with XStreamxstream · xstreamEPSS82%·Published Dec 21, 2020
- CVE-2020-35234High 7.5The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020.wp-ecommerce · easy wp smtpEPSS60%·Published Dec 14, 2020
- CVE-2020-3495High 8.8A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code.cisco · jabberEPSS61%·Published Dec 11, 2020
- CVE-2020-17143High 8.8Microsoft Exchange Server Information Disclosure Vulnerabilitymicrosoft · exchange serverEPSS71%·Published Dec 9, 2020
- CVE-2020-26950High 8.8In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition.mozilla · firefoxEPSS42%2 exploitsPublished Dec 9, 2020
- CVE-2020-11993High 7.5Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools.apache · http serverEPSS56%1 exploitPublished Dec 4, 2020
- CVE-2020-28579High 8.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.trendmicro · interscan web security virtual applianceEPSS51%·Published Nov 18, 2020
- CVE-2020-26217High 8.8XStream can be used for Remote Code Executionxstream · xstreamEPSS85%·Published Nov 16, 2020
- CVE-2020-27386High 8.8An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using…flexdotnetcms project · flexdotnetcmsEPSS73%1 exploitPublished Nov 12, 2020
- CVE-2020-28328High 8.8SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting.salesagility · suitecrmEPSS63%6 exploitsPublished Nov 6, 2020
- CVE-2020-24435High 7.8Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the…adobe · acrobatEPSS53%·Published Nov 5, 2020
- CVE-2020-7384High 7.8Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.rapid7 · metasploitEPSS30%4 exploitsPublished Oct 29, 2020
- CVE-2020-11853High 8.8Arbitrary code execution vulnerability affecting multiple Micro Focus products.microfocus · application performance managementEPSS77%2 exploitsPublished Oct 22, 2020
- CVE-2020-5792High 7.2Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.nagios · nagios xiEPSS59%2 exploitsPublished Oct 20, 2020
- CVE-2020-16952High 7.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.microsoft · sharepoint serverEPSS71%2 exploitsPublished Oct 16, 2020
- CVE-2020-15867High 7.2The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution.gogs · gogsEPSS87%2 exploitsPublished Oct 16, 2020
- CVE-2020-13340High 8.7An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Loggitlab · gitlabEPSS67%·Published Oct 8, 2020
- CVE-2020-4280High 8.8IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function.ibm · qradar security information and event managerEPSS73%1 exploitPublished Oct 8, 2020
- CVE-2020-26124High 8.8openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc.openmediavault · openmediavaultEPSS67%2 exploitsPublished Oct 2, 2020
- CVE-2020-6113High 7.8An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table.gonitro · nitro proEPSS64%·Published Sep 17, 2020
- CVE-2020-6146High 8.8An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300.gonitro · nitro proEPSS75%·Published Sep 16, 2020
- CVE-2020-16875High 7.2A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.microsoft · exchange serverEPSS46%2 exploitsPublished Sep 11, 2020
- CVE-2020-11991High 7.5When using the StreamGenerator, the code parse a user-provided XML.apache · cocoonEPSS72%·Published Sep 11, 2020
- CVE-2020-17408High 7.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1.nec · expresscluster xEPSS69%·Published Sep 10, 2020
- CVE-2020-2038High 7.2An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges.paloaltonetworks · pan-osEPSS86%4 exploitsPublished Sep 9, 2020
- CVE-2020-24949High 8.8Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).php-fusion · php-fusionEPSS68%3 exploitsPublished Sep 3, 2020
- CVE-2020-15643High 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.marvell · qconvergeconsoleEPSS59%·Published Aug 25, 2020
- CVE-2020-16205High 7.2Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5).geutebrueck · g-cam ebc-2110 firmwareEPSS61%2 exploitsPublished Aug 14, 2020
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-3407 | Double free of object during linearization may lead to memory corruption and other potential consequences. artifex · mupdf | High 7.8 | 50% | · | |
| CVE-2021-27212 | In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. openldap · openldap | High 7.5 | 66% | · | |
| CVE-2020-27871 | This vulnerability allows remote attackers to create arbitrary files on affected installations of SolarWinds Orion Platform 2020.2.1. solarwinds · orion platform | High 7.2 | 91% | · | |
| CVE-2020-13548 | In Foxit Reader 10.1.0.37527, a specially crafted PDF document can trigger reuse of previously free memory which can lead to arbitrary code execution. foxitsoftware · foxit reader | High 8.8 | 66% | · | |
| CVE-2021-26914 | NetMotion Mobility before 11.73 and 12.x before 12.02 allows unauthenticated remote attackers to execute arbitrary code as SYSTEM because of Java deserialization in MvcUtil valueStringToObject. netmotionsoftware · netmotion mobility | High 8.1 | 78% | 2 exploits | |
| CVE-2020-36228 | openldap - security update openldap · openldap | High 7.5 | 85% | · | |
| CVE-2020-36221 | openldap - security update openldap · openldap | High 7.5 | 85% | · | |
| CVE-2020-36227 | openldap - security update openldap · openldap | High 7.5 | 77% | · | |
| CVE-2020-36222 | openldap - security update openldap · openldap | High 7.5 | 77% | · | |
| CVE-2020-36243 | The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. open-emr · openemr | High 8.8 | 64% | · | |
| CVE-2020-13580 | An exploitable heap-based buffer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. softmaker · planmaker 2021 | High 7.8 | 71% | · | |
| CVE-2020-13579 | An exploitable integer overflow vulnerability exists in the PlanMaker document parsing functionality of SoftMaker Office 2021’s PlanMaker application. softmaker · planmaker 2021 | High 7.8 | 71% | · | |
| CVE-2021-25646 | druid: Authenticated javascript code injection apache · druid | High 8.8 | 99% | 2 exploits | |
| CVE-2020-4888 | IBM QRadar SIEM 7.4.0 to 7.4.2 Patch 1 and 7.3.0 to 7.3.3 Patch 7 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. ibm · qradar security information and event manager | High 8.8 | 62% | · | |
| CVE-2021-2109 | Easily exploitable vulnerability allows high privileged attacker with network access via HTTP to compromise Oracle WebLogic Server. oracle · weblogic server | High 7.2 | 70% | 2 exploits | |
| CVE-2020-25681 | A heap-based buffer overflow was discovered in the way RRSets are sorted before validating with DNSSEC data. thekelleys · dnsmasq | High 8.1 | 81% | · | |
| CVE-2020-25682 | A buffer overflow vulnerability was discovered in the way dnsmasq extract names from DNS packets before validating them with DNSSEC data. thekelleys · dnsmasq | High 8.1 | 71% | · | |
| CVE-2020-27858 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of CA Arcserve D2D 16.5. arcserve · d2d | High 7.5 | 74% | · | |
| CVE-2021-2114 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Common Applications Calendar. oracle · common applications calendar | High 8.2 | 59% | · | |
| CVE-2020-19364 | OpenEMR 5.0.1 allows an authenticated attacker to upload and execute malicious PHP scripts through /controller.php. open-emr · openemr | High 8.8 | 71% | 1 exploit | |
| CVE-2020-35578 | Because the line-ending conversion feature is mishandled during a plugin upload, a remote, authenticated admin user can execute operating-system commands. nagios · nagios xi | High 7.2 | 82% | 4 exploits | |
| CVE-2020-13557 | A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. foxitsoftware · foxit reader | High 8.8 | 70% | · | |
| CVE-2020-26258 | Server-Side Forgery Request can be activated unmarshalling with XStream xstream · xstream | High 7.7 | 82% | · | |
| CVE-2020-35234 | The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. wp-ecommerce · easy wp smtp | High 7.5 | 60% | · | |
| CVE-2020-3495 | A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. cisco · jabber | High 8.8 | 61% | · | |
| CVE-2020-17143 | Microsoft Exchange Server Information Disclosure Vulnerability microsoft · exchange server | High 8.8 | 71% | · | |
| CVE-2020-26950 | In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. mozilla · firefox | High 8.8 | 42% | 2 exploits | |
| CVE-2020-11993 | Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. apache · http server | High 7.5 | 56% | 1 exploit | |
| CVE-2020-28579 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. trendmicro · interscan web security virtual appliance | High 8.8 | 51% | · | |
| CVE-2020-26217 | XStream can be used for Remote Code Execution xstream · xstream | High 8.8 | 85% | · | |
| CVE-2020-27386 | An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using… flexdotnetcms project · flexdotnetcms | High 8.8 | 73% | 1 exploit | |
| CVE-2020-28328 | SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. salesagility · suitecrm | High 8.8 | 63% | 6 exploits | |
| CVE-2020-24435 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the… adobe · acrobat | High 7.8 | 53% | · | |
| CVE-2020-7384 | Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine. rapid7 · metasploit | High 7.8 | 30% | 4 exploits | |
| CVE-2020-11853 | Arbitrary code execution vulnerability affecting multiple Micro Focus products. microfocus · application performance management | High 8.8 | 77% | 2 exploits | |
| CVE-2020-5792 | Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user. nagios · nagios xi | High 7.2 | 59% | 2 exploits | |
| CVE-2020-16952 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. microsoft · sharepoint server | High 7.8 | 71% | 2 exploits | |
| CVE-2020-15867 | The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. gogs · gogs | High 7.2 | 87% | 2 exploits | |
| CVE-2020-13340 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log gitlab · gitlab | High 8.7 | 67% | · | |
| CVE-2020-4280 | IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. ibm · qradar security information and event manager | High 8.8 | 73% | 1 exploit | |
| CVE-2020-26124 | openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. openmediavault · openmediavault | High 8.8 | 67% | 2 exploits | |
| CVE-2020-6113 | An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. gonitro · nitro pro | High 7.8 | 64% | · | |
| CVE-2020-6146 | An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300. gonitro · nitro pro | High 8.8 | 75% | · | |
| CVE-2020-16875 | A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments. microsoft · exchange server | High 7.2 | 46% | 2 exploits | |
| CVE-2020-11991 | When using the StreamGenerator, the code parse a user-provided XML. apache · cocoon | High 7.5 | 72% | · | |
| CVE-2020-17408 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. nec · expresscluster x | High 7.5 | 69% | · | |
| CVE-2020-2038 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. paloaltonetworks · pan-os | High 7.2 | 86% | 4 exploits | |
| CVE-2020-24949 | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE). php-fusion · php-fusion | High 8.8 | 68% | 3 exploits | |
| CVE-2020-15643 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. marvell · qconvergeconsole | High 8.8 | 59% | · | |
| CVE-2020-16205 | Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5). geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 61% | 2 exploits |
Showing 601–650 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.