Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2022-40022Critical 9.8Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.microchip · syncserver s650 firmwareEPSS92%1 exploitPublished Feb 13, 2023
- CVE-2022-48323Critical 9.8Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue.sunlogin · sunflowerEPSS57%1 exploitPublished Feb 13, 2023
- CVE-2022-45699Critical 9.8Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.apsystems · ecu-r firmwareEPSS77%1 exploitPublished Feb 9, 2023
- CVE-2023-0286High 7.4Vulnerable OpenSSL included in cryptography wheelsopenssl · opensslEPSS71%·Published Feb 8, 2023
- CVE-2023-25194High 8.8Apache Kafka Connect vulnerable to Deserialization of Untrusted Dataapache · kafka connectEPSS96%1 exploitPublished Feb 7, 2023
- CVE-2022-40224High 7.5A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.moxa · sds-3008 firmwareEPSS65%·Published Feb 7, 2023
- CVE-2023-22374High 8.5A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code.f5 · big-ip access policy managerEPSS73%·Published Feb 7, 2023
- CVE-2022-44268Medium 6.5ImageMagick 7.1.0-49 is vulnerable to Information Disclosure.imagemagick · imagemagickEPSS90%1 exploitPublished Feb 6, 2023
- CVE-2022-44267Medium 6.5ImageMagick 7.1.0-49 is vulnerable to Denial of Service.imagemagick · imagemagickEPSS77%1 exploitPublished Feb 6, 2023
- CVE-2022-3229Critical 9.8Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated…unifiedremote · unified remoteEPSS66%1 exploitPublished Feb 6, 2023
- CVE-2023-23333Critical 9.8There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.contec · solarview compact firmwareEPSS99%3 exploitsPublished Feb 6, 2023
- CVE-2023-20073Critical 9.8A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device.cisco · rv340 firmwareEPSS90%·Published Feb 3, 2023
- CVE-2023-25136Medium 6.5OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.openbsd · opensshEPSS90%·Published Feb 3, 2023
- CVE-2023-23074Medium 6.1Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.zohocorp · manageengine servicedesk plusEPSS84%·Published Feb 2, 2023
- CVE-2023-23076Critical 9.8OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.zohocorp · manageengine supportcenter plusEPSS74%·Published Feb 1, 2023
- CVE-2023-0587Critical 9.1A file upload vulnerability in exists in Trend Micro Apex One server build 11110.trendmicro · apex oneEPSS60%·Published Feb 1, 2023
- CVE-2023-3388Medium 6.1Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scriptingbeautiful-cookie-banner · beautiful cookie consent bannerEPSS84%·Published Jan 30, 2023
- CVE-2022-41142High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS85%·Published Jan 26, 2023
- CVE-2022-32215Medium 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers.llhttp · llhttpEPSS70%·Published Jan 25, 2023
- CVE-2022-31706Critical 9.8The vRealize Log Insight contains a Directory Traversal Vulnerability.vmware · vrealize log insightEPSS87%1 exploitPublished Jan 25, 2023
- CVE-2022-31704Critical 9.8The vRealize Log Insight contains a broken access control vulnerability.vmware · vrealize log insightEPSS81%1 exploitPublished Jan 25, 2023
- CVE-2022-31711Medium 5.3VMware vRealize Log Insight contains an Information Disclosure Vulnerability.vmware · vrealize log insightEPSS24%1 exploitPublished Jan 25, 2023
- CVE-2023-22458Medium 5.5Authenticated users can issue a HRANDFIELD or ZRANDMEMBER command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure.redis · redisEPSS72%·Published Jan 20, 2023
- CVE-2023-23492High 8.8The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.idehweb · login with phone numberEPSS57%·Published Jan 20, 2023
- CVE-2023-23488Critical 9.8The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.strangerstudios · paid memberships proEPSS92%1 exploitPublished Jan 20, 2023
- CVE-2023-0126High 7.5Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.sonicwall · sma1000 firmwareEPSS73%·Published Jan 19, 2023
- CVE-2022-46889Medium 5.4A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php.nexusphp · nexusphpEPSS60%·Published Jan 19, 2023
- CVE-2023-22809High 7.8In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process.sudo project · sudoEPSS55%2 exploitsPublished Jan 18, 2023
- CVE-2022-44793Medium 6.5net-snmp - security updatenet-snmp · net-snmpEPSS53%2 exploitsPublished Jan 16, 2023
- CVE-2022-44792Medium 6.5net-snmp - security updatenet-snmp · net-snmpEPSS52%2 exploitsPublished Jan 16, 2023
- CVE-2023-0315High 8.8Froxlor vulnerable to Command Injectionfroxlor · froxlorEPSS98%2 exploitsPublished Jan 16, 2023
- CVE-2023-0297Critical 9.8Code Injection in pyload-ngpyload · pyloadEPSS96%2 exploitsPublished Jan 14, 2023
- CVE-2023-21742High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS56%·Published Jan 11, 2023
- CVE-2023-21768High 7.8Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerabilitymicrosoft · windows 11EPSS65%1 exploitPublished Jan 10, 2023
- CVE-2023-21758High 7.5Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerabilitymicrosoft · windows 10EPSS93%·Published Jan 10, 2023
- CVE-2023-21547High 7.5Internet Key Exchange (IKE) Protocol Denial of Service Vulnerabilitymicrosoft · windows 10 1607EPSS89%·Published Jan 10, 2023
- CVE-2023-22480Critical 9.8KubeOperator allows unauthorized access to system APIfit2cloud · kubeoperatorEPSS67%·Published Jan 9, 2023
- CVE-2023-22463Critical 9.8KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeysfit2cloud · kubepiEPSS70%·Published Jan 6, 2023
- CVE-2022-44149High 8.8The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component.nexxtsolutions · amp300 firmwareEPSS64%4 exploitsPublished Jan 6, 2023
- CVE-2022-47523Critical 9.8Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.zohocorp · manageengine access manager plusEPSS71%·Published Jan 5, 2023
- CVE-2023-0028Medium 5.4Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.linagora · twakeEPSS56%·Published Dec 31, 2022
- CVE-2022-43396High 8.8Apache Kylin vulnerable to Command injection by Useless configurationapache · kylinEPSS55%·Published Dec 30, 2022
- CVE-2022-47938Medium 6.5fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT.linux · linux kernelEPSS60%·Published Dec 27, 2022
- CVE-2021-45467Critical 9.8In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi…control-webpanel · webpanelEPSS71%·Published Dec 26, 2022
- CVE-2021-45466Critical 9.8In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.control-webpanel · webpanelEPSS55%·Published Dec 26, 2022
- CVE-2022-44456Critical 9.8CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.contec · conprosys hmi systemEPSS70%·Published Dec 19, 2022
- CVE-2022-46689High 7.0A race condition was addressed with additional validation.apple · ipadosEPSS48%1 exploitPublished Dec 15, 2022
- CVE-2022-29517High 8.8A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0.lansweeper · lansweeperEPSS58%·Published Dec 15, 2022
- CVE-2022-4223High 8.8pgadmin4 vulnerable to Code Injectionpgadmin · pgadmin 4EPSS80%·Published Dec 13, 2022
- CVE-2022-44690High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS82%·Published Dec 13, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-40022 | Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. microchip · syncserver s650 firmware | Critical 9.8 | 92% | 1 exploit | |
| CVE-2022-48323 | Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. sunlogin · sunflower | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-45699 | Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter. apsystems · ecu-r firmware | Critical 9.8 | 77% | 1 exploit | |
| CVE-2023-0286 | Vulnerable OpenSSL included in cryptography wheels openssl · openssl | High 7.4 | 71% | · | |
| CVE-2023-25194 | Apache Kafka Connect vulnerable to Deserialization of Untrusted Data apache · kafka connect | High 8.8 | 96% | 1 exploit | |
| CVE-2022-40224 | A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. moxa · sds-3008 firmware | High 7.5 | 65% | · | |
| CVE-2023-22374 | A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. f5 · big-ip access policy manager | High 8.5 | 73% | · | |
| CVE-2022-44268 | ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. imagemagick · imagemagick | Medium 6.5 | 90% | 1 exploit | |
| CVE-2022-44267 | ImageMagick 7.1.0-49 is vulnerable to Denial of Service. imagemagick · imagemagick | Medium 6.5 | 77% | 1 exploit | |
| CVE-2022-3229 | Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated… unifiedremote · unified remote | Critical 9.8 | 66% | 1 exploit | |
| CVE-2023-23333 | There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. contec · solarview compact firmware | Critical 9.8 | 99% | 3 exploits | |
| CVE-2023-20073 | A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. cisco · rv340 firmware | Critical 9.8 | 90% | · | |
| CVE-2023-25136 | OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. openbsd · openssh | Medium 6.5 | 90% | · | |
| CVE-2023-23074 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. zohocorp · manageengine servicedesk plus | Medium 6.1 | 84% | · | |
| CVE-2023-23076 | OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules. zohocorp · manageengine supportcenter plus | Critical 9.8 | 74% | · | |
| CVE-2023-0587 | A file upload vulnerability in exists in Trend Micro Apex One server build 11110. trendmicro · apex one | Critical 9.1 | 60% | · | |
| CVE-2023-3388 | Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting beautiful-cookie-banner · beautiful cookie consent banner | Medium 6.1 | 84% | · | |
| CVE-2022-41142 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 85% | · | |
| CVE-2022-32215 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. llhttp · llhttp | Medium 6.5 | 70% | · | |
| CVE-2022-31706 | The vRealize Log Insight contains a Directory Traversal Vulnerability. vmware · vrealize log insight | Critical 9.8 | 87% | 1 exploit | |
| CVE-2022-31704 | The vRealize Log Insight contains a broken access control vulnerability. vmware · vrealize log insight | Critical 9.8 | 81% | 1 exploit | |
| CVE-2022-31711 | VMware vRealize Log Insight contains an Information Disclosure Vulnerability. vmware · vrealize log insight | Medium 5.3 | 24% | 1 exploit | |
| CVE-2023-22458 | Authenticated users can issue a HRANDFIELD or ZRANDMEMBER command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. redis · redis | Medium 5.5 | 72% | · | |
| CVE-2023-23492 | The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action. idehweb · login with phone number | High 8.8 | 57% | · | |
| CVE-2023-23488 | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route. strangerstudios · paid memberships pro | Critical 9.8 | 92% | 1 exploit | |
| CVE-2023-0126 | Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory. sonicwall · sma1000 firmware | High 7.5 | 73% | · | |
| CVE-2022-46889 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php. nexusphp · nexusphp | Medium 5.4 | 60% | · | |
| CVE-2023-22809 | In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. sudo project · sudo | High 7.8 | 55% | 2 exploits | |
| CVE-2022-44793 | net-snmp - security update net-snmp · net-snmp | Medium 6.5 | 53% | 2 exploits | |
| CVE-2022-44792 | net-snmp - security update net-snmp · net-snmp | Medium 6.5 | 52% | 2 exploits | |
| CVE-2023-0315 | Froxlor vulnerable to Command Injection froxlor · froxlor | High 8.8 | 98% | 2 exploits | |
| CVE-2023-0297 | Code Injection in pyload-ng pyload · pyload | Critical 9.8 | 96% | 2 exploits | |
| CVE-2023-21742 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 56% | · | |
| CVE-2023-21768 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability microsoft · windows 11 | High 7.8 | 65% | 1 exploit | |
| CVE-2023-21758 | Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability microsoft · windows 10 | High 7.5 | 93% | · | |
| CVE-2023-21547 | Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability microsoft · windows 10 1607 | High 7.5 | 89% | · | |
| CVE-2023-22480 | KubeOperator allows unauthorized access to system API fit2cloud · kubeoperator | Critical 9.8 | 67% | · | |
| CVE-2023-22463 | KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys fit2cloud · kubepi | Critical 9.8 | 70% | · | |
| CVE-2022-44149 | The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. nexxtsolutions · amp300 firmware | High 8.8 | 64% | 4 exploits | |
| CVE-2022-47523 | Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. zohocorp · manageengine access manager plus | Critical 9.8 | 71% | · | |
| CVE-2023-0028 | Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+. linagora · twake | Medium 5.4 | 56% | · | |
| CVE-2022-43396 | Apache Kylin vulnerable to Command injection by Useless configuration apache · kylin | High 8.8 | 55% | · | |
| CVE-2022-47938 | fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT. linux · linux kernel | Medium 6.5 | 60% | · | |
| CVE-2021-45467 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi… control-webpanel · webpanel | Critical 9.8 | 71% | · | |
| CVE-2021-45466 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder. control-webpanel · webpanel | Critical 9.8 | 55% | · | |
| CVE-2022-44456 | CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request. contec · conprosys hmi system | Critical 9.8 | 70% | · | |
| CVE-2022-46689 | A race condition was addressed with additional validation. apple · ipados | High 7.0 | 48% | 1 exploit | |
| CVE-2022-29517 | A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. lansweeper · lansweeper | High 8.8 | 58% | · | |
| CVE-2022-4223 | pgadmin4 vulnerable to Code Injection pgadmin · pgadmin 4 | High 8.8 | 80% | · | |
| CVE-2022-44690 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 82% | · |
Showing 701–750 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.