Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2013-2097High 7.8ZPanel through 10.1.0 has Remote Command Executionzpanel project · zpanelEPSS26%5 exploitsPublished Feb 12, 2020
- CVE-2020-0668High 7.8An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'.microsoft · windows 10EPSS26%3 exploitsPublished Feb 11, 2020
- CVE-2020-0655High 8.0A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an authenticated attacker abuses clipboard redirection, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.microsoft · windows 10EPSS66%·Published Feb 11, 2020
- CVE-2014-7863High 7.5The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users…zohocorp · manageengine applications managerEPSS83%2 exploitsPublished Feb 8, 2020
- CVE-2014-5468High 8.8A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, which could let a remote malicious user obtain sensitive information or execute arbitrary code.getrailo · railoEPSS53%4 exploitsPublished Feb 7, 2020
- CVE-2013-3629High 8.8ISPConfig 3.0.5.2 has Arbitrary PHP Code Executionispconfig · ispconfigEPSS43%3 exploitsPublished Feb 7, 2020
- CVE-2013-3628High 8.8Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerabilityzabbix · zabbixEPSS67%2 exploitsPublished Feb 7, 2020
- CVE-2013-3591High 8.8vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerabilityvtiger · vtiger crmEPSS43%3 exploitsPublished Feb 7, 2020
- CVE-2020-8654High 8.8An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field.eyesofnetwork · eyesofnetworkEPSS92%6 exploitsPublished Feb 6, 2020
- CVE-2013-3568High 8.8Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors.cisco · linksys wrt110 firmwareEPSS25%3 exploitsPublished Feb 6, 2020
- CVE-2015-6000High 8.8Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an…vtiger · vtiger crmEPSS40%3 exploitsPublished Feb 6, 2020
- CVE-2020-5398High 7.5RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Applicationvmware · spring frameworkEPSS89%·Published Jan 21, 2020
- CVE-2020-7246High 8.8A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier.qdpm · qdpmEPSS83%9 exploitsPublished Jan 21, 2020
- CVE-2014-6039High 7.5ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability.zohocorp · manageengine eventlog analyzerEPSS69%2 exploitsPublished Jan 13, 2020
- CVE-2014-6038High 7.5Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability.zohocorp · manageengine eventlog analyzerEPSS73%2 exploitsPublished Jan 13, 2020
- CVE-2015-4553High 8.8A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell.dedecms · dedecmsEPSS57%2 exploitsPublished Jan 6, 2020
- CVE-2019-19509High 8.8A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution.rconfig · rconfigEPSS72%8 exploitsPublished Jan 6, 2020
- CVE-2019-18610High 8.8A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands.digium · asteriskEPSS50%·Published Nov 22, 2019
- CVE-2019-1234High 7.5A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'.microsoft · azure stackEPSS75%·Published Nov 12, 2019
- CVE-2013-1391High 7.5Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration.hachi · hv-04rd pro firmwareEPSS76%1 exploitPublished Oct 30, 2019
- CVE-2019-16663High 8.8An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution.rconfig · rconfigEPSS85%2 exploitsPublished Oct 28, 2019
- CVE-2019-18371High 7.5An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable.mi · millet router 3g firmwareEPSS56%1 exploitPublished Oct 23, 2019
- CVE-2019-14287High 8.8In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID.sudo project · sudoEPSS64%1 exploitPublished Oct 17, 2019
- CVE-2019-1358High 7.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.microsoft · windows 10EPSS76%·Published Oct 10, 2019
- CVE-2019-15226High 7.5Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit.envoyproxy · envoyEPSS65%·Published Oct 9, 2019
- CVE-2019-16667High 8.8diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands.netgate · pfsenseEPSS55%1 exploitPublished Sep 26, 2019
- CVE-2019-10097High 7.2In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference.apache · http serverEPSS53%·Published Sep 26, 2019
- CVE-2015-9406High 7.5Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a ..mtheme-unus project · mtheme-unusEPSS55%1 exploitPublished Sep 20, 2019
- CVE-2019-10669High 7.2There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function.librenms · librenmsEPSS81%3 exploitsPublished Sep 9, 2019
- CVE-2019-16113High 8.8Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname.bludit · bluditEPSS78%8 exploitsPublished Sep 8, 2019
- CVE-2019-15043High 7.5In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use.grafana · grafanaEPSS63%·Published Sep 3, 2019
- CVE-2019-11248High 8.2The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port.kubernetes · kubernetesEPSS75%·Published Aug 29, 2019
- CVE-2019-1936High 7.2A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux…cisco · ucs directorEPSS39%3 exploitsPublished Aug 21, 2019
- CVE-2019-9515High 7.5Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service.redhat · jboss core servicesEPSS87%·Published Aug 13, 2019
- CVE-2019-9513High 7.5Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service.redhat · jboss core servicesEPSS82%·Published Aug 13, 2019
- CVE-2019-9511High 7.5Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service.redhat · jboss core servicesEPSS60%·Published Aug 13, 2019
- CVE-2019-14530High 8.8An attacker can download any file (that is readable by the user www-data) from server storage.open-emr · openemrEPSS66%5 exploitsPublished Aug 13, 2019
- CVE-2019-12257High 8.8Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component.windriver · vxworksEPSS84%·Published Aug 9, 2019
- CVE-2019-10267High 8.8An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50.ahsay · cloud backup suiteEPSS75%5 exploitsPublished Jul 26, 2019
- CVE-2019-14241High 7.5HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c.haproxy · haproxyEPSS70%1 exploitPublished Jul 22, 2019
- CVE-2019-14205High 7.5A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php.nevma · adaptive imagesEPSS63%1 exploitPublished Jul 21, 2019
- CVE-2019-0887High 8.0A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard redirection, aka 'Remote Desktop Services Remote Code Execution Vulnerability'.microsoft · remote desktop clientEPSS71%·Published Jul 15, 2019
- CVE-2018-15812High 7.5Insufficient Entropy in DotNetNukednnsoftware · dotnetnukeEPSS47%2 exploitsPublished Jul 5, 2019
- CVE-2018-18326High 7.5Insufficient Entropy in DotNetNukednnsoftware · dotnetnukeEPSS54%2 exploitsPublished Jul 5, 2019
- CVE-2019-7254High 7.5Linear eMerge E3-Series devices allow File Inclusion.nortekcontrol · linear emerge elite firmwareEPSS82%2 exploitsPublished Jul 2, 2019
- CVE-2019-10072High 7.5Improper Locking in Apache Tomcatapache · tomcatEPSS73%·Published Jun 26, 2019
- CVE-2019-7232High 8.8The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request.abb · pb610 panel builder 600 firmwareEPSS52%1 exploitPublished Jun 24, 2019
- CVE-2019-11479High 7.5Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes.linux · linux kernelEPSS92%·Published Jun 19, 2019
- CVE-2019-11478High 7.5Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences.linux · linux kernelEPSS95%·Published Jun 19, 2019
- CVE-2019-11477High 7.5Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs).linux · linux kernelEPSS99%·Published Jun 19, 2019
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2013-2097 | ZPanel through 10.1.0 has Remote Command Execution zpanel project · zpanel | High 7.8 | 26% | 5 exploits | |
| CVE-2020-0668 | An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of Privilege Vulnerability'. microsoft · windows 10 | High 7.8 | 26% | 3 exploits | |
| CVE-2020-0655 | A remote code execution vulnerability exists in Remote Desktop Services – formerly known as Terminal Services – when an authenticated attacker abuses clipboard redirection, aka 'Remote Desktop Services Remote Code Execution Vulnerability'. microsoft · windows 10 | High 8.0 | 66% | · | |
| CVE-2014-7863 | The FailOverHelperServlet (aka FailServlet) servlet in ZOHO ManageEngine Applications Manager before 11.9 build 11912, OpManager 8 through 11.5 build 11400, and IT360 10.5 and earlier does not properly restrict access, which allows remote attackers and remote authenticated users… zohocorp · manageengine applications manager | High 7.5 | 83% | 2 exploits | |
| CVE-2014-5468 | A File Inclusion vulnerability exists in Railo 4.2.1 and earlier via a specially-crafted URL request to the thumbnail.cfm to specify a malicious PNG file, which could let a remote malicious user obtain sensitive information or execute arbitrary code. getrailo · railo | High 8.8 | 53% | 4 exploits | |
| CVE-2013-3629 | ISPConfig 3.0.5.2 has Arbitrary PHP Code Execution ispconfig · ispconfig | High 8.8 | 43% | 3 exploits | |
| CVE-2013-3628 | Zabbix 2.0.9 has an Arbitrary Command Execution Vulnerability zabbix · zabbix | High 8.8 | 67% | 2 exploits | |
| CVE-2013-3591 | vTiger CRM 5.3 and 5.4: 'files' Upload Folder Arbitrary PHP Code Execution Vulnerability vtiger · vtiger crm | High 8.8 | 43% | 3 exploits | |
| CVE-2020-8654 | An authenticated web user with sufficient privileges could abuse the AutoDiscovery module to run arbitrary OS commands via the /module/module_frame/index.php autodiscovery.php target field. eyesofnetwork · eyesofnetwork | High 8.8 | 92% | 6 exploits | |
| CVE-2013-3568 | Cross-site request forgery (CSRF) vulnerability in Cisco Linksys WRT110 allows remote attackers to hijack the authentication of users for requests that have unspecified impact via unknown vectors. cisco · linksys wrt110 firmware | High 8.8 | 25% | 3 exploits | |
| CVE-2015-6000 | Unrestricted file upload vulnerability in the Settings_Vtiger_CompanyDetailsSave_Action class in modules/Settings/Vtiger/actions/CompanyDetailsSave.php in Vtiger CRM 6.3.0 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an… vtiger · vtiger crm | High 8.8 | 40% | 3 exploits | |
| CVE-2020-5398 | RFD attack via Content-Disposition header sourced from request input by Spring MVC or Spring WebFlux Application vmware · spring framework | High 7.5 | 89% | · | |
| CVE-2020-7246 | A remote code execution (RCE) vulnerability exists in qdPM 9.1 and earlier. qdpm · qdpm | High 8.8 | 83% | 9 exploits | |
| CVE-2014-6039 | ManageEngine EventLog Analyzer version 7 through 9.9 build 9002 has a Credentials Disclosure Vulnerability. zohocorp · manageengine eventlog analyzer | High 7.5 | 69% | 2 exploits | |
| CVE-2014-6038 | Zoho ManageEngine EventLog Analyzer versions 7 through 9.9 build 9002 have a database Information Disclosure Vulnerability. zohocorp · manageengine eventlog analyzer | High 7.5 | 73% | 2 exploits | |
| CVE-2015-4553 | A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. dedecms · dedecms | High 8.8 | 57% | 2 exploits | |
| CVE-2019-19509 | A remote authenticated user can directly execute system commands by sending a GET request to ajaxArchiveFiles.php because the path parameter is passed to the exec function without filtering, which can lead to command execution. rconfig · rconfig | High 8.8 | 72% | 8 exploits | |
| CVE-2019-18610 | A remote authenticated Asterisk Manager Interface (AMI) user without system authorization could use a specially crafted Originate AMI request to execute arbitrary system commands. digium · asterisk | High 8.8 | 50% | · | |
| CVE-2019-1234 | A spoofing vulnerability exists when Azure Stack fails to validate certain requests, aka 'Azure Stack Spoofing Vulnerability'. microsoft · azure stack | High 7.5 | 75% | · | |
| CVE-2013-1391 | Authentication bypass vulnerability in the the web interface in Hunt CCTV, Capture CCTV, Hachi CCTV, NoVus CCTV, and Well-Vision Inc DVR systems allows a remote attacker to retrieve the device configuration. hachi · hv-04rd pro firmware | High 7.5 | 76% | 1 exploit | |
| CVE-2019-16663 | An attacker can directly execute system commands by sending a GET request to search.crud.php because the catCommand parameter is passed to the exec function without filtering, which can lead to command execution. rconfig · rconfig | High 8.8 | 85% | 2 exploits | |
| CVE-2019-18371 | An issue was discovered on Xiaomi Mi WiFi R3G devices before 2.28.23-stable. mi · millet router 3g firmware | High 7.5 | 56% | 1 exploit | |
| CVE-2019-14287 | In Sudo before 1.8.28, an attacker with access to a Runas ALL sudoer account can bypass certain policy blacklists and session PAM modules, and can cause incorrect logging, by invoking sudo with a crafted user ID. sudo project · sudo | High 8.8 | 64% | 1 exploit | |
| CVE-2019-1358 | A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. microsoft · windows 10 | High 7.8 | 76% | · | |
| CVE-2019-15226 | Upon receiving each incoming request header data, Envoy will iterate over existing request headers to verify that the total size of the headers stays below a maximum limit. envoyproxy · envoy | High 7.5 | 65% | · | |
| CVE-2019-16667 | diag_command.php in pfSense 2.4.4-p3 allows CSRF via the txtCommand or txtRecallBuffer field, as demonstrated by executing OS commands. netgate · pfsense | High 8.8 | 55% | 1 exploit | |
| CVE-2019-10097 | In Apache HTTP Server 2.4.32-2.4.39, when mod_remoteip was configured to use a trusted intermediary proxy server using the "PROXY" protocol, a specially crafted PROXY header could trigger a stack buffer overflow or NULL pointer deference. apache · http server | High 7.2 | 53% | · | |
| CVE-2015-9406 | Directory traversal vulnerability in the mTheme-Unus theme before 2.3 for WordPress allows an attacker to read arbitrary files via a .. mtheme-unus project · mtheme-unus | High 7.5 | 55% | 1 exploit | |
| CVE-2019-10669 | There is a command injection vulnerability in html/includes/graphs/device/collectd.inc.php where user supplied parameters are filtered with the mysqli_escape_real_string function. librenms · librenms | High 7.2 | 81% | 3 exploits | |
| CVE-2019-16113 | Bludit 3.9.2 allows remote code execution via bl-kernel/ajax/upload-images.php because PHP code can be entered with a .jpg file name, and then this PHP code can write other PHP code to a ../ pathname. bludit · bludit | High 8.8 | 78% | 8 exploits | |
| CVE-2019-15043 | In Grafana 2.x through 6.x before 6.3.4, parts of the HTTP API allow unauthenticated use. grafana · grafana | High 7.5 | 63% | · | |
| CVE-2019-11248 | The debugging endpoint /debug/pprof is exposed over the unauthenticated Kubelet healthz port. kubernetes · kubernetes | High 8.2 | 75% | · | |
| CVE-2019-1936 | A vulnerability in the web-based management interface of Cisco Integrated Management Controller (IMC) Supervisor, Cisco UCS Director, and Cisco UCS Director Express for Big Data could allow an authenticated, remote attacker to execute arbitrary commands on the underlying Linux… cisco · ucs director | High 7.2 | 39% | 3 exploits | |
| CVE-2019-9515 | Some HTTP/2 implementations are vulnerable to a settings flood, potentially leading to a denial of service. redhat · jboss core services | High 7.5 | 87% | · | |
| CVE-2019-9513 | Some HTTP/2 implementations are vulnerable to resource loops, potentially leading to a denial of service. redhat · jboss core services | High 7.5 | 82% | · | |
| CVE-2019-9511 | Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. redhat · jboss core services | High 7.5 | 60% | · | |
| CVE-2019-14530 | An attacker can download any file (that is readable by the user www-data) from server storage. open-emr · openemr | High 8.8 | 66% | 5 exploits | |
| CVE-2019-12257 | Wind River VxWorks 6.6 through 6.9 has a Buffer Overflow in the DHCP client component. windriver · vxworks | High 8.8 | 84% | · | |
| CVE-2019-10267 | An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.1.0.50. ahsay · cloud backup suite | High 8.8 | 75% | 5 exploits | |
| CVE-2019-14241 | HAProxy through 2.0.2 allows attackers to cause a denial of service (ha_panic) via vectors related to htx_manage_client_side_cookies in proto_htx.c. haproxy · haproxy | High 7.5 | 70% | 1 exploit | |
| CVE-2019-14205 | A Local File Inclusion vulnerability in the Nevma Adaptive Images plugin before 0.6.67 for WordPress allows remote attackers to retrieve arbitrary files via the $REQUEST['adaptive-images-settings']['source_file'] parameter in adaptive-images-script.php. nevma · adaptive images | High 7.5 | 63% | 1 exploit | |
| CVE-2019-0887 | A remote code execution vulnerability exists in Remote Desktop Services - formerly known as Terminal Services - when an authenticated attacker abuses clipboard redirection, aka 'Remote Desktop Services Remote Code Execution Vulnerability'. microsoft · remote desktop client | High 8.0 | 71% | · | |
| CVE-2018-15812 | Insufficient Entropy in DotNetNuke dnnsoftware · dotnetnuke | High 7.5 | 47% | 2 exploits | |
| CVE-2018-18326 | Insufficient Entropy in DotNetNuke dnnsoftware · dotnetnuke | High 7.5 | 54% | 2 exploits | |
| CVE-2019-7254 | Linear eMerge E3-Series devices allow File Inclusion. nortekcontrol · linear emerge elite firmware | High 7.5 | 82% | 2 exploits | |
| CVE-2019-10072 | Improper Locking in Apache Tomcat apache · tomcat | High 7.5 | 73% | · | |
| CVE-2019-7232 | The ABB IDAL HTTP server is vulnerable to a buffer overflow when a long Host header is sent in a web request. abb · pb610 panel builder 600 firmware | High 8.8 | 52% | 1 exploit | |
| CVE-2019-11479 | Jonathan Looney discovered that the Linux kernel default MSS is hard-coded to 48 bytes. linux · linux kernel | High 7.5 | 92% | · | |
| CVE-2019-11478 | Jonathan Looney discovered that the TCP retransmission queue implementation in tcp_fragment in the Linux kernel could be fragmented when handling certain TCP Selective Acknowledgment (SACK) sequences. linux · linux kernel | High 7.5 | 95% | · | |
| CVE-2019-11477 | Jonathan Looney discovered that the TCP_SKB_CB(skb)->tcp_gso_segs value was subject to an integer overflow in the Linux kernel when handling TCP Selective Acknowledgments (SACKs). linux · linux kernel | High 7.5 | 99% | · |
Showing 701–750 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.