Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2022-41076High 8.5PowerShell Remote Code Execution Vulnerabilitymicrosoft · powershellEPSS61%·Published Dec 13, 2022
- CVE-2022-3786High 7.5OpenSSL: X.509 Email Address Variable Length Buffer Overflowopenssl · opensslEPSS92%·Published Dec 12, 2022
- CVE-2022-41800High 8.7In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint.f5 · big-ip access policy managerEPSS77%3 exploitsPublished Dec 7, 2022
- CVE-2022-41622High 8.8In all versions,f5 · big-ip access policy managerEPSS92%3 exploitsPublished Dec 7, 2022
- CVE-2022-44635High 8.8Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code.apache · fineractEPSS69%·Published Nov 29, 2022
- CVE-2022-45933Critical 9.8KubeView vulnerable to full cluster takeover due to improper authenticationkubeview project · kubeviewEPSS52%·Published Nov 27, 2022
- CVE-2018-25032High 7.5zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.zlib · zlibEPSS52%·Published Nov 25, 2022
- CVE-2022-40770High 7.2Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection.zohocorp · manageengine servicedesk plusEPSS81%·Published Nov 23, 2022
- CVE-2022-3562Medium 5.4Cross-site Scripting in librenms/librenmslibrenms · librenmsEPSS94%·Published Nov 20, 2022
- CVE-2022-4067Medium 5.4Cross-site Scripting in librenms/librenmslibrenms · librenmsEPSS94%·Published Nov 20, 2022
- CVE-2022-4069Medium 4.8Cross-site Scripting in librenms/librenmslibrenms · librenmsEPSS93%·Published Nov 20, 2022
- CVE-2022-42904High 7.2Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.zohocorp · manageengine admanager plusEPSS83%·Published Nov 18, 2022
- CVE-2022-28732Medium 6.1Apache JSPWiki XSS due to crafted request in WeblogPluginapache · jspwikiEPSS82%·Published Nov 17, 2022
- CVE-2022-45402Medium 6.1Apache Airflow Contains Open Redirectapache · airflowEPSS82%·Published Nov 15, 2022
- CVE-2022-40127High 8.8Apache Airflow vulnerable to OS Command Injection via example DAGsapache · airflowEPSS86%·Published Nov 14, 2022
- CVE-2022-43672Critical 9.8Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.zohocorp · manageengine password manager proEPSS67%·Published Nov 12, 2022
- CVE-2022-43671Critical 9.8Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.zohocorp · manageengine password manager proEPSS75%·Published Nov 12, 2022
- CVE-2022-3265Medium 5.4A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2.gitlab · gitlabEPSS87%·Published Nov 10, 2022
- CVE-2022-3602High 7.5X.509 Email Address 4-byte Buffer Overflowopenssl · opensslEPSS91%·Published Nov 1, 2022
- CVE-2022-40471Critical 9.8Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.phporetnom23 · clinic\'s patient management systemEPSS23%3 exploitsPublished Oct 31, 2022
- CVE-2022-38108High 7.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.solarwinds · orion platformEPSS66%1 exploitPublished Oct 20, 2022
- CVE-2022-36958High 8.8SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.solarwinds · orion platformEPSS82%·Published Oct 20, 2022
- CVE-2016-20016Critical 9.8MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI.mvpower · tv-7104he firmwareEPSS86%2 exploitsPublished Oct 19, 2022
- CVE-2022-2992Critical 9.9Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitLabgitlab · gitlabEPSS86%1 exploitPublished Oct 17, 2022
- CVE-2022-2884Critical 9.9Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in GitLabgitlab · gitlabEPSS76%1 exploitPublished Oct 17, 2022
- CVE-2022-38421High 7.2Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user.adobe · coldfusionEPSS80%·Published Oct 14, 2022
- CVE-2022-38419High 7.5Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read.adobe · coldfusionEPSS54%·Published Oct 14, 2022
- CVE-2022-38418Critical 9.8Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user.adobe · coldfusionEPSS80%·Published Oct 14, 2022
- CVE-2022-35711Critical 9.8Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.adobe · coldfusionEPSS74%·Published Oct 14, 2022
- CVE-2022-35690Critical 9.8Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.adobe · coldfusionEPSS73%·Published Oct 14, 2022
- CVE-2022-32174Critical 9.0Gogs vulnerable to Cross-site Scriptinggogs · gogsEPSS58%·Published Oct 11, 2022
- CVE-2022-41034High 7.8Visual Studio Code Remote Code Execution Vulnerabilitymicrosoft · visual studio codeEPSS67%1 exploitPublished Oct 11, 2022
- CVE-2022-38053High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS76%·Published Oct 11, 2022
- CVE-2022-38044High 7.8Windows CD-ROM File System Driver Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS56%·Published Oct 11, 2022
- CVE-2022-39288High 7.5fastify vulnerable to denial of service via malicious Content-Typefastify · fastifyEPSS59%·Published Oct 11, 2022
- CVE-2022-36961High 8.8A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.solarwinds · orion platformEPSS74%·Published Sep 30, 2022
- CVE-2014-0050High 7.5MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended…apache · commons fileuploadEPSS83%1 exploitPublished Sep 28, 2022
- CVE-2022-3218Critical 9.8Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.necta · wifi mouse serverEPSS74%5 exploitsPublished Sep 19, 2022
- CVE-2022-2753Medium 6.1The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation madeketchup restaurant reservations project · ketchup restaurant reservationsEPSS84%·Published Sep 19, 2022
- CVE-2022-40300Critical 9.8Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.zohocorp · manageengine password manager proEPSS99%·Published Sep 16, 2022
- CVE-2022-36096Critical 9.0XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listxwiki · xwikiEPSS60%·Published Sep 16, 2022
- CVE-2022-36097Medium 6.1XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formxwiki · xwikiEPSS58%1 exploitPublished Sep 16, 2022
- CVE-2022-36098Critical 9.0XWiki Platform Mentions UI vulnerable to Cross-site Scriptingxwiki · xwikiEPSS72%·Published Sep 16, 2022
- CVE-2022-36099High 8.8XWiki Platform Wiki UI Main Wiki Eval Injection vulnerabilityxwiki · xwikiEPSS76%1 exploitPublished Sep 16, 2022
- CVE-2022-36100High 8.8XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injectionxwiki · xwikiEPSS74%·Published Sep 16, 2022
- CVE-2022-36094Critical 9.0XWiki Platform Web Parent POM vulnerable to XSS in the attachment historyxwiki · xwikiEPSS65%·Published Sep 16, 2022
- CVE-2022-36534High 8.8Super Flexible Software GmbH & Co.syncovery · syncoveryEPSS52%2 exploitsPublished Sep 16, 2022
- CVE-2022-34721Critical 9.8Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS76%·Published Sep 14, 2022
- CVE-2022-34718Critical 9.8Windows TCP/IP Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS54%·Published Sep 14, 2022
- CVE-2022-35823High 8.8Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint enterprise serverEPSS54%·Published Sep 14, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-41076 | PowerShell Remote Code Execution Vulnerability microsoft · powershell | High 8.5 | 61% | · | |
| CVE-2022-3786 | OpenSSL: X.509 Email Address Variable Length Buffer Overflow openssl · openssl | High 7.5 | 92% | · | |
| CVE-2022-41800 | In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. f5 · big-ip access policy manager | High 8.7 | 77% | 3 exploits | |
| CVE-2022-41622 | In all versions, f5 · big-ip access policy manager | High 8.8 | 92% | 3 exploits | |
| CVE-2022-44635 | Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. apache · fineract | High 8.8 | 69% | · | |
| CVE-2022-45933 | KubeView vulnerable to full cluster takeover due to improper authentication kubeview project · kubeview | Critical 9.8 | 52% | · | |
| CVE-2018-25032 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. zlib · zlib | High 7.5 | 52% | · | |
| CVE-2022-40770 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. zohocorp · manageengine servicedesk plus | High 7.2 | 81% | · | |
| CVE-2022-3562 | Cross-site Scripting in librenms/librenms librenms · librenms | Medium 5.4 | 94% | · | |
| CVE-2022-4067 | Cross-site Scripting in librenms/librenms librenms · librenms | Medium 5.4 | 94% | · | |
| CVE-2022-4069 | Cross-site Scripting in librenms/librenms librenms · librenms | Medium 4.8 | 93% | · | |
| CVE-2022-42904 | Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. zohocorp · manageengine admanager plus | High 7.2 | 83% | · | |
| CVE-2022-28732 | Apache JSPWiki XSS due to crafted request in WeblogPlugin apache · jspwiki | Medium 6.1 | 82% | · | |
| CVE-2022-45402 | Apache Airflow Contains Open Redirect apache · airflow | Medium 6.1 | 82% | · | |
| CVE-2022-40127 | Apache Airflow vulnerable to OS Command Injection via example DAGs apache · airflow | High 8.8 | 86% | · | |
| CVE-2022-43672 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671. zohocorp · manageengine password manager pro | Critical 9.8 | 67% | · | |
| CVE-2022-43671 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. zohocorp · manageengine password manager pro | Critical 9.8 | 75% | · | |
| CVE-2022-3265 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. gitlab · gitlab | Medium 5.4 | 87% | · | |
| CVE-2022-3602 | X.509 Email Address 4-byte Buffer Overflow openssl · openssl | High 7.5 | 91% | · | |
| CVE-2022-40471 | Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php oretnom23 · clinic\'s patient management system | Critical 9.8 | 23% | 3 exploits | |
| CVE-2022-38108 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. solarwinds · orion platform | High 7.2 | 66% | 1 exploit | |
| CVE-2022-36958 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. solarwinds · orion platform | High 8.8 | 82% | · | |
| CVE-2016-20016 | MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. mvpower · tv-7104he firmware | Critical 9.8 | 86% | 2 exploits | |
| CVE-2022-2992 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitLab gitlab · gitlab | Critical 9.9 | 86% | 1 exploit | |
| CVE-2022-2884 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in GitLab gitlab · gitlab | Critical 9.9 | 76% | 1 exploit | |
| CVE-2022-38421 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. adobe · coldfusion | High 7.2 | 80% | · | |
| CVE-2022-38419 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. adobe · coldfusion | High 7.5 | 54% | · | |
| CVE-2022-38418 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. adobe · coldfusion | Critical 9.8 | 80% | · | |
| CVE-2022-35711 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. adobe · coldfusion | Critical 9.8 | 74% | · | |
| CVE-2022-35690 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. adobe · coldfusion | Critical 9.8 | 73% | · | |
| CVE-2022-32174 | Gogs vulnerable to Cross-site Scripting gogs · gogs | Critical 9.0 | 58% | · | |
| CVE-2022-41034 | Visual Studio Code Remote Code Execution Vulnerability microsoft · visual studio code | High 7.8 | 67% | 1 exploit | |
| CVE-2022-38053 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 76% | · | |
| CVE-2022-38044 | Windows CD-ROM File System Driver Remote Code Execution Vulnerability microsoft · windows 10 | High 7.8 | 56% | · | |
| CVE-2022-39288 | fastify vulnerable to denial of service via malicious Content-Type fastify · fastify | High 7.5 | 59% | · | |
| CVE-2022-36961 | A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution. solarwinds · orion platform | High 8.8 | 74% | · | |
| CVE-2014-0050 | MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended… apache · commons fileupload | High 7.5 | 83% | 1 exploit | |
| CVE-2022-3218 | Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution. necta · wifi mouse server | Critical 9.8 | 74% | 5 exploits | |
| CVE-2022-2753 | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made ketchup restaurant reservations project · ketchup restaurant reservations | Medium 6.1 | 84% | · | |
| CVE-2022-40300 | Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities. zohocorp · manageengine password manager pro | Critical 9.8 | 99% | · | |
| CVE-2022-36096 | XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list xwiki · xwiki | Critical 9.0 | 60% | · | |
| CVE-2022-36097 | XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form xwiki · xwiki | Medium 6.1 | 58% | 1 exploit | |
| CVE-2022-36098 | XWiki Platform Mentions UI vulnerable to Cross-site Scripting xwiki · xwiki | Critical 9.0 | 72% | · | |
| CVE-2022-36099 | XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability xwiki · xwiki | High 8.8 | 76% | 1 exploit | |
| CVE-2022-36100 | XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection xwiki · xwiki | High 8.8 | 74% | · | |
| CVE-2022-36094 | XWiki Platform Web Parent POM vulnerable to XSS in the attachment history xwiki · xwiki | Critical 9.0 | 65% | · | |
| CVE-2022-36534 | Super Flexible Software GmbH & Co. syncovery · syncovery | High 8.8 | 52% | 2 exploits | |
| CVE-2022-34721 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 76% | · | |
| CVE-2022-34718 | Windows TCP/IP Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 54% | · | |
| CVE-2022-35823 | Microsoft SharePoint Remote Code Execution Vulnerability microsoft · sharepoint enterprise server | High 8.8 | 54% | · |
Showing 751–800 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.