Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2019-6441Critical 9.8An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices.coship · rt3050 firmwareEPSS54%4 exploitsPublished Mar 21, 2019
- CVE-2018-20526Critical 9.8Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php.roxyfileman · roxy filemanEPSS73%1 exploitPublished Mar 21, 2019
- CVE-2018-19524Critical 9.8An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SDOTBGN1 devices.skyworthdigital · dt721-cb firmwareEPSS51%3 exploitsPublished Mar 21, 2019
- CVE-2018-19276Critical 9.8OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body.openmrs · openmrsEPSS99%5 exploitsPublished Mar 21, 2019
- CVE-2019-0192Critical 9.8Critical severity vulnerability that affects org.apache.solr:solr-coreapache · solrEPSS78%·Published Mar 14, 2019
- CVE-2019-9760Critical 9.8FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-controlled machine that sends crafted responses.ftpgetter · ftpgetterEPSS53%4 exploitsPublished Mar 13, 2019
- CVE-2019-5420Critical 9.8Use of Insufficiently Random Values in Railties Allows Remote Code Executionrubyonrails · railsEPSS89%2 exploitsPublished Mar 13, 2019
- CVE-2019-0626Critical 9.8A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'.microsoft · windows 10EPSS69%·Published Mar 5, 2019
- CVE-2019-1663Critical 9.8A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected…cisco · rv110w firmwareEPSS96%5 exploitsPublished Feb 28, 2019
- CVE-2018-17431Critical 9.8Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL.comodo · unified threat management firewallEPSS84%3 exploitsPublished Jan 30, 2019
- CVE-2019-6443Critical 9.1Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd.ntpsec · ntpsecEPSS67%2 exploitsPublished Jan 16, 2019
- CVE-2018-16167Critical 9.8LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.jpcert · logontracerEPSS75%1 exploitPublished Jan 9, 2019
- CVE-2019-0547Critical 9.8A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka "Windows DHCP Client Remote Code Execution Vulnerability." This affects Windows 10, Windows 10 Servers.microsoft · windows 10EPSS71%·Published Jan 8, 2019
- CVE-2018-17246Critical 9.8Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin.elastic · kibanaEPSS82%·Published Dec 20, 2018
- CVE-2018-15708Critical 9.8Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request.nagios · nagios xiEPSS89%4 exploitsPublished Nov 14, 2018
- CVE-2018-8476Critical 9.8A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "Windows Deployment Services TFTP Server Remote Code Execution Vulnerability." This affects Windows Server 2012 R2, Windows Server 2008, Windows…microsoft · windows server 2008EPSS65%·Published Nov 13, 2018
- CVE-2018-19207Critical 9.8The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.van-ons · wp-gdpr-complianceEPSS88%·Published Nov 12, 2018
- CVE-2018-8021Critical 9.3Deserialization of Untrusted Data in supersetapache · supersetEPSS53%·Published Nov 9, 2018
- CVE-2018-15439Critical 9.8A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device.cisco · sf200-24 firmwareEPSS50%1 exploitPublished Nov 8, 2018
- CVE-2018-15381Critical 9.8A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user.cisco · unity expressEPSS87%·Published Nov 8, 2018
- CVE-2018-9206Critical 9.8Unrestricted Upload of File with Dangerous Type in blueimp-file-uploadjquery file upload project · jquery file uploadEPSS97%4 exploitsPublished Oct 22, 2018
- CVE-2017-11467Critical 9.8OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injectionorientdb · orientdbEPSS73%2 exploitsPublished Oct 18, 2018
- CVE-2018-1275Critical 9.8Spring Framework has Improperly Implemented Security Check for Standardvmware · spring frameworkEPSS57%·Published Oct 17, 2018
- CVE-2018-1270Critical 9.8Spring Framework allows applications to expose STOMP over WebSocket endpointsvmware · spring frameworkEPSS77%·Published Oct 17, 2018
- CVE-2017-12629Critical 9.8Remote code execution occurs in Apache Solrapache · solrEPSS92%2 exploitsPublished Oct 17, 2018
- CVE-2018-3245Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS94%2 exploitsPublished Oct 16, 2018
- CVE-2018-3191Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS63%·Published Oct 16, 2018
- CVE-2017-12611Critical 9.8Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literalapache · strutsEPSS87%1 exploitPublished Oct 16, 2018
- CVE-2015-2794Critical 9.8The installation wizard in DotNetNuke (DNN) allows privilege escalationdnnsoftware · dotnetnukeEPSS75%·Published Oct 16, 2018
- CVE-2018-17532Critical 9.8Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization.teltonika · rut900 firmwareEPSS71%2 exploitsPublished Oct 15, 2018
- CVE-2012-6710Critical 9.8ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php.extplorer · extplorerEPSS25%1 exploitPublished Oct 7, 2018
- CVE-2018-17456Critical 9.8Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a…git-scm · gitEPSS97%5 exploitsPublished Oct 6, 2018
- CVE-2018-15379Critical 9.8A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file.cisco · prime infrastructureEPSS86%3 exploitsPublished Oct 5, 2018
- CVE-2018-17552Critical 9.8SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie.naviwebs · navigate cmsEPSS84%4 exploitsPublished Oct 3, 2018
- CVE-2018-16283Critical 9.8The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter.wechat brodcast project · wechat brodcastEPSS63%2 exploitsPublished Sep 24, 2018
- CVE-2018-17173Critical 9.8LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail.lg · supersign cmsEPSS56%2 exploitsPublished Sep 21, 2018
- CVE-2018-17254Critical 9.8The JCK Editor component 6.4.4 for Joomla!arkextensions · jck editorEPSS83%4 exploitsPublished Sep 20, 2018
- CVE-2018-17243Critical 9.8Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection.zohocorp · manageengine opmanagerEPSS75%·Published Sep 20, 2018
- CVE-2018-17153Critical 9.8It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability.western digital · my cloud dl2100EPSS87%1 exploitPublished Sep 18, 2018
- CVE-2018-16836Critical 9.8Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI.rubedo project · rubedoEPSS61%3 exploitsPublished Sep 11, 2018
- CVE-2018-16763Critical 9.8FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter.thedaylightstudio · fuel cmsEPSS83%6 exploitsPublished Sep 9, 2018
- CVE-2015-9266Critical 9.8The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques.ubnt · airos 4 xs2EPSS74%4 exploitsPublished Sep 5, 2018
- CVE-2018-17207Critical 9.8Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Executionawesomemotive · duplicatorEPSS60%1 exploitPublished Aug 28, 2018
- CVE-2018-14007Critical 9.8Citrix XenServer 7.1 and newer allows Directory Traversal.citrix · xenserverEPSS56%·Published Aug 15, 2018
- CVE-2018-14417Critical 9.8A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3.softnas · cloudEPSS89%2 exploitsPublished Aug 3, 2018
- CVE-2018-14728Critical 9.8upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter.tecrail · responsive filemanagerEPSS76%3 exploitsPublished Aug 3, 2018
- CVE-2017-5941Critical 9.8Code Execution through IIFE in node-serializenode-serialize project · node-serializeEPSS61%3 exploitsPublished Jul 18, 2018
- CVE-2018-2894Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS50%·Published Jul 18, 2018
- CVE-2018-2893Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS70%·Published Jul 18, 2018
- CVE-2016-6563Critical 9.8Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers.dlink · dir-818l\(w\) firmwareEPSS80%3 exploitsPublished Jul 13, 2018
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-6441 | An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. coship · rt3050 firmware | Critical 9.8 | 54% | 4 exploits | |
| CVE-2018-20526 | Roxy Fileman 1.4.5 allows unrestricted file upload in upload.php. roxyfileman · roxy fileman | Critical 9.8 | 73% | 1 exploit | |
| CVE-2018-19524 | An issue was discovered on Shenzhen Skyworth DT741 Converged Intelligent Terminal (G/EPON+IPTV) SDOTBGN1, DT721-cb SDOTBGN1, and DT741-cb SDOTBGN1 devices. skyworthdigital · dt721-cb firmware | Critical 9.8 | 51% | 3 exploits | |
| CVE-2018-19276 | OpenMRS before 2.24.0 is affected by an Insecure Object Deserialization vulnerability that allows an unauthenticated user to execute arbitrary commands on the targeted system via crafted XML data in a request body. openmrs · openmrs | Critical 9.8 | 99% | 5 exploits | |
| CVE-2019-0192 | Critical severity vulnerability that affects org.apache.solr:solr-core apache · solr | Critical 9.8 | 78% | · | |
| CVE-2019-9760 | FTPGetter Standard v.5.97.0.177 allows remote code execution when a user initiates an FTP connection to an attacker-controlled machine that sends crafted responses. ftpgetter · ftpgetter | Critical 9.8 | 53% | 4 exploits | |
| CVE-2019-5420 | Use of Insufficiently Random Values in Railties Allows Remote Code Execution rubyonrails · rails | Critical 9.8 | 89% | 2 exploits | |
| CVE-2019-0626 | A memory corruption vulnerability exists in the Windows Server DHCP service when an attacker sends specially crafted packets to a DHCP server, aka 'Windows DHCP Server Remote Code Execution Vulnerability'. microsoft · windows 10 | Critical 9.8 | 69% | · | |
| CVE-2019-1663 | A vulnerability in the web-based management interface of the Cisco RV110W Wireless-N VPN Firewall, Cisco RV130W Wireless-N Multifunction VPN Router, and Cisco RV215W Wireless-N VPN Router could allow an unauthenticated, remote attacker to execute arbitrary code on an affected… cisco · rv110w firmware | Critical 9.8 | 96% | 5 exploits | |
| CVE-2018-17431 | Web Console in Comodo UTM Firewall before 2.7.0 allows remote attackers to execute arbitrary code without authentication via a crafted URL. comodo · unified threat management firewall | Critical 9.8 | 84% | 3 exploits | |
| CVE-2019-6443 | Because of a bug in ctl_getitem, there is a stack-based buffer over-read in read_sysvars in ntp_control.c in ntpd. ntpsec · ntpsec | Critical 9.1 | 67% | 2 exploits | |
| CVE-2018-16167 | LogonTracer 1.2.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors. jpcert · logontracer | Critical 9.8 | 75% | 1 exploit | |
| CVE-2019-0547 | A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka "Windows DHCP Client Remote Code Execution Vulnerability." This affects Windows 10, Windows 10 Servers. microsoft · windows 10 | Critical 9.8 | 71% | · | |
| CVE-2018-17246 | Kibana versions before 6.4.3 and 5.6.13 contain an arbitrary file inclusion flaw in the Console plugin. elastic · kibana | Critical 9.8 | 82% | · | |
| CVE-2018-15708 | Snoopy 1.0 in Nagios XI 5.5.6 allows remote unauthenticated attackers to execute arbitrary commands via a crafted HTTP request. nagios · nagios xi | Critical 9.8 | 89% | 4 exploits | |
| CVE-2018-8476 | A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "Windows Deployment Services TFTP Server Remote Code Execution Vulnerability." This affects Windows Server 2012 R2, Windows Server 2008, Windows… microsoft · windows server 2008 | Critical 9.8 | 65% | · | |
| CVE-2018-19207 | The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018. van-ons · wp-gdpr-compliance | Critical 9.8 | 88% | · | |
| CVE-2018-8021 | Deserialization of Untrusted Data in superset apache · superset | Critical 9.3 | 53% | · | |
| CVE-2018-15439 | A vulnerability in the Cisco Small Business Switches software could allow an unauthenticated, remote attacker to bypass the user authentication mechanism of an affected device. cisco · sf200-24 firmware | Critical 9.8 | 50% | 1 exploit | |
| CVE-2018-15381 | A Java deserialization vulnerability in Cisco Unity Express (CUE) could allow an unauthenticated, remote attacker to execute arbitrary shell commands with the privileges of the root user. cisco · unity express | Critical 9.8 | 87% | · | |
| CVE-2018-9206 | Unrestricted Upload of File with Dangerous Type in blueimp-file-upload jquery file upload project · jquery file upload | Critical 9.8 | 97% | 4 exploits | |
| CVE-2017-11467 | OrientDB vulnerable to Improper Privilage Management leading to arbitrary command injection orientdb · orientdb | Critical 9.8 | 73% | 2 exploits | |
| CVE-2018-1275 | Spring Framework has Improperly Implemented Security Check for Standard vmware · spring framework | Critical 9.8 | 57% | · | |
| CVE-2018-1270 | Spring Framework allows applications to expose STOMP over WebSocket endpoints vmware · spring framework | Critical 9.8 | 77% | · | |
| CVE-2017-12629 | Remote code execution occurs in Apache Solr apache · solr | Critical 9.8 | 92% | 2 exploits | |
| CVE-2018-3245 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. oracle · weblogic server | Critical 9.8 | 94% | 2 exploits | |
| CVE-2018-3191 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. oracle · weblogic server | Critical 9.8 | 63% | · | |
| CVE-2017-12611 | Apache Struts 2.0.1 uses an unintentional expression in a Freemarker tag instead of string literal apache · struts | Critical 9.8 | 87% | 1 exploit | |
| CVE-2015-2794 | The installation wizard in DotNetNuke (DNN) allows privilege escalation dnnsoftware · dotnetnuke | Critical 9.8 | 75% | · | |
| CVE-2018-17532 | Teltonika RUT9XX routers with firmware before 00.04.233 are prone to multiple unauthenticated OS command injection vulnerabilities in autologin.cgi and hotspotlogin.cgi due to insufficient user input sanitization. teltonika · rut900 firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2012-6710 | ext_find_user in eXtplorer through 2.1.2 allows remote attackers to bypass authentication via a password[]= (aka an empty array) in an action=login request to index.php. extplorer · extplorer | Critical 9.8 | 25% | 1 exploit | |
| CVE-2018-17456 | Git before 2.14.5, 2.15.x before 2.15.3, 2.16.x before 2.16.5, 2.17.x before 2.17.2, 2.18.x before 2.18.1, and 2.19.x before 2.19.1 allows remote code execution during processing of a recursive "git clone" of a superproject if a .gitmodules file has a URL field beginning with a… git-scm · git | Critical 9.8 | 97% | 5 exploits | |
| CVE-2018-15379 | A vulnerability in which the HTTP web server for Cisco Prime Infrastructure (PI) has unrestricted directory permissions could allow an unauthenticated, remote attacker to upload an arbitrary file. cisco · prime infrastructure | Critical 9.8 | 86% | 3 exploits | |
| CVE-2018-17552 | SQL Injection in login.php in Naviwebs Navigate CMS 2.8 allows remote attackers to bypass authentication via the navigate-user cookie. naviwebs · navigate cms | Critical 9.8 | 84% | 4 exploits | |
| CVE-2018-16283 | The Wechat Broadcast plugin 1.2.0 and earlier for WordPress allows Directory Traversal via the Image.php url parameter. wechat brodcast project · wechat brodcast | Critical 9.8 | 63% | 2 exploits | |
| CVE-2018-17173 | LG SuperSign CMS allows remote attackers to execute arbitrary code via the sourceUri parameter to qsr_server/device/getThumbnail. lg · supersign cms | Critical 9.8 | 56% | 2 exploits | |
| CVE-2018-17254 | The JCK Editor component 6.4.4 for Joomla! arkextensions · jck editor | Critical 9.8 | 83% | 4 exploits | |
| CVE-2018-17243 | Global Search in Zoho ManageEngine OpManager before 12.3 123205 allows SQL Injection. zohocorp · manageengine opmanager | Critical 9.8 | 75% | · | |
| CVE-2018-17153 | It was discovered that the Western Digital My Cloud device before 2.30.196 is affected by an authentication bypass vulnerability. western digital · my cloud dl2100 | Critical 9.8 | 87% | 1 exploit | |
| CVE-2018-16836 | Rubedo through 3.4.0 contains a Directory Traversal vulnerability in the theme component, allowing unauthenticated attackers to read and execute arbitrary files outside of the service root path, as demonstrated by a /theme/default/img/%2e%2e/..//etc/passwd URI. rubedo project · rubedo | Critical 9.8 | 61% | 3 exploits | |
| CVE-2018-16763 | FUEL CMS 1.4.1 allows PHP Code Evaluation via the pages/select/ filter parameter or the preview/ data parameter. thedaylightstudio · fuel cms | Critical 9.8 | 83% | 6 exploits | |
| CVE-2015-9266 | The web management interface of Ubiquiti airMAX, airFiber, airGateway and EdgeSwitch XP (formerly TOUGHSwitch) allows an unauthenticated attacker to upload and write arbitrary files using directory traversal techniques. ubnt · airos 4 xs2 | Critical 9.8 | 74% | 4 exploits | |
| CVE-2018-17207 | Duplicator <= 1.2.41 - Sensitive Information Disclosure leading to Remote Code Execution awesomemotive · duplicator | Critical 9.8 | 60% | 1 exploit | |
| CVE-2018-14007 | Citrix XenServer 7.1 and newer allows Directory Traversal. citrix · xenserver | Critical 9.8 | 56% | · | |
| CVE-2018-14417 | A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. softnas · cloud | Critical 9.8 | 89% | 2 exploits | |
| CVE-2018-14728 | upload.php in Responsive FileManager 9.13.1 allows SSRF via the url parameter. tecrail · responsive filemanager | Critical 9.8 | 76% | 3 exploits | |
| CVE-2017-5941 | Code Execution through IIFE in node-serialize node-serialize project · node-serialize | Critical 9.8 | 61% | 3 exploits | |
| CVE-2018-2894 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. oracle · weblogic server | Critical 9.8 | 50% | · | |
| CVE-2018-2893 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. oracle · weblogic server | Critical 9.8 | 70% | · | |
| CVE-2016-6563 | Processing malformed SOAP messages when performing the HNAP Login action causes a buffer overflow in the stack in some D-Link DIR routers. dlink · dir-818l\(w\) firmware | Critical 9.8 | 80% | 3 exploits |
Showing 751–800 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.