Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
1,474 vulnerabilities · highest exploit probability first
  • CVE-2018-18852High 8.8
    Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature's use of Save.cgi to execute a ping command, as exploited in the wild in October 2018.
    cerio · dt-300n firmware
    EPSS64%
    ·
    Published Jun 18, 2019
  • CVE-2019-11409High 8.8
    app/operator_panel/exec.php in the Operator Panel module in FusionPBX 4.4.3 suffers from a command injection vulnerability due to a lack of input validation that allows authenticated non-administrative attackers to execute commands on the host.
    fusionpbx · fusionpbx
    EPSS87%
    4 exploits
    Published Jun 17, 2019
  • CVE-2019-12181High 8.8
    A privilege escalation vulnerability exists in SolarWinds Serv-U before 15.1.7 for Linux.
    solarwinds · serv-u ftp server
    EPSS65%
    6 exploits
    Published Jun 17, 2019
  • CVE-2019-12840High 8.8
    In Webmin through 1.910, any user authorized to the "Package Updates" module can execute arbitrary commands with root privileges via the data parameter to update.cgi.
    webmin · webmin
    EPSS77%
    2 exploits
    Published Jun 15, 2019
  • CVE-2019-12276High 7.5
    A Path Traversal vulnerability in Controllers/LetsEncryptController.cs in LetsEncryptController in GrandNode 4.40 allows remote, unauthenticated attackers to retrieve arbitrary files on the web server via specially crafted LetsEncrypt/Index?fileName= HTTP requests.
    grandnode · grandnode
    EPSS57%
    1 exploit
    Published Jun 5, 2019
  • CVE-2019-5355High 7.5
    A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
    hp · intelligent management center
    EPSS54%
    ·
    Published Jun 5, 2019
  • CVE-2018-7123High 7.5
    A remote denial of service vulnerability was identified in HPE Intelligent Management Center (IMC) PLAT earlier than version 7.3 E0506P09.
    hp · intelligent management center
    EPSS58%
    ·
    Published Jun 5, 2019
  • CVE-2019-12169High 8.8
    ATutor 2.2.4 allows Arbitrary File Upload and Directory Traversal, resulting in remote code execution via a ".." pathname in a ZIP archive to the mods/_core/languages/language_import.php (aka Import New Language) or mods/_standard/patcher/index_admin.php (aka Patcher) component.
    atutor · atutor
    EPSS72%
    4 exploits
    Published Jun 3, 2019
  • CVE-2019-7111High 8.8
    Adobe Acrobat and Reader versions 2019.010.20098 and earlier, 2019.010.20098 and earlier, 2017.011.30127 and earlier version, and 2015.006.30482 and earlier have an out-of-bounds write vulnerability.
    adobe · acrobat dc
    EPSS56%
    ·
    Published May 23, 2019
  • CVE-2019-8442High 7.5
    The CachingResourceDownloadRewriteRule class in Jira before version 7.13.4, and from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to access files in the Jira webroot under the META-INF directory via a lax path access…
    atlassian · jira
    EPSS60%
    ·
    Published May 22, 2019
  • CVE-2019-0227High 7.5
    Server Side Request Forgery in Apache Axis
    apache · axis
    EPSS92%
    1 exploit
    Published May 14, 2019
  • CVE-2019-11600High 8.1
    A SQL injection vulnerability in the activities API in OpenProject before 8.3.2 allows a remote attacker to execute arbitrary SQL commands via the id parameter.
    openproject · openproject
    EPSS80%
    2 exploits
    Published May 13, 2019
  • CVE-2017-18372High 8.8
    The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router distributed by TrueOnline has a command injection vulnerability in the Time Setting function, which is only accessible by an authenticated user.
    billion · 5200w-t firmware
    EPSS22%
    1 exploit
    Published May 2, 2019
  • CVE-2017-18370High 8.8
    The ZyXEL P660HN-T1A v2 TCLinux Fw #7.3.37.6 router distributed by TrueOnline has a command injection vulnerability in the Remote System Log forwarding function, which is only accessible by an authenticated user.
    zyxel · p660hn-t1a v1 firmware
    EPSS24%
    1 exploit
    Published May 2, 2019
  • CVE-2019-11542High 7.2
    In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1RX before 8.1R15.1 and Pulse Policy Secure version 9.0RX before 9.0R3.2, 5.4RX before 5.4R7.1, 5.3RX before 5.3R12.1, 5.2RX before 5.2R12.1, and 5.1RX before…
    ivanti · connect secure
    EPSS66%
    ·
    Published Apr 25, 2019
  • CVE-2019-2578High 8.6
    The supported version that is affected is 12.2.1.3.0.
    oracle · webcenter sites
    EPSS72%
    ·
    Published Apr 23, 2019
  • CVE-2019-11447High 8.8
    An attacker can infiltrate the server through the avatar upload process in the profile area via the avatar_file field to index.php?mod=main&opt=personal.
    cutephp · cutenews
    EPSS53%
    3 exploits
    Published Apr 22, 2019
  • CVE-2019-9193High 7.2
    In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context of the database's operating system user.
    postgresql · postgresql
    EPSS92%
    2 exploits
    Published Apr 1, 2019
  • CVE-2019-10662High 8.8
    Grandstream UCM6204 before 1.0.19.20 devices allow remote authenticated users to execute arbitrary code via shell metacharacters in the backupUCMConfig file-backup parameter to the /cgi?
    grandstream · ucm6204 firmware
    EPSS44%
    1 exploit
    Published Mar 30, 2019
  • CVE-2019-9053High 8.1
    It is possible with the News module, through a crafted URL, to achieve unauthenticated blind time-based SQL injection via the m1_idlist parameter.
    cmsmadesimple · cms made simple
    EPSS69%
    3 exploits
    Published Mar 26, 2019
  • CVE-2018-16858High 7.8
    It was found that libreoffice before versions 6.0.7 and 6.1.3 was vulnerable to a directory traversal attack which could be used to execute arbitrary macros bundled with a document.
    EPSS67%
    5 exploits
    Published Mar 25, 2019
  • CVE-2018-20323High 8.8
    www/soap/application/MCSoap/Logs.php in MailCleaner Community Edition 2018.08 allows remote attackers to execute arbitrary OS commands.
    mailcleaner · mailcleaner
    EPSS54%
    2 exploits
    Published Mar 21, 2019
  • CVE-2018-10093High 8.8
    AudioCodes IP phone 420HD devices using firmware version 2.2.12.126 allow Remote Code Execution.
    audiocodes · 420hd ip phone firmware
    EPSS68%
    3 exploits
    Published Mar 21, 2019
  • CVE-2019-9624High 7.8
    Webmin 1.900 allows remote attackers to execute arbitrary code by leveraging the "Java file manager" and "Upload and Download" privileges to upload a crafted .cgi file via the /updown/upload.cgi URI.
    webmin · webmin
    EPSS24%
    2 exploits
    Published Mar 7, 2019
  • CVE-2019-0618High 8.8
    A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
    microsoft · windows 10
    EPSS67%
    ·
    Published Mar 5, 2019
  • CVE-2019-8903High 7.5
    Path Traversal in total.js
    totaljs · total.js
    EPSS72%
    ·
    Published Feb 20, 2019
  • CVE-2019-8942High 8.8
    WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an _wp_attached_file Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring.
    wordpress · wordpress
    EPSS83%
    6 exploits
    Published Feb 20, 2019
  • CVE-2019-6453High 8.1
    mIRC before 7.55 allows remote command execution by using argument injection through custom URI protocol handlers.
    mirc · mirc
    EPSS54%
    3 exploits
    Published Feb 18, 2019
  • CVE-2019-5736High 8.6
    runc through 1.0-rc6, as used in Docker before 18.09.2 and other products, allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new…
    docker · docker
    EPSS98%
    8 exploits
    Published Feb 11, 2019
  • CVE-2018-11803High 7.5
    Subversion's mod_dav_svn Apache HTTPD module versions 1.11.0 and 1.10.0 to 1.10.3 will crash after dereferencing an uninitialized pointer if the client omits the root path in a recursive directory listing operation.
    apache · subversion
    EPSS58%
    ·
    Published Feb 5, 2019
  • CVE-2019-0190High 7.5
    A remote attacker could send a carefully crafted request that would cause mod_ssl to enter a loop leading to a denial of service.
    apache · http server
    EPSS59%
    ·
    Published Jan 30, 2019
  • CVE-2019-6977High 8.8
    gdImageColorMatch in gd_color_match.c in the GD Graphics Library (aka LibGD) 2.2.5, as used in the imagecolormatch function in PHP before 5.6.40, 7.x before 7.1.26, 7.2.x before 7.2.14, and 7.3.x before 7.3.1, has a heap-based buffer overflow.
    libgd · libgd
    EPSS71%
    1 exploit
    Published Jan 27, 2019
  • CVE-2018-5740High 7.5
    "deny-answer-aliases" is a little-used feature intended to help recursive server operators protect end users against DNS rebinding attacks, a potential method of circumventing the security model used by client browsers.
    isc · bind
    EPSS60%
    ·
    Published Jan 16, 2019
  • CVE-2017-3144High 7.5
    A vulnerability stemming from failure to properly clean up closed OMAPI connections can lead to exhaustion of the pool of socket descriptors available to the DHCP server.
    isc · dhcp
    EPSS73%
    ·
    Published Jan 16, 2019
  • CVE-2019-6447High 8.1
    The ES File Explorer File Manager application through 4.1.9.7.4 for Android allows remote attackers to read arbitrary files or execute applications via TCP port 59777 requests on the local Wi-Fi network.
    estrongs · es file explorer file manager
    EPSS64%
    3 exploits
    Published Jan 16, 2019
  • CVE-2018-18264High 7.5
    Kubernetes Dashboard before 1.10.1 allows attackers to bypass authentication and use Dashboard's Service Account for reading secrets within the cluster.
    kubernetes · dashboard
    EPSS70%
    ·
    Published Jan 2, 2019
  • CVE-2018-20247High 7.8
    In Foxit Quick PDF Library (all versions prior to 16.12), issue where loading a malformed or malicious PDF containing a recursive page tree structure using the LoadFromFile, LoadFromString or LoadFromStream functions results in a stack overflow.
    foxitsoftware · quick pdf library
    EPSS54%
    ·
    Published Dec 24, 2018
  • CVE-2018-8631High 7.5
    A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10.
    microsoft · internet explorer
    EPSS68%
    2 exploits
    Published Dec 11, 2018
  • CVE-2018-4021High 7.2
    An exploitable command injection vulnerability exists in the way Netgate pfSense CE 2.4.4-RELEASE processes the parameters of a specific POST request.
    netgate · pfsense
    EPSS72%
    ·
    Published Dec 3, 2018
  • CVE-2018-16855High 7.5
    An issue has been found in PowerDNS Recursor before version 4.1.8 where a remote attacker sending a DNS query can trigger an out-of-bounds memory read while computing the hash of the query for a packet cache lookup, possibly leading to a crash.
    powerdns · recursor
    EPSS59%
    ·
    Published Dec 3, 2018
  • CVE-2018-3949High 7.5
    An exploitable information disclosure vulnerability exists in the HTTP server functionality of the TP-Link TL-R600VPN.
    tp-link · tl-r600vpn firmware
    EPSS53%
    ·
    Published Dec 1, 2018
  • CVE-2018-18982High 8.8
    NUUO CMS All versions 3.3 and prior the web server application allows injection of arbitrary SQL characters, which can be used to inject SQL into an executing statement and allow arbitrary code execution.
    nuuo · nuuo cms
    EPSS61%
    3 exploits
    Published Nov 27, 2018
  • CVE-2018-19518High 7.5
    University of Washington IMAP Toolkit 2007f on UNIX, as used in imap_open() in PHP and other products, launches an rsh command (by means of the imap_rimap function in c-client/imap4r1.c and the tcp_aopen function in osdep/unix/tcp_unix.c) without preventing argument injection,…
    php · php
    EPSS96%
    4 exploits
    Published Nov 25, 2018
  • CVE-2018-15710High 7.8
    Nagios XI 5.5.6 allows local authenticated attackers to escalate privileges to root via Autodiscover_new.php.
    nagios · nagios xi
    EPSS44%
    4 exploits
    Published Nov 14, 2018
  • CVE-2018-7358High 8.8
    ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper change control vulnerability, which may allow an unauthorized user to perform unauthorized operations.
    zte · zxhn h168n firmware
    EPSS90%
    2 exploits
    Published Nov 14, 2018
  • CVE-2018-7357High 8.8
    ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.
    zte · zxhn h168n firmware
    EPSS88%
    2 exploits
    Published Nov 14, 2018
  • CVE-2018-8552High 7.5
    An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data, aka "Windows Scripting Engine Memory Corruption Vulnerability." This…
    microsoft · internet explorer
    EPSS51%
    2 exploits
    Published Nov 13, 2018
  • CVE-2015-2080High 7.5
    Jetty vulnerable to exposure of sensitive information to unauthenticated remote users
    eclipse · jetty
    EPSS75%
    1 exploit
    Published Nov 9, 2018
  • CVE-2018-11759High 7.5
    The Apache Web Server (httpd) specific code that normalised the requested path before matching it to the URI-worker map in Apache Tomcat JK (mod_jk) Connector 1.2.0 to 1.2.44 did not handle some edge cases correctly.
    apache · tomcat jk connector
    EPSS91%
    ·
    Published Oct 31, 2018
  • CVE-2015-4632High 7.5
    Multiple directory traversal vulnerabilities in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, 3.18.x before 3.18.08, and 3.20.x before 3.20.1 allow remote attackers to read arbitrary files via a ..%2f (dot dot encoded slash) in the template_path parameter to (1)…
    koha · koha
    EPSS52%
    3 exploits
    Published Oct 18, 2018
Showing 751–800 of 1,474

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.