Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2022-37961High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS51%·Published Sep 14, 2022
- CVE-2022-37958High 8.1SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS86%·Published Sep 13, 2022
- CVE-2022-37860Critical 9.8The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability.tp-link · m7350 firmwareEPSS80%·Published Sep 12, 2022
- CVE-2022-39810Medium 6.1A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter.wso2 · enterprise integratorEPSS57%·Published Sep 9, 2022
- CVE-2022-20828High 7.2A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root…cisco · asa firepowerEPSS49%2 exploitsPublished Sep 8, 2022
- CVE-2022-31474High 7.5BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Downloadithemes · backupbuddyEPSS64%·Published Sep 5, 2022
- CVE-2022-31814Critical 9.8pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header.netgate · pfblockerngEPSS92%3 exploitsPublished Sep 5, 2022
- CVE-2022-25813High 7.5In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page.apache · ofbizEPSS67%·Published Sep 2, 2022
- CVE-2022-2068High 7.3openssl: the c_rehash script allows command injectionopenssl · opensslEPSS96%·Published Aug 31, 2022
- CVE-2022-1292High 7.3openssl - security updateopenssl · opensslEPSS83%·Published Aug 31, 2022
- CVE-2022-36553Critical 9.8Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.hytec · hwl-2511-ss firmwareEPSS91%·Published Aug 29, 2022
- CVE-2022-38772High 8.8Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.zohocorp · manageengine opmanagerEPSS78%·Published Aug 29, 2022
- CVE-2022-31499Critical 9.8Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo.nortekcontrol · emerge e3 firmwareEPSS65%2 exploitsPublished Aug 25, 2022
- CVE-2022-36633High 8.8Improper token validation leading to code execution in Teleportgoteleport · teleportEPSS50%1 exploitPublished Aug 25, 2022
- CVE-2021-42627Critical 9.8The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page.dlink · dir-615 firmwareEPSS63%·Published Aug 23, 2022
- CVE-2022-30690Medium 6.1A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.wwbn · avideoEPSS84%·Published Aug 22, 2022
- CVE-2022-30547Critical 9.9A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.wwbn · avideoEPSS64%·Published Aug 22, 2022
- CVE-2022-30534High 8.8An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.wwbn · avideoEPSS75%·Published Aug 22, 2022
- CVE-2022-37061Critical 9.8All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection.flir · flir ax8 firmwareEPSS100%6 exploitsPublished Aug 18, 2022
- CVE-2022-34258Medium 4.8Magento stored Cross-Site Scripting (XSS) vulnerabilityadobe · commerceEPSS69%·Published Aug 17, 2022
- CVE-2020-9850Critical 9.8webkitgtk: Logic issue may lead to arbitrary code executionapple · icloudEPSS77%1 exploitPublished Aug 15, 2022
- CVE-2022-0778High 7.5openssl - security updateopenssl · opensslEPSS73%·Published Aug 15, 2022
- CVE-2021-43813Medium 4.3grafana: directory traversal vulnerabilitygrafana · grafanaEPSS57%·Published Aug 15, 2022
- CVE-2022-38130Critical 9.8The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS.keysight · sensor management serverEPSS55%·Published Aug 10, 2022
- CVE-2022-37024High 8.8Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code…zohocorp · manageengine opmanagerEPSS80%·Published Aug 10, 2022
- CVE-2022-32429Critical 9.8An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution.megatech · msnswitch firmwareEPSS76%2 exploitsPublished Aug 10, 2022
- CVE-2022-34715Critical 9.8Windows Network File System Remote Code Execution Vulnerabilitymicrosoft · windows server 2022EPSS81%·Published Aug 10, 2022
- CVE-2022-36801Medium 6.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint.atlassian · jira serverEPSS66%·Published Aug 10, 2022
- CVE-2018-7187High 8.8Remote command execution via "go get" command with "-insecure" option in cmd/gogolang · goEPSS63%1 exploitPublished Aug 9, 2022
- CVE-2022-2733Medium 6.1Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.open-emr · openemrEPSS96%·Published Aug 9, 2022
- CVE-2022-31626High 8.8php7.3 - security updateEPSS58%·Published Aug 9, 2022
- CVE-2022-36267Critical 9.8In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability.airspan · airspot 5410 firmwareEPSS55%3 exploitsPublished Aug 8, 2022
- CVE-2022-28730Medium 6.1Apache JSPWiki XSS due to incomplete patch for CVE-2021-40369apache · jspwikiEPSS86%·Published Aug 5, 2022
- CVE-2022-27166Medium 6.1Apache JSPWiki XSS due to crafted request on XHRHtml2Markup.jspapache · jspwikiEPSS86%·Published Aug 5, 2022
- CVE-2022-28731Medium 6.5Apache JSPWiki CSRF due to crafted request on UserPreferences.jspapache · jspwikiEPSS58%·Published Aug 5, 2022
- CVE-2018-16873High 8.1Remote command execution via "go get" with "-u" flag in cmd/gogolang · goEPSS66%·Published Aug 4, 2022
- CVE-2022-35919Low 2.7In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested.minio · minioEPSS52%1 exploitPublished Aug 1, 2022
- CVE-2022-2414High 7.5Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.dogtagpki · dogtagpkiEPSS85%·Published Jul 29, 2022
- CVE-2022-30287High 8.0Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class.horde · groupwareEPSS69%·Published Jul 28, 2022
- CVE-2022-35650High 7.5Moodle Arbitrary file read when importing lesson questionsmoodle · moodleEPSS54%·Published Jul 26, 2022
- CVE-2022-35869Critical 9.8This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114).inductiveautomation · ignitionEPSS60%·Published Jul 25, 2022
- CVE-2022-33318Critical 9.8Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics…iconics · genesis64EPSS50%·Published Jul 25, 2022
- CVE-2022-36446Critical 9.8software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.webmin · webminEPSS96%3 exploitsPublished Jul 25, 2022
- CVE-2022-2487Critical 9.8The manipulation of the argument start_hour leads to os command injection.wavlink · wl-wn535k2 firmwareEPSS79%1 exploitPublished Jul 20, 2022
- CVE-2022-21550Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS51%·Published Jul 19, 2022
- CVE-2022-32214Medium 6.5llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fieldsllhttp · llhttpEPSS82%·Published Jul 15, 2022
- CVE-2022-34753High 8.8A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised.schneider-electric · spacelogic c-bus home controller firmwareEPSS70%1 exploitPublished Jul 13, 2022
- CVE-2022-30216High 8.8Windows Server Service Tampering Vulnerabilitymicrosoft · windows 10EPSS89%·Published Jul 12, 2022
- CVE-2022-31137Critical 9.8Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability.roxy-wi · roxy-wiEPSS91%2 exploitsPublished Jul 8, 2022
- CVE-2022-33098Medium 6.1Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.magnolia-cms · magnolia cmsEPSS53%1 exploitPublished Jul 7, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-37961 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 51% | · | |
| CVE-2022-37958 | SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability microsoft · windows 10 | High 8.1 | 86% | · | |
| CVE-2022-37860 | The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability. tp-link · m7350 firmware | Critical 9.8 | 80% | · | |
| CVE-2022-39810 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. wso2 · enterprise integrator | Medium 6.1 | 57% | · | |
| CVE-2022-20828 | A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root… cisco · asa firepower | High 7.2 | 49% | 2 exploits | |
| CVE-2022-31474 | BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Download ithemes · backupbuddy | High 7.5 | 64% | · | |
| CVE-2022-31814 | pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. netgate · pfblockerng | Critical 9.8 | 92% | 3 exploits | |
| CVE-2022-25813 | In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. apache · ofbiz | High 7.5 | 67% | · | |
| CVE-2022-2068 | openssl: the c_rehash script allows command injection openssl · openssl | High 7.3 | 96% | · | |
| CVE-2022-1292 | openssl - security update openssl · openssl | High 7.3 | 83% | · | |
| CVE-2022-36553 | Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. hytec · hwl-2511-ss firmware | Critical 9.8 | 91% | · | |
| CVE-2022-38772 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature. zohocorp · manageengine opmanager | High 8.8 | 78% | · | |
| CVE-2022-31499 | Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. nortekcontrol · emerge e3 firmware | Critical 9.8 | 65% | 2 exploits | |
| CVE-2022-36633 | Improper token validation leading to code execution in Teleport goteleport · teleport | High 8.8 | 50% | 1 exploit | |
| CVE-2021-42627 | The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page. dlink · dir-615 firmware | Critical 9.8 | 63% | · | |
| CVE-2022-30690 | A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. wwbn · avideo | Medium 6.1 | 84% | · | |
| CVE-2022-30547 | A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. wwbn · avideo | Critical 9.9 | 64% | · | |
| CVE-2022-30534 | An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. wwbn · avideo | High 8.8 | 75% | · | |
| CVE-2022-37061 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. flir · flir ax8 firmware | Critical 9.8 | 100% | 6 exploits | |
| CVE-2022-34258 | Magento stored Cross-Site Scripting (XSS) vulnerability adobe · commerce | Medium 4.8 | 69% | · | |
| CVE-2020-9850 | webkitgtk: Logic issue may lead to arbitrary code execution apple · icloud | Critical 9.8 | 77% | 1 exploit | |
| CVE-2022-0778 | openssl - security update openssl · openssl | High 7.5 | 73% | · | |
| CVE-2021-43813 | grafana: directory traversal vulnerability grafana · grafana | Medium 4.3 | 57% | · | |
| CVE-2022-38130 | The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. keysight · sensor management server | Critical 9.8 | 55% | · | |
| CVE-2022-37024 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code… zohocorp · manageengine opmanager | High 8.8 | 80% | · | |
| CVE-2022-32429 | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution. megatech · msnswitch firmware | Critical 9.8 | 76% | 2 exploits | |
| CVE-2022-34715 | Windows Network File System Remote Code Execution Vulnerability microsoft · windows server 2022 | Critical 9.8 | 81% | · | |
| CVE-2022-36801 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. atlassian · jira server | Medium 6.1 | 66% | · | |
| CVE-2018-7187 | Remote command execution via "go get" command with "-insecure" option in cmd/go golang · go | High 8.8 | 63% | 1 exploit | |
| CVE-2022-2733 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1. open-emr · openemr | Medium 6.1 | 96% | · | |
| CVE-2022-31626 | php7.3 - security update | High 8.8 | 58% | · | |
| CVE-2022-36267 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. airspan · airspot 5410 firmware | Critical 9.8 | 55% | 3 exploits | |
| CVE-2022-28730 | Apache JSPWiki XSS due to incomplete patch for CVE-2021-40369 apache · jspwiki | Medium 6.1 | 86% | · | |
| CVE-2022-27166 | Apache JSPWiki XSS due to crafted request on XHRHtml2Markup.jsp apache · jspwiki | Medium 6.1 | 86% | · | |
| CVE-2022-28731 | Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp apache · jspwiki | Medium 6.5 | 58% | · | |
| CVE-2018-16873 | Remote command execution via "go get" with "-u" flag in cmd/go golang · go | High 8.1 | 66% | · | |
| CVE-2022-35919 | In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. minio · minio | Low 2.7 | 52% | 1 exploit | |
| CVE-2022-2414 | Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. dogtagpki · dogtagpki | High 7.5 | 85% | · | |
| CVE-2022-30287 | Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. horde · groupware | High 8.0 | 69% | · | |
| CVE-2022-35650 | Moodle Arbitrary file read when importing lesson questions moodle · moodle | High 7.5 | 54% | · | |
| CVE-2022-35869 | This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). inductiveautomation · ignition | Critical 9.8 | 60% | · | |
| CVE-2022-33318 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics… iconics · genesis64 | Critical 9.8 | 50% | · | |
| CVE-2022-36446 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. webmin · webmin | Critical 9.8 | 96% | 3 exploits | |
| CVE-2022-2487 | The manipulation of the argument start_hour leads to os command injection. wavlink · wl-wn535k2 firmware | Critical 9.8 | 79% | 1 exploit | |
| CVE-2022-21550 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 51% | · | |
| CVE-2022-32214 | llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields llhttp · llhttp | Medium 6.5 | 82% | · | |
| CVE-2022-34753 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. schneider-electric · spacelogic c-bus home controller firmware | High 8.8 | 70% | 1 exploit | |
| CVE-2022-30216 | Windows Server Service Tampering Vulnerability microsoft · windows 10 | High 8.8 | 89% | · | |
| CVE-2022-31137 | Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. roxy-wi · roxy-wi | Critical 9.8 | 91% | 2 exploits | |
| CVE-2022-33098 | Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. magnolia-cms · magnolia cms | Medium 6.1 | 53% | 1 exploit |
Showing 801–850 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.