Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
1,642 vulnerabilities · highest exploit probability first
  • CVE-2018-12464Critical 9.8
    A SQL injection vulnerability in the web administration and quarantine components of Micro Focus Secure Messaging Gateway allows an unauthenticated remote attacker to execute arbitrary SQL statements against the database.
    microfocus · secure messaging gateway
    EPSS81%
    2 exploits
    Published Jun 29, 2018
  • CVE-2018-10594Critical 9.8
    Delta Industrial Automation COMMGR from Delta Electronics versions 1.08 and prior with accompanying PLC Simulators (DVPSimulator EH2, EH3, ES2, SE, SS2 and AHSIM_5x0, AHSIM_5x1) utilize a fixed-length stack buffer where an unverified length value can be read from the network…
    deltaww · commgr
    EPSS69%
    5 exploits
    Published Jun 26, 2018
  • CVE-2018-10662Critical 9.8
    There is an Exposed Insecure Interface.
    axis · a1001 firmware
    EPSS80%
    3 exploits
    Published Jun 26, 2018
  • CVE-2018-10661Critical 9.8
    There is a bypass of access control.
    axis · a1001 firmware
    EPSS87%
    3 exploits
    Published Jun 26, 2018
  • CVE-2018-10660Critical 9.8
    There is Shell Command Injection.
    axis · a1001 firmware
    EPSS82%
    3 exploits
    Published Jun 26, 2018
  • CVE-2018-1000533Critical 9.8
    klaussilveira GitList version <= 0.6 contains a Passing incorrectly sanitized input to system function vulnerability in searchTree function that can result in Execute any code as PHP user.
    gitlist · gitlist
    EPSS73%
    1 exploit
    Published Jun 26, 2018
  • CVE-2018-12634Critical 9.8
    CirCarLife Scada before 4.3 allows remote attackers to obtain sensitive information via a direct request for the html/log or services/system/info.html URI.
    circontrol · circarlife scada
    EPSS56%
    2 exploits
    Published Jun 21, 2018
  • CVE-2018-11714Critical 9.8
    An issue was discovered on TP-Link TL-WR840N v5 00000005 0.9.1 3.16 v0001.0 Build 170608 Rel.58696n and TL-WR841N v13 00000013 0.9.1 4.16 v0001.0 Build 170622 Rel.64334n devices.
    tp-link · tl-wr840n firmware
    EPSS67%
    1 exploit
    Published Jun 4, 2018
  • CVE-2018-9059Critical 9.8
    Stack-based buffer overflow in Easy File Sharing (EFS) Web Server 7.2 allows remote attackers to execute arbitrary code via a malicious login request to forum.ghp.
    sharing-file · easy file sharing web server
    EPSS77%
    3 exploits
    Published Apr 20, 2018
  • CVE-2018-1143Critical 9.8
    A remote unauthenticated user can execute commands as root in the Belkin N750 using firmware version 1.10.22 by sending a crafted HTTP request to twonky_command.cgi.
    belkin · n750 firmware
    EPSS54%
    ·
    Published Apr 19, 2018
  • CVE-2018-8734Critical 9.8
    SQL injection vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an attacker to execute arbitrary SQL commands via the selInfoKey1 parameter.
    nagios · nagios xi
    EPSS54%
    6 exploits
    Published Apr 17, 2018
  • CVE-2018-8733Critical 9.8
    Authentication bypass vulnerability in the core config manager in Nagios XI 5.2.x through 5.4.x before 5.4.13 allows an unauthenticated attacker to make configuration changes and leverage an authenticated SQL injection vulnerability.
    nagios · nagios xi
    EPSS27%
    6 exploits
    Published Apr 17, 2018
  • CVE-2018-9995Critical 9.8
    TBK DVR4104 and DVR4216 devices, as well as Novo, CeNova, QSee, Pulnix, XVR 5 in 1, Securus, Night OWL, DVR Login, HVR Login, and MDVR Login, which run re-branded versions of the original TBK DVR4104 and DVR4216 series, allow remote attackers to bypass authentication via a…
    tbkvision · tbk-dvr4104 firmware
    EPSS82%
    2 exploits
    Published Apr 10, 2018
  • CVE-2018-1217Critical 9.8
    Avamar Installation Manager in Dell EMC Avamar Server 7.3.1, 7.4.1, and 7.5.0, and Dell EMC Integrated Data Protection Appliance 2.0 and 2.1, is affected by a missing access control check vulnerability which could potentially allow a remote unauthenticated attacker to read or…
    dell · emc avamar
    EPSS51%
    2 exploits
    Published Apr 9, 2018
  • CVE-2018-9161Critical 9.8
    Prisma Industriale Checkweigher PrismaWEB 1.21 allows remote attackers to discover the hardcoded prisma password for the prismaweb account by reading user/scripts/login_par.js.
    prismaindustriale · checkweigher prismaweb
    EPSS57%
    1 exploit
    Published Mar 31, 2018
  • CVE-2018-8823Critical 9.8
    modules/bamegamenu/ajax_phpcode.php in the Responsive Mega Menu (Horizontal+Vertical+Dropdown) Pro module 1.0.32 for PrestaShop 1.5.5.0 through 1.7.2.5 allows remote attackers to execute arbitrary PHP code via the code parameter.
    prestashop · prestashop
    EPSS50%
    ·
    Published Mar 27, 2018
  • CVE-2017-17736Critical 9.8
    Kentico 9.0 before 9.0.51 and 10.0 before 10.0.48 allows remote attackers to obtain Global Administrator access by visiting CMSInstall/install.aspx and then navigating to the CMS Administration Dashboard.
    kentico · xperience
    EPSS68%
    ·
    Published Mar 23, 2018
  • CVE-2018-1207Critical 9.8
    Dell EMC iDRAC7/iDRAC8, versions prior to 2.52.52.52, contain CGI injection vulnerability which could be used to execute remote code.
    dell · emc idrac7
    EPSS90%
    1 exploit
    Published Mar 23, 2018
  • CVE-2018-7422Critical 9.8
    A Local File Inclusion vulnerability in the Site Editor plugin through 1.1.1 for WordPress allows remote attackers to retrieve arbitrary files via the ajax_path parameter to editor/extensions/pagebuilder/includes/ajax_shortcode_pattern.php, aka absolute path traversal.
    siteeditor · site editor
    EPSS62%
    2 exploits
    Published Mar 19, 2018
  • CVE-2018-7756Critical 9.8
    RunExeFile.exe in the installer for DEWESoft X3 SP1 (64-bit) devices does not require authentication for sessions on TCP port 1999, which allows remote attackers to execute arbitrary code or access internal commands, as demonstrated by a RUN command that launches a .EXE file…
    dewesoft · dewesoft
    EPSS61%
    2 exploits
    Published Mar 14, 2018
  • CVE-2018-6329Critical 9.8
    It was discovered that the Unitrends Backup (UB) before 10.1.0 libbpext.so authentication could be bypassed with a SQL injection, allowing a remote attacker to place a privilege escalation exploit on the target system and subsequently execute arbitrary commands.
    unitrends · backup
    EPSS61%
    5 exploits
    Published Mar 14, 2018
  • CVE-2018-6328Critical 9.8
    It was discovered that the Unitrends Backup (UB) before 10.1.0 user interface was exposed to an authentication bypass, which then could allow an unauthenticated user to inject arbitrary commands into its /api/hosts parameters using backquotes.
    kaseya · unitrends backup
    EPSS64%
    5 exploits
    Published Mar 14, 2018
  • CVE-2018-7890Critical 9.8
    A remote code execution issue was discovered in Zoho ManageEngine Applications Manager before 13.6 (build 13640).
    zohocorp · manageengine applications manager
    EPSS79%
    4 exploits
    Published Mar 8, 2018
  • CVE-2018-7739Critical 9.8
    antsle antman before 0.9.1a allows remote attackers to bypass authentication via invalid characters in the username and password parameters, as demonstrated by a username=>&password=%0a string to the /login URI.
    antsle · antman
    EPSS53%
    4 exploits
    Published Mar 6, 2018
  • CVE-2018-7584Critical 9.8
    In PHP through 5.6.33, 7.0.x before 7.0.28, 7.1.x through 7.1.14, and 7.2.x through 7.2.2, there is a stack-based buffer under-read while parsing an HTTP response in the php_stream_url_wrap_http_ex function in ext/standard/http_fopen_wrapper.c.
    php · php
    EPSS87%
    2 exploits
    Published Mar 1, 2018
  • CVE-2018-7573Critical 9.8
    A remote FTP server can send 400 characters of 'F' in conjunction with the FTP 220 response code to crash the application; after this overflow, one can run arbitrary code on the victim machine.
    ftpshell · ftpshell client
    EPSS69%
    5 exploits
    Published Mar 1, 2018
  • CVE-2018-6481Critical 9.8
    A buffer overflow vulnerability in the control protocol of Disk Savvy Enterprise v10.4.18 allows remote attackers to execute arbitrary code by sending a crafted packet to TCP port 9124.
    flexense · disksavvy
    EPSS21%
    5 exploits
    Published Feb 27, 2018
  • CVE-2014-3206Critical 9.8
    Seagate BlackArmor NAS allows remote attackers to execute arbitrary code via the session parameter to localhost/backupmgt/localJob.php or the auth_name parameter to localhost/backupmgmt/pre_connect_check.php.
    seagate · blackarmor nas 110 firmware
    EPSS51%
    1 exploit
    Published Feb 23, 2018
  • CVE-2018-7314Critical 9.8
    SQL Injection exists in the PrayerCenter 3.0.2 component for Joomla!
    mlwebtechnologies · prayercenter
    EPSS58%
    2 exploits
    Published Feb 22, 2018
  • CVE-2018-7297Critical 9.8
    Remote Code Execution in the TCL script interpreter in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to obtain read/write access and execute system commands on the device.
    eq-3 · homematic central control unit ccu2 firmware
    EPSS64%
    1 exploit
    Published Feb 22, 2018
  • CVE-2017-5817Critical 9.8
    A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
    hp · intelligent management center
    EPSS83%
    5 exploits
    Published Feb 15, 2018
  • CVE-2017-5816Critical 9.8
    A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.
    hp · intelligent management center
    EPSS86%
    5 exploits
    Published Feb 15, 2018
  • CVE-2017-12557Critical 9.8
    A Remote Code Execution vulnerability in HPE intelligent Management Center (iMC) PLAT version IMC Plat 7.3 E0504P2 and earlier was found.
    hp · intelligent management center
    EPSS80%
    3 exploits
    Published Feb 15, 2018
  • CVE-2017-12542Critical 10.0
    A authentication bypass and execution of code vulnerability in HPE Integrated Lights-out 4 (iLO 4) version prior to 2.53 was found.
    hp · integrated lights-out 4 firmware
    EPSS99%
    2 exploits
    Published Feb 15, 2018
  • CVE-2018-6892Critical 9.8
    An unauthenticated remote attacker that can connect to the "CloudMe Sync" client application listening on port 8888 can send a malicious payload causing a buffer overflow condition.
    cloudme · sync
    EPSS93%
    9 exploits
    Published Feb 11, 2018
  • CVE-2018-1161Critical 9.8
    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Quest NetVault Backup 11.2.0.13.
    quest · netvault backup
    EPSS67%
    ·
    Published Feb 8, 2018
  • CVE-2018-0127Critical 9.8
    A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN Routers and Cisco RV134W VDSL2 Wireless-AC VPN Routers could allow an unauthenticated, remote attacker to view configuration parameters for an affected device, which could lead to the disclosure of…
    cisco · rv132w firmware
    EPSS78%
    ·
    Published Feb 8, 2018
  • CVE-2018-6605Critical 9.8
    SQL Injection exists in the Zh BaiduMap 3.0.0.1 component for Joomla!
    zh baidumap project · zh baidumap
    EPSS58%
    2 exploits
    Published Feb 5, 2018
  • CVE-2018-0101Critical 10.0
    A vulnerability in the Secure Sockets Layer (SSL) VPN functionality of the Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause a reload of the affected system or to remotely execute code.
    cisco · firepower threat defense
    EPSS87%
    2 exploits
    Published Jan 29, 2018
  • CVE-2017-13696Critical 9.8
    A buffer overflow vulnerability lies in the web server component of Dup Scout Enterprise 9.9.14, Disk Savvy Enterprise 9.9.14, Sync Breeze Enterprise 9.9.16, and Disk Pulse Enterprise 9.9.16 where an attacker can craft a malicious GET request and exploit the web server component.
    flexense · diskpulse
    EPSS79%
    7 exploits
    Published Jan 24, 2018
  • CVE-2017-2741Critical 9.8
    A potential security vulnerability has been identified with HP PageWide Printers, HP OfficeJet Pro Printers, with firmware before 1708D.
    hp · d3q15a firmware
    EPSS85%
    3 exploits
    Published Jan 23, 2018
  • CVE-2017-16597Critical 9.8
    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of NetGain Systems Enterprise Manager 7.2.730 build 1034.
    netgain-systems · enterprise manager
    EPSS57%
    ·
    Published Jan 22, 2018
  • CVE-2018-6000Critical 9.8
    The do_vpnupload_post function in router/httpd/web.c in vpnupload.cgi provides functionality for setting NVRAM configuration values, which allows attackers to set the admin password and launch an SSH daemon (or enable infosvr command mode), and consequently obtain remote…
    asus · asuswrt
    EPSS85%
    5 exploits
    Published Jan 22, 2018
  • CVE-2018-5999Critical 9.8
    In the handle_request function in router/httpd/httpd.c, processing of POST requests continues even if authentication fails.
    asus · asuswrt
    EPSS88%
    5 exploits
    Published Jan 22, 2018
  • CVE-2018-5955Critical 9.8
    User controlled input is not sufficiently filtered, allowing an unauthenticated attacker to add a user to the server via the username and password fields to the rest/user/ URI.
    smartmobilesoftware · gitstack
    EPSS81%
    4 exploits
    Published Jan 21, 2018
  • CVE-2017-12635Critical 9.8
    couchdb - security update
    apache · couchdb
    EPSS100%
    3 exploits
    Published Jan 21, 2018
  • CVE-2017-18044Critical 9.8
    A Command Injection issue was discovered in ContentStore/Base/CVDataPipe.dll in Commvault before v11 SP6.
    commvault · commvault
    EPSS70%
    2 exploits
    Published Jan 19, 2018
  • CVE-2018-5347Critical 9.8
    Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.
    seagate · personal cloud firmware
    EPSS54%
    2 exploits
    Published Jan 11, 2018
  • CVE-2017-16720Critical 9.8
    A Path Traversal issue was discovered in WebAccess versions 8.3.2 and earlier.
    advantech · webaccess
    EPSS50%
    2 exploits
    Published Jan 5, 2018
  • CVE-2014-7862Critical 9.8
    The DCPluginServelet servlet in ManageEngine Desktop Central and Desktop Central MSP before build 90109 allows remote attackers to create administrator accounts via an addPlugInUser action.
    zohocorp · desktop central
    EPSS81%
    1 exploit
    Published Jan 4, 2018
Showing 801–850 of 1,642

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.