Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2022-25046Critical 9.8A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.control-webpanel · webpanelEPSS57%1 exploitPublished Jul 7, 2022
- CVE-2022-31126Critical 9.8A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file.roxy-wi · roxy-wiEPSS53%1 exploitPublished Jul 6, 2022
- CVE-2022-34265Critical 9.3Django Trunc() and Extract() database functions vulnerable to SQL Injectiondjangoproject · djangoEPSS74%·Published Jul 5, 2022
- CVE-2022-2230Medium 4.8A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf.gitlab · gitlabEPSS57%·Published Jul 1, 2022
- CVE-2022-2185High 8.8A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code…gitlab · gitlabEPSS77%·Published Jul 1, 2022
- CVE-2022-26135Medium 6.5A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint.atlassian · jira data centerEPSS72%·Published Jul 1, 2022
- CVE-2022-34783Medium 5.4Cross-site Scripting in Jenkins Plot Pluginjenkins · plotEPSS81%·Published Jul 1, 2022
- CVE-2022-34777Medium 5.4Cross-site Scripting in Jenkins GitLab Pluginjenkins · gitlabEPSS73%·Published Jul 1, 2022
- CVE-2022-2143Critical 9.8The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.advantech · iviewEPSS60%2 exploitsPublished Jun 29, 2022
- CVE-2022-31061Critical 9.8In affected versions there is a SQL injection vulnerability which is possible on login page.glpi-project · glpiEPSS51%·Published Jun 28, 2022
- CVE-2022-28171Critical 9.8The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.hikvision · ds-a71024 firmwareEPSS52%2 exploitsPublished Jun 27, 2022
- CVE-2022-30522High 7.5If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.apache · http serverEPSS90%·Published Jun 24, 2022
- CVE-2022-34176Medium 5.4Cross-site Scripting in Jenkins JUnit Pluginjenkins · junitEPSS77%·Published Jun 24, 2022
- CVE-2022-29775Critical 9.8iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.ispyconnect · ispyEPSS60%·Published Jun 21, 2022
- CVE-2021-34429Medium 5.3For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.eclipse · jettyEPSS99%1 exploitPublished Jun 20, 2022
- CVE-2021-4104High 7.5JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.apache · log4jEPSS81%·Published Jun 20, 2022
- CVE-2022-21449High 7.5OpenJDK: Improper ECDSA signature verification (Libraries, 8277233)oracle · graalvmEPSS77%·Published Jun 20, 2022
- CVE-2022-24562Critical 9.8In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.iobit · iotransferEPSS54%2 exploitsPublished Jun 16, 2022
- CVE-2022-30136Critical 9.8Windows Network File System Remote Code Execution Vulnerabilitymicrosoft · windows server 2012EPSS73%·Published Jun 15, 2022
- CVE-2022-1707Medium 6.1Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Searchgtm4wp · google tag managerEPSS89%·Published Jun 14, 2022
- CVE-2022-30780High 7.5Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.lighttpd · lighttpdEPSS57%1 exploitPublished Jun 11, 2022
- CVE-2016-2183High 7.5SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)openssl · opensslEPSS95%·Published Jun 10, 2022
- CVE-2009-3555Critical 9.8The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4…apache · http serverEPSS87%3 exploitsPublished Jun 10, 2022
- CVE-2015-2808Low 3.7openjdk-6 - security updateibm · cognos metrics managerEPSS74%·Published Jun 10, 2022
- CVE-2022-29013Critical 9.8A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.razer · sila firmwareEPSS77%2 exploitsPublished Jun 8, 2022
- CVE-2022-31470Medium 6.1An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and…axigen · axigen mobile webmailEPSS53%1 exploitPublished Jun 7, 2022
- CVE-2022-25237Critical 9.8Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter.bonitasoft · bonita webEPSS56%·Published Jun 2, 2022
- CVE-2022-22972Critical 9.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.vmware · identity managerEPSS56%·Published Jun 1, 2022
- CVE-2022-24422Critical 9.8Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability.dell · idrac9EPSS59%·Published May 26, 2022
- CVE-2022-25772Medium 6.1Cross-site Scripting vulnerability in Mautic's tracking pixel functionalityacquia · mauticEPSS62%·Published May 25, 2022
- CVE-2021-27907Medium 5.4Apache Superset Stored XSS on Dashboard markdownapache · supersetEPSS86%·Published May 24, 2022
- CVE-2019-10405Medium 5.4Exposure of Sensitive Information to an Unauthorized Actor in Jenkinsjenkins · jenkinsEPSS65%·Published May 24, 2022
- CVE-2021-33618Medium 6.1Dolibarr ERP and CRM contain XSS Vulnerabilitydolibarr · dolibarr erp\/crmEPSS79%·Published May 24, 2022
- CVE-2021-38540Critical 9.3Missing Authentication for Critical Function in Apache Airflowapache · airflowEPSS81%·Published May 24, 2022
- CVE-2021-3712High 7.4Read buffer overruns processing ASN.1 stringsopenssl · opensslEPSS50%·Published May 24, 2022
- CVE-2021-22145Medium 6.5Generation of Error Message Containing Sensitive Information in Elasticsearchelastic · elasticsearchEPSS76%2 exploitsPublished May 24, 2022
- CVE-2021-21659High 8.1XXE vulnerability in Jenkins URLTrigger Pluginjenkins · urltriggerEPSS67%·Published May 24, 2022
- CVE-2021-21628Medium 5.4Stored XSS vulnerability in Jenkins Build With Parameters Pluginjenkins · build with parametersEPSS81%·Published May 24, 2022
- CVE-2021-21630Medium 5.4Stored XSS vulnerability in Jenkins Extra Columns Pluginjenkins · extra columnsEPSS72%·Published May 24, 2022
- CVE-2021-3197Critical 9.8SaltStack Salt is vulnerable to shell injection via ProxyCommand argumentsaltstack · saltEPSS72%·Published May 24, 2022
- CVE-2021-25282High 8.8SaltStack Salt Directory Traversal vulnerabilitysaltstack · saltEPSS92%1 exploitPublished May 24, 2022
- CVE-2021-25281Critical 9.8SaltStack Salt Improper Authentication vulnerabilitysaltstack · saltEPSS73%1 exploitPublished May 24, 2022
- CVE-2021-21616Medium 4.6Stored XSS vulnerability in Jenkins Active Choices Pluginjenkins · active choicesEPSS76%·Published May 24, 2022
- CVE-2021-21618Medium 5.4Stored XSS vulnerability in Jenkins Repository Connector Pluginjenkins · repository connectorEPSS79%·Published May 24, 2022
- CVE-2020-10770Medium 5.3Keycloak vulnerable to Server-Side Request Forgeryredhat · keycloakEPSS70%2 exploitsPublished May 24, 2022
- CVE-2020-25592Critical 9.8SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapisaltstack · saltEPSS57%1 exploitPublished May 24, 2022
- CVE-2020-26935Critical 9.8phpMyAdmin SQL injection vulnerabilityphpmyadmin · phpmyadminEPSS66%·Published May 24, 2022
- CVE-2020-25540High 7.5ThinkAdmin directory traversal vulnerabilitythinkadmin · thinkadminEPSS75%2 exploitsPublished May 24, 2022
- CVE-2020-2230Medium 5.4Jenkins Cross-site Scripting vulnerability in project naming strategyjenkins · jenkinsEPSS83%2 exploitsPublished May 24, 2022
- CVE-2020-2140Medium 6.1XSS vulnerability in Jenkins Audit Trail Pluginjenkins · audit trailEPSS76%·Published May 24, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-25046 | A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request. control-webpanel · webpanel | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-31126 | A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. roxy-wi · roxy-wi | Critical 9.8 | 53% | 1 exploit | |
| CVE-2022-34265 | Django Trunc() and Extract() database functions vulnerable to SQL Injection djangoproject · django | Critical 9.3 | 74% | · | |
| CVE-2022-2230 | A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf. gitlab · gitlab | Medium 4.8 | 57% | · | |
| CVE-2022-2185 | A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code… gitlab · gitlab | High 8.8 | 77% | · | |
| CVE-2022-26135 | A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. atlassian · jira data center | Medium 6.5 | 72% | · | |
| CVE-2022-34783 | Cross-site Scripting in Jenkins Plot Plugin jenkins · plot | Medium 5.4 | 81% | · | |
| CVE-2022-34777 | Cross-site Scripting in Jenkins GitLab Plugin jenkins · gitlab | Medium 5.4 | 73% | · | |
| CVE-2022-2143 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. advantech · iview | Critical 9.8 | 60% | 2 exploits | |
| CVE-2022-31061 | In affected versions there is a SQL injection vulnerability which is possible on login page. glpi-project · glpi | Critical 9.8 | 51% | · | |
| CVE-2022-28171 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. hikvision · ds-a71024 firmware | Critical 9.8 | 52% | 2 exploits | |
| CVE-2022-30522 | If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. apache · http server | High 7.5 | 90% | · | |
| CVE-2022-34176 | Cross-site Scripting in Jenkins JUnit Plugin jenkins · junit | Medium 5.4 | 77% | · | |
| CVE-2022-29775 | iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL. ispyconnect · ispy | Critical 9.8 | 60% | · | |
| CVE-2021-34429 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. eclipse · jetty | Medium 5.3 | 99% | 1 exploit | |
| CVE-2021-4104 | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. apache · log4j | High 7.5 | 81% | · | |
| CVE-2022-21449 | OpenJDK: Improper ECDSA signature verification (Libraries, 8277233) oracle · graalvm | High 7.5 | 77% | · | |
| CVE-2022-24562 | In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution. iobit · iotransfer | Critical 9.8 | 54% | 2 exploits | |
| CVE-2022-30136 | Windows Network File System Remote Code Execution Vulnerability microsoft · windows server 2012 | Critical 9.8 | 73% | · | |
| CVE-2022-1707 | Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search gtm4wp · google tag manager | Medium 6.1 | 89% | · | |
| CVE-2022-30780 | Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers. lighttpd · lighttpd | High 7.5 | 57% | 1 exploit | |
| CVE-2016-2183 | SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) openssl · openssl | High 7.5 | 95% | · | |
| CVE-2009-3555 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4… apache · http server | Critical 9.8 | 87% | 3 exploits | |
| CVE-2015-2808 | openjdk-6 - security update ibm · cognos metrics manager | Low 3.7 | 74% | · | |
| CVE-2022-29013 | A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. razer · sila firmware | Critical 9.8 | 77% | 2 exploits | |
| CVE-2022-31470 | An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and… axigen · axigen mobile webmail | Medium 6.1 | 53% | 1 exploit | |
| CVE-2022-25237 | Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. bonitasoft · bonita web | Critical 9.8 | 56% | · | |
| CVE-2022-22972 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. vmware · identity manager | Critical 9.8 | 56% | · | |
| CVE-2022-24422 | Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. dell · idrac9 | Critical 9.8 | 59% | · | |
| CVE-2022-25772 | Cross-site Scripting vulnerability in Mautic's tracking pixel functionality acquia · mautic | Medium 6.1 | 62% | · | |
| CVE-2021-27907 | Apache Superset Stored XSS on Dashboard markdown apache · superset | Medium 5.4 | 86% | · | |
| CVE-2019-10405 | Exposure of Sensitive Information to an Unauthorized Actor in Jenkins jenkins · jenkins | Medium 5.4 | 65% | · | |
| CVE-2021-33618 | Dolibarr ERP and CRM contain XSS Vulnerability dolibarr · dolibarr erp\/crm | Medium 6.1 | 79% | · | |
| CVE-2021-38540 | Missing Authentication for Critical Function in Apache Airflow apache · airflow | Critical 9.3 | 81% | · | |
| CVE-2021-3712 | Read buffer overruns processing ASN.1 strings openssl · openssl | High 7.4 | 50% | · | |
| CVE-2021-22145 | Generation of Error Message Containing Sensitive Information in Elasticsearch elastic · elasticsearch | Medium 6.5 | 76% | 2 exploits | |
| CVE-2021-21659 | XXE vulnerability in Jenkins URLTrigger Plugin jenkins · urltrigger | High 8.1 | 67% | · | |
| CVE-2021-21628 | Stored XSS vulnerability in Jenkins Build With Parameters Plugin jenkins · build with parameters | Medium 5.4 | 81% | · | |
| CVE-2021-21630 | Stored XSS vulnerability in Jenkins Extra Columns Plugin jenkins · extra columns | Medium 5.4 | 72% | · | |
| CVE-2021-3197 | SaltStack Salt is vulnerable to shell injection via ProxyCommand argument saltstack · salt | Critical 9.8 | 72% | · | |
| CVE-2021-25282 | SaltStack Salt Directory Traversal vulnerability saltstack · salt | High 8.8 | 92% | 1 exploit | |
| CVE-2021-25281 | SaltStack Salt Improper Authentication vulnerability saltstack · salt | Critical 9.8 | 73% | 1 exploit | |
| CVE-2021-21616 | Stored XSS vulnerability in Jenkins Active Choices Plugin jenkins · active choices | Medium 4.6 | 76% | · | |
| CVE-2021-21618 | Stored XSS vulnerability in Jenkins Repository Connector Plugin jenkins · repository connector | Medium 5.4 | 79% | · | |
| CVE-2020-10770 | Keycloak vulnerable to Server-Side Request Forgery redhat · keycloak | Medium 5.3 | 70% | 2 exploits | |
| CVE-2020-25592 | SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi saltstack · salt | Critical 9.8 | 57% | 1 exploit | |
| CVE-2020-26935 | phpMyAdmin SQL injection vulnerability phpmyadmin · phpmyadmin | Critical 9.8 | 66% | · | |
| CVE-2020-25540 | ThinkAdmin directory traversal vulnerability thinkadmin · thinkadmin | High 7.5 | 75% | 2 exploits | |
| CVE-2020-2230 | Jenkins Cross-site Scripting vulnerability in project naming strategy jenkins · jenkins | Medium 5.4 | 83% | 2 exploits | |
| CVE-2020-2140 | XSS vulnerability in Jenkins Audit Trail Plugin jenkins · audit trail | Medium 6.1 | 76% | · |
Showing 851–900 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.