Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
1,642 vulnerabilities · highest exploit probability first
  • CVE-2017-18017Critical 9.8
    The tcpmss_mangle_packet function in net/netfilter/xt_TCPMSS.c in the Linux kernel before 4.11, and 4.9.x before 4.9.36, allows remote attackers to cause a denial of service (use-after-free and memory corruption) or possibly have unspecified other impact by leveraging the…
    linux · linux kernel
    EPSS53%
    ·
    Published Jan 3, 2018
  • CVE-2017-17968Critical 9.8
    A buffer overflow vulnerability in NetTransport.exe in NetTransport Download Manager 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response.
    xi-soft · nettransport download manager
    EPSS39%
    3 exploits
    Published Dec 29, 2017
  • CVE-2017-17932Critical 9.8
    A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine/computer via a long string to TCP port 888.
    allmediaserver · allmediaserver
    EPSS54%
    7 exploits
    Published Dec 28, 2017
  • CVE-2014-8389Critical 9.8
    cgi-bin/mft/wireless_mft.cgi in AirLive BU-2015 with firmware 1.03.18 16.06.2014, AirLive BU-3026 with firmware 1.43 21.08.2014, AirLive MD-3025 with firmware 1.81 21.08.2014, AirLive WL-2000CAM with firmware LM.1.6.18 14.10.2011, and AirLive POE-200CAM v2 with firmware…
    airlive · bu-2015 firmware
    EPSS51%
    1 exploit
    Published Dec 27, 2017
  • CVE-2017-17411Critical 9.8
    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0.
    linksys · wvbr0 firmware
    EPSS88%
    6 exploits
    Published Dec 21, 2017
  • CVE-2012-2576Critical 9.8
    SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager before 5.1.2, SolarWinds Storage Profiler before 5.1.2, and SolarWinds Backup Profiler before 5.1.2 allows remote attackers to execute arbitrary SQL commands via the loginName field.
    solarwinds · backup profiler
    EPSS59%
    4 exploits
    Published Dec 20, 2017
  • CVE-2017-17105Critical 9.8
    Zivif PR115-204-P-RS V2.3.4.2103 and V4.7.4.2121 (and possibly in-between versions) web cameras are vulnerable to unauthenticated, blind remote command injection via CGI scripts used as part of the web interface, as demonstrated by a…
    zivif · pr115-204-p-rs firmware
    EPSS85%
    2 exploits
    Published Dec 18, 2017
  • CVE-2017-3191Critical 9.8
    D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page.
    d-link · dir-130 firmware
    EPSS63%
    ·
    Published Dec 15, 2017
  • CVE-2017-17560Critical 9.8
    An issue was discovered on Western Digital MyCloud PR4100 2.30.172 devices.
    westerndigital · my cloud pr4100 firmware
    EPSS73%
    3 exploits
    Published Dec 12, 2017
  • CVE-2012-5357Critical 9.8
    Ektron Content Management System (CMS) before 8.02 SP5 uses the XslCompiledTransform class with enablescript set to true, which allows remote attackers to execute arbitrary code with NETWORK SERVICE privileges via crafted XSL data.
    ektron · ektron content management system
    EPSS68%
    2 exploits
    Published Oct 30, 2017
  • CVE-2014-7205Critical 10.0
    Arbitrary JavaScript Execution in bassmaster
    bassmaster project · bassmaster
    EPSS79%
    1 exploit
    Published Oct 24, 2017
  • CVE-2017-15222Critical 9.8
    Buffer Overflow vulnerability in Ayukov NFTPD 2.0 and earlier allows remote attackers to execute arbitrary code.
    nftp project · nftp
    EPSS60%
    7 exploits
    Published Oct 24, 2017
  • CVE-2017-11771Critical 9.8
    The Microsoft Windows Search component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows a remote code execution vulnerability when…
    microsoft · windows 10
    EPSS52%
    ·
    Published Oct 13, 2017
  • CVE-2017-5791Critical 9.8
    The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI.
    hp · intelligent management center plat
    EPSS69%
    ·
    Published Oct 11, 2017
  • CVE-2017-14980Critical 9.8
    Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login.
    flexense · syncbreeze
    EPSS22%
    2 exploits
    Published Oct 9, 2017
  • CVE-2017-14491Critical 9.8
    Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.
    thekelleys · dnsmasq
    EPSS85%
    3 exploits
    Published Oct 4, 2017
  • CVE-2017-14493Critical 9.8
    Stack-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DHCPv6 request.
    thekelleys · dnsmasq
    EPSS84%
    2 exploits
    Published Oct 3, 2017
  • CVE-2017-14492Critical 9.8
    Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted IPv6 router advertisement request.
    thekelleys · dnsmasq
    EPSS93%
    1 exploit
    Published Oct 3, 2017
  • CVE-2017-14942Critical 9.8
    Intelbras WRN 150 devices allow remote attackers to read the configuration file, and consequently bypass authentication, via a direct request for cgi-bin/DownloadCfg/RouterCfm.cfg containing an admin:language=pt cookie.
    intelbras · wrn 150 firmware
    EPSS61%
    1 exploit
    Published Sep 29, 2017
  • CVE-2015-8249Critical 9.8
    The FileUploadServlet class in ManageEngine Desktop Central 9 before build 91093 allows remote attackers to upload and execute arbitrary files via the ConnectionId parameter.
    manageengine · desktop central
    EPSS74%
    4 exploits
    Published Sep 27, 2017
  • CVE-2017-14706Critical 9.8
    DenyAll WAF before 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php, and then reading the iToken field in the reply.
    denyall · i-suite
    EPSS28%
    2 exploits
    Published Sep 22, 2017
  • CVE-2017-14078Critical 9.8
    SQL Injection vulnerabilities in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations.
    trendmicro · mobile security
    EPSS50%
    ·
    Published Sep 22, 2017
  • CVE-2014-8686Critical 9.8
    CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.
    codeigniter · codeigniter
    EPSS37%
    2 exploits
    Published Sep 19, 2017
  • CVE-2017-14143Critical 9.8
    The getUserzoneCookie function in Kaltura before 13.2.0 uses a hardcoded cookie secret to validate cookie signatures, which allows remote attackers to bypass an intended protection mechanism and consequently conduct PHP object injection attacks and execute arbitrary PHP code via…
    kaltura · kaltura server
    EPSS77%
    3 exploits
    Published Sep 19, 2017
  • CVE-2014-9618Critical 9.8
    The Client Filter Admin portal in Netsweeper before 3.1.10, 4.0.x before 4.0.9, and 4.1.x before 4.1.2 allows remote attackers to bypass authentication and subsequently create arbitrary profiles via a showdeny action to the default URL.
    netsweeper · netsweeper
    EPSS73%
    1 exploit
    Published Sep 19, 2017
  • CVE-2017-14147Critical 9.8
    An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which could allow an attacker to easily restore a router to its factory settings by simply browsing to the link http://[Default-Router-IP]/restoreinfo.cgi & execute it.
    fiberhome · adsl an1020-25 firmware
    EPSS66%
    3 exploits
    Published Sep 7, 2017
  • CVE-2015-2857Critical 9.8
    Accellion File Transfer Appliance before FTA_9_11_210 allows remote attackers to execute arbitrary code via shell metacharacters in the oauth_token parameter.
    accellion · file transfer appliance
    EPSS84%
    3 exploits
    Published Aug 22, 2017
  • CVE-2017-7546Critical 9.8
    postgresql-9.1 - security update
    postgresql · postgresql
    EPSS62%
    ·
    Published Aug 16, 2017
  • CVE-2015-7871Critical 9.8
    Crypto-NAK packets in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to bypass authentication.
    ntp · ntp
    EPSS82%
    ·
    Published Aug 7, 2017
  • CVE-2017-12478Critical 9.8
    It was discovered that the api/storage web interface in Unitrends Backup (UB) before 10.0.0 has an issue in which one of its input parameters was not validated.
    kaseya · unitrends backup
    EPSS78%
    6 exploits
    Published Aug 7, 2017
  • CVE-2017-12477Critical 9.8
    It was discovered that the bpserverd proprietary protocol in Unitrends Backup (UB) before 10.0.0, as invoked through xinetd, has an issue in which its authentication can be bypassed.
    kaseya · unitrends backup
    EPSS68%
    4 exploits
    Published Aug 7, 2017
  • CVE-2017-11394Critical 9.8
    Proxy command injection vulnerability in Trend Micro OfficeScan 11 and XG (12) allows remote attackers to execute arbitrary code on vulnerable installations.
    trendmicro · officescan
    EPSS67%
    2 exploits
    Published Aug 3, 2017
  • CVE-2017-9769Critical 9.8
    A specially crafted IOCTL can be issued to the rzpnk.sys driver in Razer Synapse 2.20.15.1104 that is forwarded to ZwOpenProcess allowing a handle to be opened to an arbitrary process.
    razer · synapse
    EPSS86%
    2 exploits
    Published Aug 2, 2017
  • CVE-2017-11517Critical 9.8
    Stack-based buffer overflow in GCoreServer.exe in the server in Geutebrueck Gcore 1.3.8.42 and 1.4.2.37 allows remote attackers to execute arbitrary code via a long URI in a GET request.
    geutebrueck · gcore
    EPSS29%
    3 exploits
    Published Jul 21, 2017
  • CVE-2017-1000002Critical 9.8
    ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution.
    atutor · atutor
    EPSS31%
    1 exploit
    Published Jul 17, 2017
  • CVE-2017-9788Critical 9.1
    In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest.
    apache · http server
    EPSS57%
    ·
    Published Jul 13, 2017
  • CVE-2017-11165Critical 9.8
    dataTaker DT80 dEX 1.50.012 allows remote attackers to obtain sensitive credential and configuration information via a direct request for the /services/getFile.cmd?userfile=config.xml URI.
    thermofisher · dt80 dex firmware
    EPSS64%
    2 exploits
    Published Jul 12, 2017
  • CVE-2017-6326Critical 10.0
    The Symantec Messaging Gateway can encounter an issue of remote code execution, which describes a situation whereby an individual may obtain the ability to execute commands remotely on a target machine or in a target process.
    symantec · messaging gateway
    EPSS73%
    2 exploits
    Published Jun 26, 2017
  • CVE-2017-9828Critical 9.8
    '/cgi-bin/admin/testserver.cgi' of the web service in most of the VIVOTEK Network Cameras is vulnerable to shell command injection, which allows remote attackers to execute any shell command as root via a crafted HTTP request.
    vivotek · network camera fd8164 firmware
    EPSS82%
    ·
    Published Jun 23, 2017
  • CVE-2017-9544Critical 9.8
    There is a remote stack-based buffer overflow (SEH) in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1.
    echatserver · easy chat server
    EPSS24%
    2 exploits
    Published Jun 12, 2017
  • CVE-2014-8687Critical 9.8
    Seagate Business NAS devices with firmware before 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging use of a static encryption key to create session tokens.
    seagate · business nas firmware
    EPSS44%
    7 exploits
    Published Jun 8, 2017
  • CVE-2017-8835Critical 9.8
    SQL injection exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before fw-b305hw2_380hw6_580hw2_710hw3_1350hw2_2500-7.0.1-build2093.
    peplink · 1350hw2 firmware
    EPSS62%
    1 exploit
    Published Jun 5, 2017
  • CVE-2017-9417Critical 9.8
    Broadcom BCM43xx Wi-Fi chips allow remote attackers to execute arbitrary code via unspecified vectors, aka the "Broadpwn" issue.
    broadcom · bcm43xx wi-fi chipset firmware
    EPSS64%
    1 exploit
    Published Jun 4, 2017
  • CVE-2015-0936Critical 9.8
    Ceragon FibeAir IP-10 have a default SSH public key in the authorized_keys file for the mateidu user, which allows remote attackers to obtain SSH access by leveraging knowledge of the private key.
    ceragon · fibeair ip-10 firmware
    EPSS78%
    3 exploits
    Published Jun 1, 2017
  • CVE-2017-1092Critical 9.8
    IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers.
    ibm · informix open admin tool
    EPSS76%
    3 exploits
    Published May 22, 2017
  • CVE-2017-9101Critical 9.8
    import.php (aka the Phonebook import feature) in PlaySMS 1.4 allows remote code execution via vectors involving the User-Agent HTTP header and PHP code in the name of a file.
    playsms · playsms
    EPSS77%
    4 exploits
    Published May 21, 2017
  • CVE-2017-5174Critical 9.8
    An Authentication Bypass issue was discovered in Geutebruck IP Camera G-Cam/EFD-2250 Version 1.11.0.12.
    geutebruck · ip camera g-cam efd-2250 firmware
    EPSS52%
    1 exploit
    Published May 19, 2017
  • CVE-2017-6622Critical 9.8
    A vulnerability in the web interface for Cisco Prime Collaboration Provisioning could allow an unauthenticated, remote attacker to bypass authentication and perform command injection with root privileges.
    cisco · prime collaboration provisioning
    EPSS62%
    1 exploit
    Published May 18, 2017
  • CVE-2017-8917Critical 9.8
    SQL injection vulnerability in Joomla!
    joomla · joomla\!
    EPSS100%
    5 exploits
    Published May 17, 2017
  • CVE-2016-10372Critical 9.8
    The Eir D1000 modem does not properly restrict the TR-064 protocol, which allows remote attackers to execute arbitrary commands via TCP port 7547, as demonstrated by opening WAN access to TCP port 80, retrieving the login password (which defaults to the Wi-Fi password), and…
    eir · d1000 modem firmware
    EPSS82%
    1 exploit
    Published May 16, 2017
Showing 851–900 of 1,642

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.