Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,918 vulnerabilities · highest exploit probability first
- CVE-2025-34152Critical 9.4An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint.EPSS87%1 exploitPublished Aug 7, 2025
- CVE-2025-47188Medium 6.5A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to…EPSS53%·Published Aug 7, 2025
- CVE-2025-54254High 8.6Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read.adobe · experience manager formsEPSS77%·Published Aug 5, 2025
- CVE-2025-36604Critical 9.8Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.dell · unity operating environmentEPSS66%·Published Aug 4, 2025
- CVE-2025-54782Critical 9.4@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developersnestjs · devtools-integrationEPSS52%·Published Aug 1, 2025
- CVE-2013-10059High 8.6An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint.dlink · dir-615h firmwareEPSS27%3 exploitsPublished Aug 1, 2025
- CVE-2019-25224Critical 9.8WP Database Backup < 5.2 - Unauthenticated OS Command Injectionwpseeds · wp database backupEPSS22%1 exploitPublished Jul 25, 2025
- CVE-2025-32429Critical 9.3XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterxwiki · xwikiEPSS88%1 exploitPublished Jul 24, 2025
- CVE-2025-40598Medium 6.1A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.sonicwall · sma 210 firmwareEPSS64%Ransomware1 actorPublished Jul 23, 2025
- CVE-2025-40596High 7.3A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.sonicwall · sma 210 firmwareEPSS57%Ransomware1 actorPublished Jul 23, 2025
- CVE-2025-6197Medium 4.2grafana: Open Redirect in GrafanaEPSS74%·Published Jul 22, 2025
- CVE-2025-6023High 7.6Grafana is vulnerable to XSS attacks through open redirects and path traversalEPSS53%·Published Jul 18, 2025
- CVE-2025-5394Critical 9.8Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin InstallationEPSS51%·Published Jul 17, 2025
- CVE-2025-34117Critical 9.3A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413.EPSS21%1 exploitPublished Jul 16, 2025
- CVE-2025-34300Critical 10.0A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application.EPSS81%1 exploitPublished Jul 16, 2025
- CVE-2025-6965High 7.2There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available.sqlite · sqliteEPSS73%1 exploitPublished Jul 15, 2025
- CVE-2020-36847Critical 9.8The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension.simplefilelist · simple file listEPSS44%3 exploitsPublished Jul 12, 2025
- CVE-2013-3307High 8.3Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.EPSS63%1 exploitPublished Jul 11, 2025
- CVE-2025-6970High 7.5The Events Manager – Calendar, Bookings, Tickets, and more!pixelite · events managerEPSS56%·Published Jul 9, 2025
- CVE-2025-6514Critical 9.6mcp-remote exposed to OS command injection via untrusted MCP server connectionsEPSS77%·Published Jul 9, 2025
- CVE-2025-49533Critical 9.8Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker.adobe · experience managerEPSS52%·Published Jul 8, 2025
- CVE-2025-53771Medium 6.5Microsoft SharePoint Server Spoofing Vulnerabilitymicrosoft · sharepoint serverEPSS100%Ransomware1 exploit8 actorsPublished Jul 8, 2025
- CVE-2025-5961High 7.2The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.wpvivid · migration\, backup\, stagingEPSS55%1 exploitPublished Jul 3, 2025
- CVE-2025-5306High 7.0Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.artica · pandora fmsEPSS36%1 exploitPublished Jun 27, 2025
- CVE-2025-34037Critical 10.0An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080.EPSS93%1 exploitPublished Jun 23, 2025
- CVE-2025-34030Critical 10.0An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php.EPSS52%·Published Jun 20, 2025
- CVE-2025-49132Critical 10.0Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionEPSS54%2 exploitsPublished Jun 19, 2025
- CVE-2025-34511High 8.8Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue.sitecore · experience managerEPSS30%1 exploitPublished Jun 17, 2025
- CVE-2025-34510High 8.8Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability.sitecore · experience commerceEPSS24%1 exploitPublished Jun 17, 2025
- CVE-2025-34509High 7.5Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev.sitecore · experience managerEPSS56%2 exploitsPublished Jun 17, 2025
- CVE-2025-34508Medium 5.3A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior.EPSS73%·Published Jun 17, 2025
- CVE-2025-5301Medium 6.1ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol.EPSS62%·Published Jun 12, 2025
- CVE-2025-27817Medium 8.6Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerabilityapache · kafkaEPSS69%·Published Jun 10, 2025
- CVE-2025-49619High 8.5Skyvern has a Jinja runtime leakEPSS20%1 exploitPublished Jun 7, 2025
- CVE-2025-41646Critical 9.8An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion.kunbus · revpi statusEPSS51%·Published Jun 6, 2025
- CVE-2025-44148Critical 9.8Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx componentmailenable · mailenableEPSS55%1 exploitPublished Jun 3, 2025
- CVE-2025-4009Critical 9.3This device exposes a web management interface on port 80.EPSS71%·Published May 28, 2025
- CVE-2025-48828High 8.1Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.vbulletin · vbulletinEPSS58%1 exploitPublished May 27, 2025
- CVE-2025-48827Critical 9.8vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.vbulletin · vbulletinEPSS76%1 exploitPublished May 27, 2025
- CVE-2025-4123Medium 6.1Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugingrafana · grafanaEPSS97%·Published May 22, 2025
- CVE-2025-4901Medium 5.3A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125).dlink · di-7003g firmwareEPSS79%1 exploitPublished May 18, 2025
- CVE-2025-47916Critical 9.8Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.invisioncommunity · invisioncommunityEPSS84%2 exploitsPublished May 16, 2025
- CVE-2025-43566Medium 6.8ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.adobe · coldfusionEPSS57%·Published May 13, 2025
- CVE-2024-48766High 8.6NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025.netalertx · netalertxEPSS68%·Published May 13, 2025
- CVE-2024-46506Critical 10.0NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025.netalertx · netalertxEPSS62%1 exploitPublished May 13, 2025
- CVE-2025-29971High 7.5Web Threat Defense (WTD.sys) Denial of Service Vulnerabilitymicrosoft · windows 11 22h2EPSS67%·Published May 13, 2025
- CVE-2025-4443Medium 5.3It has been rated as critical.dlink · dir-605l firmwareEPSS63%·Published May 8, 2025
- CVE-2025-2777Critical 9.8SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.sysaid · sysaidEPSS73%·Published May 7, 2025
- CVE-2025-27007Critical 9.8OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege EscalationEPSS54%2 exploitsPublished Apr 29, 2025
- CVE-2025-31650Medium 8.7Apache Tomcat Denial of Service via invalid HTTP priority headerapache · tomcatEPSS61%1 exploitPublished Apr 28, 2025
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-34152 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. | Critical 9.4 | 87% | 1 exploit | |
| CVE-2025-47188 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to… | Medium 6.5 | 53% | · | |
| CVE-2025-54254 | Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. adobe · experience manager forms | High 8.6 | 77% | · | |
| CVE-2025-36604 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. dell · unity operating environment | Critical 9.8 | 66% | · | |
| CVE-2025-54782 | @nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers nestjs · devtools-integration | Critical 9.4 | 52% | · | |
| CVE-2013-10059 | An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. dlink · dir-615h firmware | High 8.6 | 27% | 3 exploits | |
| CVE-2019-25224 | WP Database Backup < 5.2 - Unauthenticated OS Command Injection wpseeds · wp database backup | Critical 9.8 | 22% | 1 exploit | |
| CVE-2025-32429 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter xwiki · xwiki | Critical 9.3 | 88% | 1 exploit | |
| CVE-2025-40598 | A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code. sonicwall · sma 210 firmware | Medium 6.1 | 64% | Ransomware1 actor | |
| CVE-2025-40596 | A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution. sonicwall · sma 210 firmware | High 7.3 | 57% | Ransomware1 actor | |
| CVE-2025-6197 | grafana: Open Redirect in Grafana | Medium 4.2 | 74% | · | |
| CVE-2025-6023 | Grafana is vulnerable to XSS attacks through open redirects and path traversal | High 7.6 | 53% | · | |
| CVE-2025-5394 | Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation | Critical 9.8 | 51% | · | |
| CVE-2025-34117 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. | Critical 9.3 | 21% | 1 exploit | |
| CVE-2025-34300 | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. | Critical 10.0 | 81% | 1 exploit | |
| CVE-2025-6965 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. sqlite · sqlite | High 7.2 | 73% | 1 exploit | |
| CVE-2020-36847 | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. simplefilelist · simple file list | Critical 9.8 | 44% | 3 exploits | |
| CVE-2013-3307 | Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000. | High 8.3 | 63% | 1 exploit | |
| CVE-2025-6970 | The Events Manager – Calendar, Bookings, Tickets, and more! pixelite · events manager | High 7.5 | 56% | · | |
| CVE-2025-6514 | mcp-remote exposed to OS command injection via untrusted MCP server connections | Critical 9.6 | 77% | · | |
| CVE-2025-49533 | Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. adobe · experience manager | Critical 9.8 | 52% | · | |
| CVE-2025-53771 | Microsoft SharePoint Server Spoofing Vulnerability microsoft · sharepoint server | Medium 6.5 | 100% | Ransomware1 exploit8 actors | |
| CVE-2025-5961 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. wpvivid · migration\, backup\, staging | High 7.2 | 55% | 1 exploit | |
| CVE-2025-5306 | Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. artica · pandora fms | High 7.0 | 36% | 1 exploit | |
| CVE-2025-34037 | An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. | Critical 10.0 | 93% | 1 exploit | |
| CVE-2025-34030 | An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. | Critical 10.0 | 52% | · | |
| CVE-2025-49132 | Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution | Critical 10.0 | 54% | 2 exploits | |
| CVE-2025-34511 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. sitecore · experience manager | High 8.8 | 30% | 1 exploit | |
| CVE-2025-34510 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. sitecore · experience commerce | High 8.8 | 24% | 1 exploit | |
| CVE-2025-34509 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. sitecore · experience manager | High 7.5 | 56% | 2 exploits | |
| CVE-2025-34508 | A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. | Medium 5.3 | 73% | · | |
| CVE-2025-5301 | ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. | Medium 6.1 | 62% | · | |
| CVE-2025-27817 | Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability apache · kafka | Medium 8.6 | 69% | · | |
| CVE-2025-49619 | Skyvern has a Jinja runtime leak | High 8.5 | 20% | 1 exploit | |
| CVE-2025-41646 | An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. kunbus · revpi status | Critical 9.8 | 51% | · | |
| CVE-2025-44148 | Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component mailenable · mailenable | Critical 9.8 | 55% | 1 exploit | |
| CVE-2025-4009 | This device exposes a web management interface on port 80. | Critical 9.3 | 71% | · | |
| CVE-2025-48828 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. vbulletin · vbulletin | High 8.1 | 58% | 1 exploit | |
| CVE-2025-48827 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025. vbulletin · vbulletin | Critical 9.8 | 76% | 1 exploit | |
| CVE-2025-4123 | Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin grafana · grafana | Medium 6.1 | 97% | · | |
| CVE-2025-4901 | A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). dlink · di-7003g firmware | Medium 5.3 | 79% | 1 exploit | |
| CVE-2025-47916 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. invisioncommunity · invisioncommunity | Critical 9.8 | 84% | 2 exploits | |
| CVE-2025-43566 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. adobe · coldfusion | Medium 6.8 | 57% | · | |
| CVE-2024-48766 | NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. netalertx · netalertx | High 8.6 | 68% | · | |
| CVE-2024-46506 | NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. netalertx · netalertx | Critical 10.0 | 62% | 1 exploit | |
| CVE-2025-29971 | Web Threat Defense (WTD.sys) Denial of Service Vulnerability microsoft · windows 11 22h2 | High 7.5 | 67% | · | |
| CVE-2025-4443 | It has been rated as critical. dlink · dir-605l firmware | Medium 5.3 | 63% | · | |
| CVE-2025-2777 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives. sysaid · sysaid | Critical 9.8 | 73% | · | |
| CVE-2025-27007 | OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege Escalation | Critical 9.8 | 54% | 2 exploits | |
| CVE-2025-31650 | Apache Tomcat Denial of Service via invalid HTTP priority header apache · tomcat | Medium 8.7 | 61% | 1 exploit |
Showing 51–100 of 3,918
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.