Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2025-47916Critical 9.8Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php.invisioncommunity · invisioncommunityEPSS84%2 exploitsPublished May 16, 2025
- CVE-2024-46506Critical 10.0NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025.netalertx · netalertxEPSS62%1 exploitPublished May 13, 2025
- CVE-2025-2777Critical 9.8SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives.sysaid · sysaidEPSS73%·Published May 7, 2025
- CVE-2025-27007Critical 9.8OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege EscalationEPSS54%2 exploitsPublished Apr 29, 2025
- CVE-2025-32969Critical 9.3org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIxwiki · xwikiEPSS80%1 exploitPublished Apr 23, 2025
- CVE-2025-32375Critical 9.8BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserializationbentoml · bentomlEPSS52%1 exploitPublished Apr 9, 2025
- CVE-2025-27520Critical 9.8BentoML Allows Remote Code Execution (RCE) via Insecure Deserializationbentoml · bentomlEPSS41%1 exploitPublished Apr 4, 2025
- CVE-2024-56325Critical 9.3Apache Pinot Vulnerable to Authentication Bypassapache · pinotEPSS80%·Published Apr 1, 2025
- CVE-2025-2294Critical 9.8Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File InclusionEPSS78%1 exploitPublished Mar 28, 2025
- CVE-2025-1974Critical 9.8ingress-nginx admission controller RCE escalationEPSS99%1 exploitPublished Mar 25, 2025
- CVE-2025-29927Critical 9.1Authorization Bypass in Next.js Middlewarevercel · next.jsEPSS99%Ransomware1 exploit1 actorPublished Mar 21, 2025
- CVE-2025-24799Critical 9.8An unauthenticated user can perform a SQL injection through the inventory endpoint.glpi-project · glpiEPSS87%·Published Mar 18, 2025
- CVE-2025-25292Critical 9.3Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)onelogin · ruby-samlEPSS65%·Published Mar 12, 2025
- CVE-2025-1661Critical 9.8HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusionpluginus · husky - products filter professional for woocommerceEPSS56%·Published Mar 11, 2025
- CVE-2025-26794Critical 9.8Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.exim · eximEPSS77%·Published Feb 21, 2025
- CVE-2025-1044Critical 9.8Logsign Unified SecOps Platform Authentication Bypass Vulnerability.logsign · unified secops platformEPSS75%·Published Feb 11, 2025
- CVE-2024-36404Critical 9.8GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressionsEPSS76%·Published Feb 5, 2025
- CVE-2024-12084Critical 9.8rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handlingsamba · rsyncEPSS72%1 exploitPublished Jan 16, 2025
- CVE-2025-21298Critical 9.8Windows OLE Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS81%·Published Jan 15, 2025
- CVE-2024-48760Critical 9.8An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function.gestioip · gestioipEPSS45%3 exploitsPublished Jan 14, 2025
- CVE-2024-13179Critical 9.8Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.ivanti · avalancheEPSS63%·Published Jan 14, 2025
- CVE-2024-12847Critical 9.8NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability.netgear · dgn1000 firmwareEPSS30%3 exploitsPublished Jan 10, 2025
- CVE-2024-56511Critical 9.3Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access.dataease · dataeaseEPSS50%1 exploitPublished Jan 10, 2025
- CVE-2024-54676Critical 9.3Apache OpenMeetings vulnerable to Deserialization of Untrusted Dataapache · openmeetingsEPSS69%·Published Jan 8, 2025
- CVE-2024-55556Critical 9.8A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data.EPSS44%1 exploitPublished Jan 7, 2025
- CVE-2024-11972Critical 9.8The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk…themehunk · hunk companionEPSS59%1 exploitPublished Dec 31, 2024
- CVE-2024-43441Critical 9.8Apache HugeGraph-Server: Fixed JWT Token (Secret)apache · hugegraphEPSS73%·Published Dec 24, 2024
- CVE-2024-39931Critical 9.9Gogs allows deletion of internal filesgogs · gogsEPSS53%·Published Dec 23, 2024
- CVE-2024-49112Critical 9.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS72%·Published Dec 12, 2024
- CVE-2024-53677Critical 9.5Apache Struts file upload logic is flawedapache · strutsEPSS70%·Published Dec 11, 2024
- CVE-2024-42327Critical 9.9A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability.zabbix · zabbixEPSS79%1 exploitPublished Nov 27, 2024
- CVE-2024-53676Critical 9.8A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.hpe · insight remote supportEPSS56%·Published Nov 26, 2024
- CVE-2024-33610Critical 9.1"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.EPSS50%·Published Nov 26, 2024
- CVE-2024-47407Critical 10.0A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.EPSS64%1 exploitPublished Nov 22, 2024
- CVE-2024-8856Critical 9.8Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Uploadrevmakx · backup and staging by wp time capsuleEPSS94%2 exploitsPublished Nov 18, 2024
- CVE-2024-10924Critical 9.8Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypassreally-simple-plugins · really simple securityEPSS82%2 exploitsPublished Nov 13, 2024
- CVE-2024-10914Critical 9.2It has been declared as critical.dlink · dns-320 firmwareEPSS96%1 exploitPublished Nov 7, 2024
- CVE-2024-10915Critical 9.2It has been rated as critical.dlink · dns-320 firmwareEPSS80%·Published Nov 7, 2024
- CVE-2024-51568Critical 9.8CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.cyberpanel · cyberpanelEPSS48%2 exploitsPublished Oct 30, 2024
- CVE-2024-50498Critical 9.8WP Query Console <= 1.0 - Unauthenticated Remote Code Executionlubus · wp query consoleEPSS53%·Published Oct 30, 2024
- CVE-2024-46538Critical 9.3A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.netgate · pfsenseEPSS80%1 exploitPublished Oct 22, 2024
- CVE-2024-35286Critical 9.8A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input.mitel · micollabEPSS66%·Published Oct 22, 2024
- CVE-2024-9264Critical 9.4Grafana Command Injection And Local File Inclusion Via Sql Expressionsgrafana · grafanaEPSS97%1 exploitPublished Oct 18, 2024
- CVE-2024-45216Critical 9.3Improper Authentication vulnerability in Apache Solrapache · solrEPSS93%·Published Oct 17, 2024
- CVE-2024-9061Critical 9.8WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Addthemehunk · wp popup builderEPSS52%·Published Oct 17, 2024
- CVE-2024-32651Critical 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command ExecutionEPSS84%·Published Oct 15, 2024
- CVE-2024-48914Critical 9.1Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyEPSS60%·Published Oct 15, 2024
- CVE-2024-9047Critical 9.8WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.phpiptanus · wordpress file uploadEPSS93%·Published Oct 14, 2024
- CVE-2024-9464Critical 9.3An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.paloaltonetworks · expeditionEPSS83%1 exploitPublished Oct 10, 2024
- CVE-2024-9441Critical 9.8The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability.EPSS53%·Published Oct 2, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-47916 | Invision Community 5.0.0 before 5.0.7 allows remote code execution via crafted template strings to themeeditor.php. invisioncommunity · invisioncommunity | Critical 9.8 | 84% | 2 exploits | |
| CVE-2024-46506 | NetAlertX 23.01.14 through 24.x before 24.10.12 allows unauthenticated command injection via settings update because function=savesettings lacks an authentication requirement, as exploited in the wild in May 2025. netalertx · netalertx | Critical 10.0 | 62% | 1 exploit | |
| CVE-2025-2777 | SysAid On-Prem versions <= 23.3.40 are vulnerable to an unauthenticated XML External Entity (XXE) vulnerability in the lshw processing functionality, allowing for administrator account takeover and file read primitives. sysaid · sysaid | Critical 9.8 | 73% | · | |
| CVE-2025-27007 | OttoKit: All-in-One Automation Platform (Formerly SureTriggers) <= 1.0.82 - Unauthenticated Privilege Escalation | Critical 9.8 | 54% | 2 exploits | |
| CVE-2025-32969 | org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API xwiki · xwiki | Critical 9.3 | 80% | 1 exploit | |
| CVE-2025-32375 | BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization bentoml · bentoml | Critical 9.8 | 52% | 1 exploit | |
| CVE-2025-27520 | BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization bentoml · bentoml | Critical 9.8 | 41% | 1 exploit | |
| CVE-2024-56325 | Apache Pinot Vulnerable to Authentication Bypass apache · pinot | Critical 9.3 | 80% | · | |
| CVE-2025-2294 | Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion | Critical 9.8 | 78% | 1 exploit | |
| CVE-2025-1974 | ingress-nginx admission controller RCE escalation | Critical 9.8 | 99% | 1 exploit | |
| CVE-2025-29927 | Authorization Bypass in Next.js Middleware vercel · next.js | Critical 9.1 | 99% | Ransomware1 exploit1 actor | |
| CVE-2025-24799 | An unauthenticated user can perform a SQL injection through the inventory endpoint. glpi-project · glpi | Critical 9.8 | 87% | · | |
| CVE-2025-25292 | Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) onelogin · ruby-saml | Critical 9.3 | 65% | · | |
| CVE-2025-1661 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion pluginus · husky - products filter professional for woocommerce | Critical 9.8 | 56% | · | |
| CVE-2025-26794 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. exim · exim | Critical 9.8 | 77% | · | |
| CVE-2025-1044 | Logsign Unified SecOps Platform Authentication Bypass Vulnerability. logsign · unified secops platform | Critical 9.8 | 75% | · | |
| CVE-2024-36404 | GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions | Critical 9.8 | 76% | · | |
| CVE-2024-12084 | rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling samba · rsync | Critical 9.8 | 72% | 1 exploit | |
| CVE-2025-21298 | Windows OLE Remote Code Execution Vulnerability microsoft · windows 10 1507 | Critical 9.8 | 81% | · | |
| CVE-2024-48760 | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. gestioip · gestioip | Critical 9.8 | 45% | 3 exploits | |
| CVE-2024-13179 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. ivanti · avalanche | Critical 9.8 | 63% | · | |
| CVE-2024-12847 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. netgear · dgn1000 firmware | Critical 9.8 | 30% | 3 exploits | |
| CVE-2024-56511 | Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. dataease · dataease | Critical 9.3 | 50% | 1 exploit | |
| CVE-2024-54676 | Apache OpenMeetings vulnerable to Deserialization of Untrusted Data apache · openmeetings | Critical 9.3 | 69% | · | |
| CVE-2024-55556 | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. | Critical 9.8 | 44% | 1 exploit | |
| CVE-2024-11972 | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk… themehunk · hunk companion | Critical 9.8 | 59% | 1 exploit | |
| CVE-2024-43441 | Apache HugeGraph-Server: Fixed JWT Token (Secret) apache · hugegraph | Critical 9.8 | 73% | · | |
| CVE-2024-39931 | Gogs allows deletion of internal files gogs · gogs | Critical 9.9 | 53% | · | |
| CVE-2024-49112 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability microsoft · windows 10 1507 | Critical 9.8 | 72% | · | |
| CVE-2024-53677 | Apache Struts file upload logic is flawed apache · struts | Critical 9.5 | 70% | · | |
| CVE-2024-42327 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. zabbix · zabbix | Critical 9.9 | 79% | 1 exploit | |
| CVE-2024-53676 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. hpe · insight remote support | Critical 9.8 | 56% | · | |
| CVE-2024-33610 | "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. | Critical 9.1 | 50% | · | |
| CVE-2024-47407 | A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. | Critical 10.0 | 64% | 1 exploit | |
| CVE-2024-8856 | Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload revmakx · backup and staging by wp time capsule | Critical 9.8 | 94% | 2 exploits | |
| CVE-2024-10924 | Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass really-simple-plugins · really simple security | Critical 9.8 | 82% | 2 exploits | |
| CVE-2024-10914 | It has been declared as critical. dlink · dns-320 firmware | Critical 9.2 | 96% | 1 exploit | |
| CVE-2024-10915 | It has been rated as critical. dlink · dns-320 firmware | Critical 9.2 | 80% | · | |
| CVE-2024-51568 | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. cyberpanel · cyberpanel | Critical 9.8 | 48% | 2 exploits | |
| CVE-2024-50498 | WP Query Console <= 1.0 - Unauthenticated Remote Code Execution lubus · wp query console | Critical 9.8 | 53% | · | |
| CVE-2024-46538 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php. netgate · pfsense | Critical 9.3 | 80% | 1 exploit | |
| CVE-2024-35286 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. mitel · micollab | Critical 9.8 | 66% | · | |
| CVE-2024-9264 | Grafana Command Injection And Local File Inclusion Via Sql Expressions grafana · grafana | Critical 9.4 | 97% | 1 exploit | |
| CVE-2024-45216 | Improper Authentication vulnerability in Apache Solr apache · solr | Critical 9.3 | 93% | · | |
| CVE-2024-9061 | WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add themehunk · wp popup builder | Critical 9.8 | 52% | · | |
| CVE-2024-32651 | changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution | Critical 10.0 | 84% | · | |
| CVE-2024-48914 | Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy | Critical 9.1 | 60% | · | |
| CVE-2024-9047 | WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php iptanus · wordpress file upload | Critical 9.8 | 93% | · | |
| CVE-2024-9464 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. paloaltonetworks · expedition | Critical 9.3 | 83% | 1 exploit | |
| CVE-2024-9441 | The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. | Critical 9.8 | 53% | · |
Showing 51–100 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.