Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2018-0933High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS66%1 exploitPublished May 13, 2022
- CVE-2018-0860High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS65%1 exploitPublished May 13, 2022
- CVE-2018-0838High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS65%1 exploitPublished May 13, 2022
- CVE-2018-0837High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS65%1 exploitPublished May 13, 2022
- CVE-2018-0834High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS55%1 exploitPublished May 13, 2022
- CVE-2018-0835High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS65%1 exploitPublished May 13, 2022
- CVE-2017-7615High 8.8MantisBT allows arbitrary password resetmantisbt · mantisbtEPSS91%3 exploitsPublished May 13, 2022
- CVE-2013-2115High 8.1Code injection in Apache Strutsapache · strutsEPSS75%2 exploitsPublished May 13, 2022
- CVE-2019-1003001High 8.8Jenkins Groovy Plugin sandbox bypass vulnerabilityjenkins · pipeline\EPSS86%5 exploitsPublished May 13, 2022
- CVE-2019-1003002High 8.8Jenkins Pipeline Declarative Plugin sandbox bypass vulnerabilityjenkins · pipeline\EPSS81%5 exploitsPublished May 13, 2022
- CVE-2019-1003000High 8.8Protection Mechanism Failure in Jenkins Script Security Pluginjenkins · script securityEPSS98%7 exploitsPublished May 13, 2022
- CVE-2016-2510High 8.1Improper Input Validation in BeanShellbeanshell · beanshellEPSS70%·Published May 13, 2022
- CVE-2017-1000170High 7.5jqueryFileTree vulnerable to Directory Traversaljqueryfiletree project · jqueryfiletreeEPSS59%1 exploitPublished May 13, 2022
- CVE-2018-19422High 7.2Subrion CMS RCE Vulnerabilityintelliants · subrion cmsEPSS64%4 exploitsPublished May 13, 2022
- CVE-2017-5637High 7.5Uncontrolled Resource Consumption in Apache ZooKeeperapache · zookeeperEPSS73%1 exploitPublished May 13, 2022
- CVE-2011-5034Medium 5.3Apache Geronimo Hash Collisions Cause DoSapache · geronimoEPSS81%1 exploitPublished May 13, 2022
- CVE-2018-14773Medium 6.5Symfony HTTP Foundation web cache poisoningsensiolabs · symfonyEPSS58%·Published May 13, 2022
- CVE-2018-12613High 8.8phpMyAdmin Improper Authenticationphpmyadmin · phpmyadminEPSS98%8 exploitsPublished May 13, 2022
- CVE-2017-8046Critical 9.8Remote code execution in PATCH requests in Spring Data RESTpivotal software · spring data restEPSS75%1 exploitPublished May 13, 2022
- CVE-2013-6429Medium 6.8Cross-Site Request Forgery in Spring Frameworkpivotal software · spring frameworkEPSS91%·Published May 13, 2022
- CVE-2014-0054Medium 6.8Cross-Site Request Forgery in Spring Frameworkspringsource · spring frameworkEPSS91%·Published May 13, 2022
- CVE-2018-1999002High 7.5Improper Input Validation in Jenkinsjenkins · jenkinsEPSS86%2 exploitsPublished May 13, 2022
- CVE-2022-29885High 7.5Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumptionapache · tomcatEPSS73%1 exploitPublished May 13, 2022
- CVE-2022-1175Medium 6.1Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes.gitlab · gitlabEPSS82%1 exploitPublished May 12, 2022
- CVE-2022-29847High 7.5In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would allow them to relay encrypted WhatsUp Gold user credentials to an arbitrary host.progress · whatsup goldEPSS58%·Published May 11, 2022
- CVE-2022-26937Critical 9.8Windows Network File System Remote Code Execution Vulnerabilitymicrosoft · windows serverEPSS76%·Published May 11, 2022
- CVE-2022-26809Critical 9.8Remote Procedure Call Runtime Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS91%Ransomware1 actorPublished May 11, 2022
- CVE-2021-23840High 7.5openssl - security updateopenssl · opensslEPSS51%·Published May 11, 2022
- CVE-2022-23270High 8.1Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS70%·Published May 10, 2022
- CVE-2022-21972High 8.1Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS79%·Published May 10, 2022
- CVE-2022-1104Medium 4.8Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scriptingcode-atlantic · popup makerEPSS56%1 exploitPublished May 10, 2022
- CVE-2022-29535Critical 9.8Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.zohocorp · manageengine opmanagerEPSS92%·Published May 5, 2022
- CVE-2022-28080High 8.8Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter.event management system project · event management systemEPSS57%3 exploitsPublished May 5, 2022
- CVE-2022-1162Critical 9.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.gitlab · gitlabEPSS76%1 exploitPublished May 5, 2022
- CVE-2022-29155Critical 9.8In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query.openldap · openldapEPSS64%·Published May 4, 2022
- CVE-2012-0392Medium 6.8Apache Struts's CookieInterceptor component does not use the parameter-name whitelistapache · strutsEPSS98%1 exploitPublished May 4, 2022
- CVE-2012-0394Medium 6.8Apache Struts's DebuggingInterceptor component allows remote code execution in developer modeapache · strutsEPSS73%3 exploitsPublished May 4, 2022
- CVE-2009-0580Medium 4.3Exposure of Sensitive Information in Apache Tomcatapache · tomcatEPSS94%1 exploitPublished May 2, 2022
- CVE-2008-2938Medium 4.3Apache Tomcat Directory Traversal vulnerabilityapache · tomcatEPSS100%2 exploitsPublished May 1, 2022
- CVE-2008-2370Medium 5.0Apache Tomcat Path Traversal Vulnerabilityapache · tomcatEPSS53%1 exploitPublished May 1, 2022
- CVE-2008-1232Medium 4.3Apache Tomcat Cross-site scripting (XSS) vulnerabilityapache · tomcatEPSS76%1 exploitPublished May 1, 2022
- CVE-2007-5333Medium 5.0Exposure of Sensitive Information in Apache Tomcatapache · tomcatEPSS63%1 exploitPublished May 1, 2022
- CVE-2007-2449Medium 4.3Apache Tomcat XSS Vulnerabilities in Examples Web Applicationapache · tomcatEPSS77%1 exploitPublished May 1, 2022
- CVE-2007-1355Medium 5.3Apache Tomcat Vulnerable to Cross-Site Scriptingapache · tomcatEPSS58%1 exploitPublished May 1, 2022
- CVE-2007-0450Medium 5.0Apache Tomcat Directory Traversalapache · http serverEPSS91%1 exploitPublished May 1, 2022
- CVE-2006-7196Medium 4.3Cross-site scripting in Apache Tomcatapache · tomcatEPSS72%1 exploitPublished May 1, 2022
- CVE-2022-29081Critical 9.8Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction.zohocorp · manageengine access manager plusEPSS84%·Published Apr 28, 2022
- CVE-2021-46422Critical 9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.telesquare · sdt-cs3b1 firmwareEPSS94%3 exploitsPublished Apr 27, 2022
- CVE-2021-46442Critical 9.8In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization.dlink · dir-825 firmwareEPSS56%1 exploitPublished Apr 27, 2022
- CVE-2022-29806Critical 9.8ZoneMinder before 1.36.13 allows remote code execution via an invalid language.zoneminder · zoneminderEPSS67%2 exploitsPublished Apr 26, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2018-0933 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 66% | 1 exploit | |
| CVE-2018-0860 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 65% | 1 exploit | |
| CVE-2018-0838 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 65% | 1 exploit | |
| CVE-2018-0837 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 65% | 1 exploit | |
| CVE-2018-0834 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 55% | 1 exploit | |
| CVE-2018-0835 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 65% | 1 exploit | |
| CVE-2017-7615 | MantisBT allows arbitrary password reset mantisbt · mantisbt | High 8.8 | 91% | 3 exploits | |
| CVE-2013-2115 | Code injection in Apache Struts apache · struts | High 8.1 | 75% | 2 exploits | |
| CVE-2019-1003001 | Jenkins Groovy Plugin sandbox bypass vulnerability jenkins · pipeline\ | High 8.8 | 86% | 5 exploits | |
| CVE-2019-1003002 | Jenkins Pipeline Declarative Plugin sandbox bypass vulnerability jenkins · pipeline\ | High 8.8 | 81% | 5 exploits | |
| CVE-2019-1003000 | Protection Mechanism Failure in Jenkins Script Security Plugin jenkins · script security | High 8.8 | 98% | 7 exploits | |
| CVE-2016-2510 | Improper Input Validation in BeanShell beanshell · beanshell | High 8.1 | 70% | · | |
| CVE-2017-1000170 | jqueryFileTree vulnerable to Directory Traversal jqueryfiletree project · jqueryfiletree | High 7.5 | 59% | 1 exploit | |
| CVE-2018-19422 | Subrion CMS RCE Vulnerability intelliants · subrion cms | High 7.2 | 64% | 4 exploits | |
| CVE-2017-5637 | Uncontrolled Resource Consumption in Apache ZooKeeper apache · zookeeper | High 7.5 | 73% | 1 exploit | |
| CVE-2011-5034 | Apache Geronimo Hash Collisions Cause DoS apache · geronimo | Medium 5.3 | 81% | 1 exploit | |
| CVE-2018-14773 | Symfony HTTP Foundation web cache poisoning sensiolabs · symfony | Medium 6.5 | 58% | · | |
| CVE-2018-12613 | phpMyAdmin Improper Authentication phpmyadmin · phpmyadmin | High 8.8 | 98% | 8 exploits | |
| CVE-2017-8046 | Remote code execution in PATCH requests in Spring Data REST pivotal software · spring data rest | Critical 9.8 | 75% | 1 exploit | |
| CVE-2013-6429 | Cross-Site Request Forgery in Spring Framework pivotal software · spring framework | Medium 6.8 | 91% | · | |
| CVE-2014-0054 | Cross-Site Request Forgery in Spring Framework springsource · spring framework | Medium 6.8 | 91% | · | |
| CVE-2018-1999002 | Improper Input Validation in Jenkins jenkins · jenkins | High 7.5 | 86% | 2 exploits | |
| CVE-2022-29885 | Apache Tomcat EncryptInterceptor error leads to Uncontrolled Resource Consumption apache · tomcat | High 7.5 | 73% | 1 exploit | |
| CVE-2022-1175 | Improper neutralization of user input in GitLab CE/EE versions 14.4 before 14.7.7, all versions starting from 14.8 before 14.8.5, all versions starting from 14.9 before 14.9.2 allowed an attacker to exploit XSS by injecting HTML in notes. gitlab · gitlab | Medium 6.1 | 82% | 1 exploit | |
| CVE-2022-29847 | In Progress Ipswitch WhatsUp Gold 21.0.0 through 21.1.1, and 22.0.0, it is possible for an unauthenticated attacker to invoke an API transaction that would allow them to relay encrypted WhatsUp Gold user credentials to an arbitrary host. progress · whatsup gold | High 7.5 | 58% | · | |
| CVE-2022-26937 | Windows Network File System Remote Code Execution Vulnerability microsoft · windows server | Critical 9.8 | 76% | · | |
| CVE-2022-26809 | Remote Procedure Call Runtime Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 91% | Ransomware1 actor | |
| CVE-2021-23840 | openssl - security update openssl · openssl | High 7.5 | 51% | · | |
| CVE-2022-23270 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability microsoft · windows 10 | High 8.1 | 70% | · | |
| CVE-2022-21972 | Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability microsoft · windows 10 | High 8.1 | 79% | · | |
| CVE-2022-1104 | Popup Maker <= 1.16.4 - Authenticated (Admin+) Cross-Site Scripting code-atlantic · popup maker | Medium 4.8 | 56% | 1 exploit | |
| CVE-2022-29535 | Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. zohocorp · manageengine opmanager | Critical 9.8 | 92% | · | |
| CVE-2022-28080 | Royal Event Management System v1.0 was discovered to contain a SQL injection vulnerability via the todate parameter. event management system project · event management system | High 8.8 | 57% | 3 exploits | |
| CVE-2022-1162 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. gitlab · gitlab | Critical 9.8 | 76% | 1 exploit | |
| CVE-2022-29155 | In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. openldap · openldap | Critical 9.8 | 64% | · | |
| CVE-2012-0392 | Apache Struts's CookieInterceptor component does not use the parameter-name whitelist apache · struts | Medium 6.8 | 98% | 1 exploit | |
| CVE-2012-0394 | Apache Struts's DebuggingInterceptor component allows remote code execution in developer mode apache · struts | Medium 6.8 | 73% | 3 exploits | |
| CVE-2009-0580 | Exposure of Sensitive Information in Apache Tomcat apache · tomcat | Medium 4.3 | 94% | 1 exploit | |
| CVE-2008-2938 | Apache Tomcat Directory Traversal vulnerability apache · tomcat | Medium 4.3 | 100% | 2 exploits | |
| CVE-2008-2370 | Apache Tomcat Path Traversal Vulnerability apache · tomcat | Medium 5.0 | 53% | 1 exploit | |
| CVE-2008-1232 | Apache Tomcat Cross-site scripting (XSS) vulnerability apache · tomcat | Medium 4.3 | 76% | 1 exploit | |
| CVE-2007-5333 | Exposure of Sensitive Information in Apache Tomcat apache · tomcat | Medium 5.0 | 63% | 1 exploit | |
| CVE-2007-2449 | Apache Tomcat XSS Vulnerabilities in Examples Web Application apache · tomcat | Medium 4.3 | 77% | 1 exploit | |
| CVE-2007-1355 | Apache Tomcat Vulnerable to Cross-Site Scripting apache · tomcat | Medium 5.3 | 58% | 1 exploit | |
| CVE-2007-0450 | Apache Tomcat Directory Traversal apache · http server | Medium 5.0 | 91% | 1 exploit | |
| CVE-2006-7196 | Cross-site scripting in Apache Tomcat apache · tomcat | Medium 4.3 | 72% | 1 exploit | |
| CVE-2022-29081 | Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. zohocorp · manageengine access manager plus | Critical 9.8 | 84% | · | |
| CVE-2021-46422 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. telesquare · sdt-cs3b1 firmware | Critical 9.8 | 94% | 3 exploits | |
| CVE-2021-46442 | In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization. dlink · dir-825 firmware | Critical 9.8 | 56% | 1 exploit | |
| CVE-2022-29806 | ZoneMinder before 1.36.13 allows remote code execution via an invalid language. zoneminder · zoneminder | Critical 9.8 | 67% | 2 exploits |
Showing 1,001–1,050 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.