Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2021-25094High 8.1The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory.brandexponents · tatsuEPSS83%2 exploitsPublished Apr 25, 2022
- CVE-2022-1429High 7.5SQL Injection found in Pimcorepimcore · pimcoreEPSS64%·Published Apr 23, 2022
- CVE-2011-3923Critical 9.8Struts ParameterInterceptor vulnerability allows remote command executionapache · strutsEPSS89%2 exploitsPublished Apr 22, 2022
- CVE-2022-26133Critical 9.8SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute…atlassian · bitbucket data centerEPSS70%·Published Apr 20, 2022
- CVE-2022-0540Critical 9.8A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request.atlassian · jira serverEPSS88%·Published Apr 20, 2022
- CVE-2022-21490Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS79%·Published Apr 19, 2022
- CVE-2022-21489Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysqlEPSS79%·Published Apr 19, 2022
- CVE-2022-1329High 8.8The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to…elementor · website builderEPSS93%2 exploitsPublished Apr 19, 2022
- CVE-2022-22149High 8.8A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper · lansweeperEPSS73%·Published Apr 14, 2022
- CVE-2022-21234High 8.8An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper · lansweeperEPSS73%·Published Apr 14, 2022
- CVE-2022-21210High 8.8An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper · lansweeperEPSS71%·Published Apr 14, 2022
- CVE-2022-21145Medium 4.8A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper · lansweeperEPSS78%·Published Apr 14, 2022
- CVE-2022-22956Critical 9.8VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.vmware · identity managerEPSS50%1 exploitPublished Apr 14, 2022
- CVE-2022-22957High 7.2VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958).vmware · identity managerEPSS23%1 exploitPublished Apr 14, 2022
- CVE-2021-31805Critical 9.8Expression Language Injection in Apache Strutsapache · strutsEPSS85%·Published Apr 13, 2022
- CVE-2022-29036Medium 5.4Cross-site Scripting in Jenkins Credentials Pluginjenkins · credentialsEPSS72%·Published Apr 13, 2022
- CVE-2016-5385High 8.1HTTP Proxy header vulnerabilityphp · phpEPSS50%·Published Apr 7, 2022
- CVE-2021-46419Critical 9.1An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.telesquare · tlr-2855ks6 firmwareEPSS71%2 exploitsPublished Apr 7, 2022
- CVE-2021-46417High 7.5Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580.franklinfueling · colibri firmwareEPSS60%3 exploitsPublished Apr 7, 2022
- CVE-2021-30497High 7.5Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal.ivanti · avalancheEPSS97%·Published Apr 5, 2022
- CVE-2022-28219Critical 9.8Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.zohocorp · manageengine adaudit plusEPSS97%2 exploitsPublished Apr 5, 2022
- CVE-2022-1190Medium 5.4Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.gitlab · gitlabEPSS88%·Published Apr 4, 2022
- CVE-2022-0342Critical 9.8An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG…zyxel · atp100 firmwareEPSS95%·Published Apr 4, 2022
- CVE-2022-28368Critical 9.8Remote code injection in dompdf/dompdfdompdf project · dompdfEPSS83%2 exploitsPublished Apr 4, 2022
- CVE-2022-28381Critical 9.8Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.allmediaserver · allmediaserverEPSS70%3 exploitsPublished Apr 3, 2022
- CVE-2022-28379Medium 4.8jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.nginxproxymanager · nginx proxy managerEPSS71%1 exploitPublished Apr 3, 2022
- CVE-2021-22883High 7.5Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established.nodejs · node.jsEPSS77%·Published Apr 1, 2022
- CVE-2022-1181Medium 5.4Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.open-emr · openemrEPSS51%·Published Mar 30, 2022
- CVE-2022-1179Medium 5.4Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.open-emr · openemrEPSS77%·Published Mar 30, 2022
- CVE-2022-1178Medium 5.4Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.open-emr · openemrEPSS52%·Published Mar 30, 2022
- CVE-2022-22274Critical 9.8A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall.sonicwall · sonicosEPSS76%·Published Mar 30, 2022
- CVE-2021-4191Medium 5.3Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.gitlab · gitlabEPSS80%·Published Mar 28, 2022
- CVE-2022-0415High 8.8Unrestricted Upload of File with Dangerous Type in Gogsgogs · gogsEPSS65%·Published Mar 28, 2022
- CVE-2022-1058Medium 6.1Gitea Open Redirectgitea · giteaEPSS53%·Published Mar 25, 2022
- CVE-2022-23305Critical 9.8By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.apache · log4jEPSS67%·Published Mar 24, 2022
- CVE-2022-23881Critical 9.8ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.zzzcms · zzzphpEPSS57%1 exploitPublished Mar 23, 2022
- CVE-2022-0364Medium 5.4Modern Events Calendar Lite <= 6.3.0 - Stored Cross-Site Scriptingwebnus · modern events calendar liteEPSS70%·Published Mar 22, 2022
- CVE-2022-26960Critical 9.1Path Traversal in Studio-42 elFinder through 2.1.60std42 · elfinderEPSS51%·Published Mar 22, 2022
- CVE-2022-26148Critical 9.8The Zabbix password can be found in the api_jsonrpc.php HTML source code.grafana · grafanaEPSS53%·Published Mar 21, 2022
- CVE-2022-24637Critical 9.8Improper Privilege Management in Open Web Analyticsopenwebanalytics · open web analyticsEPSS99%3 exploitsPublished Mar 19, 2022
- CVE-2021-30180Critical 9.8Code injection in Apache Dubboapache · dubboEPSS60%·Published Mar 18, 2022
- CVE-2021-30181Critical 9.8Code injection in Apache Dubboapache · dubboEPSS61%·Published Mar 18, 2022
- CVE-2022-23943Critical 9.8Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data.apache · http serverEPSS50%·Published Mar 16, 2022
- CVE-2022-25487Critical 9.8Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.thedigitalcraft · atomcmsEPSS54%2 exploitsPublished Mar 15, 2022
- CVE-2021-45010High 8.8A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution.prasathmani · tiny file managerEPSS70%3 exploitsPublished Mar 15, 2022
- CVE-2021-40346High 7.5An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs.haproxy · haproxyEPSS59%·Published Mar 15, 2022
- CVE-2022-0169Critical 9.8Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter10web · photo galleryEPSS75%·Published Mar 15, 2022
- CVE-2021-25003Critical 9.8WPCargo <= 6.8.9 - Unauthenticated Remote Code Executionwptaskforce · wpcargo track \& traceEPSS56%·Published Mar 15, 2022
- CVE-2021-3711Critical 9.8SM2 Decryption Buffer Overflowopenssl · opensslEPSS88%·Published Mar 11, 2022
- CVE-2021-25216Critical 9.8In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running…isc · bindEPSS82%·Published Mar 11, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-25094 | The Tatsu WordPress plugin before 3.3.12 add_custom_font action can be used without prior authentication to upload a rogue zip file which is uncompressed under the WordPress's upload directory. brandexponents · tatsu | High 8.1 | 83% | 2 exploits | |
| CVE-2022-1429 | SQL Injection found in Pimcore pimcore · pimcore | High 7.5 | 64% | · | |
| CVE-2011-3923 | Struts ParameterInterceptor vulnerability allows remote command execution apache · struts | Critical 9.8 | 89% | 2 exploits | |
| CVE-2022-26133 | SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute… atlassian · bitbucket data center | Critical 9.8 | 70% | · | |
| CVE-2022-0540 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. atlassian · jira server | Critical 9.8 | 88% | · | |
| CVE-2022-21490 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 79% | · | |
| CVE-2022-21489 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql | Medium 6.3 | 79% | · | |
| CVE-2022-1329 | The Elementor Website Builder plugin for WordPress is vulnerable to unauthorized execution of several AJAX actions due to a missing capability check in the ~/core/app/modules/onboarding/module.php file that make it possible for attackers to modify site data in addition to… elementor · website builder | High 8.8 | 93% | 2 exploits | |
| CVE-2022-22149 | A SQL injection vulnerability exists in the HelpdeskEmailActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. lansweeper · lansweeper | High 8.8 | 73% | · | |
| CVE-2022-21234 | An SQL injection vulnerability exists in the EchoAssets.aspx functionality of Lansweeper lansweeper 9.1.20.2. lansweeper · lansweeper | High 8.8 | 73% | · | |
| CVE-2022-21210 | An SQL injection vulnerability exists in the AssetActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. lansweeper · lansweeper | High 8.8 | 71% | · | |
| CVE-2022-21145 | A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. lansweeper · lansweeper | Medium 4.8 | 78% | · | |
| CVE-2022-22956 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. vmware · identity manager | Critical 9.8 | 50% | 1 exploit | |
| CVE-2022-22957 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain two remote code execution vulnerabilities (CVE-2022-22957 & CVE-2022-22958). vmware · identity manager | High 7.2 | 23% | 1 exploit | |
| CVE-2021-31805 | Expression Language Injection in Apache Struts apache · struts | Critical 9.8 | 85% | · | |
| CVE-2022-29036 | Cross-site Scripting in Jenkins Credentials Plugin jenkins · credentials | Medium 5.4 | 72% | · | |
| CVE-2016-5385 | HTTP Proxy header vulnerability php · php | High 8.1 | 50% | · | |
| CVE-2021-46419 | An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. telesquare · tlr-2855ks6 firmware | Critical 9.1 | 71% | 2 exploits | |
| CVE-2021-46417 | Insecure handling of a download function leads to disclosure of internal files due to path traversal with root privileges in Franklin Fueling Systems Colibri Controller Module 1.8.19.8580. franklinfueling · colibri firmware | High 7.5 | 60% | 3 exploits | |
| CVE-2021-30497 | Ivanti Avalanche (Premise) 6.3.2 allows remote unauthenticated users to read arbitrary files via Absolute Path Traversal. ivanti · avalanche | High 7.5 | 97% | · | |
| CVE-2022-28219 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. zohocorp · manageengine adaudit plus | Critical 9.8 | 97% | 2 exploits | |
| CVE-2022-1190 | Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc. gitlab · gitlab | Medium 5.4 | 88% | · | |
| CVE-2022-0342 | An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG… zyxel · atp100 firmware | Critical 9.8 | 95% | · | |
| CVE-2022-28368 | Remote code injection in dompdf/dompdf dompdf project · dompdf | Critical 9.8 | 83% | 2 exploits | |
| CVE-2022-28381 | Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932. allmediaserver · allmediaserver | Critical 9.8 | 70% | 3 exploits | |
| CVE-2022-28379 | jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. nginxproxymanager · nginx proxy manager | Medium 4.8 | 71% | 1 exploit | |
| CVE-2021-22883 | Node.js before 10.24.0, 12.21.0, 14.16.0, and 15.10.0 is vulnerable to a denial of service attack when too many connection attempts with an 'unknownProtocol' are established. nodejs · node.js | High 7.5 | 77% | · | |
| CVE-2022-1181 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2. open-emr · openemr | Medium 5.4 | 51% | · | |
| CVE-2022-1179 | Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. open-emr · openemr | Medium 5.4 | 77% | · | |
| CVE-2022-1178 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. open-emr · openemr | Medium 5.4 | 52% | · | |
| CVE-2022-22274 | A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall. sonicwall · sonicos | Critical 9.8 | 76% | · | |
| CVE-2021-4191 | Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API. gitlab · gitlab | Medium 5.3 | 80% | · | |
| CVE-2022-0415 | Unrestricted Upload of File with Dangerous Type in Gogs gogs · gogs | High 8.8 | 65% | · | |
| CVE-2022-1058 | Gitea Open Redirect gitea · gitea | Medium 6.1 | 53% | · | |
| CVE-2022-23305 | By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. apache · log4j | Critical 9.8 | 67% | · | |
| CVE-2022-23881 | ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. zzzcms · zzzphp | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-0364 | Modern Events Calendar Lite <= 6.3.0 - Stored Cross-Site Scripting webnus · modern events calendar lite | Medium 5.4 | 70% | · | |
| CVE-2022-26960 | Path Traversal in Studio-42 elFinder through 2.1.60 std42 · elfinder | Critical 9.1 | 51% | · | |
| CVE-2022-26148 | The Zabbix password can be found in the api_jsonrpc.php HTML source code. grafana · grafana | Critical 9.8 | 53% | · | |
| CVE-2022-24637 | Improper Privilege Management in Open Web Analytics openwebanalytics · open web analytics | Critical 9.8 | 99% | 3 exploits | |
| CVE-2021-30180 | Code injection in Apache Dubbo apache · dubbo | Critical 9.8 | 60% | · | |
| CVE-2021-30181 | Code injection in Apache Dubbo apache · dubbo | Critical 9.8 | 61% | · | |
| CVE-2022-23943 | Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. apache · http server | Critical 9.8 | 50% | · | |
| CVE-2022-25487 | Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. thedigitalcraft · atomcms | Critical 9.8 | 54% | 2 exploits | |
| CVE-2021-45010 | A path traversal vulnerability in the file upload functionality in tinyfilemanager.php in Tiny File Manager before 2.4.7 allows remote attackers (with valid user accounts) to upload malicious PHP files to the webroot, leading to code execution. prasathmani · tiny file manager | High 8.8 | 70% | 3 exploits | |
| CVE-2021-40346 | An integer overflow exists in HAProxy 2.0 through 2.5 in htx_add_header that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs. haproxy · haproxy | High 7.5 | 59% | · | |
| CVE-2022-0169 | Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter 10web · photo gallery | Critical 9.8 | 75% | · | |
| CVE-2021-25003 | WPCargo <= 6.8.9 - Unauthenticated Remote Code Execution wptaskforce · wpcargo track \& trace | Critical 9.8 | 56% | · | |
| CVE-2021-3711 | SM2 Decryption Buffer Overflow openssl · openssl | Critical 9.8 | 88% | · | |
| CVE-2021-25216 | In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running… isc · bind | Critical 9.8 | 82% | · |
Showing 1,051–1,100 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.