Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
1,474 vulnerabilities · highest exploit probability first
  • CVE-2014-0782High 8.3
    Stack-based buffer overflow in BKESimmgr.exe in the Expanded Test Functions package in Yokogawa CENTUM CS 1000, CENTUM CS 3000 Entry Class R3.09.50 and earlier, CENTUM VP R5.03.00 and earlier, CENTUM VP Entry Class R5.03.00 and earlier, Exaopc R3.71.02 and earlier, B/M9000CS…
    yokogawa · exaopc
    EPSS57%
    2 exploits
    Published May 16, 2014
  • CVE-2013-4730High 10.0
    Buffer overflow in PCMan's FTP Server 2.0.7 allows remote attackers to execute arbitrary code via a long string in a USER command.
    pcman · ftp server
    EPSS67%
    13 exploits
    Published May 15, 2014
  • CVE-2014-2928High 7.1
    The iControl API in F5 BIG-IP LTM, APM, ASM, GTM, Link Controller, and PSM 10.0.0 through 10.2.4 and 11.0.0 through 11.5.1, BIG-IP AAM 11.4.0 through 11.5.1, BIG-IP AFM and PEM 11.3.0 through 11.5.1, BIG-IP Analytics 11.0.0 through 11.5.1, BIG-IP Edge Gateway, WebAccelerator,…
    f5 · big-ip edge gateway
    EPSS40%
    3 exploits
    Published May 12, 2014
  • CVE-2014-1762High 7.5
    Unspecified vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code with medium-integrity privileges and bypass a sandbox protection mechanism via unknown vectors, as demonstrated by ZDI during a Pwn4Fun competition at…
    microsoft · internet explorer
    EPSS71%
    1 exploit
    Published Apr 27, 2014
  • CVE-2014-0644High 7.8
    EMC Cloud Tiering Appliance (CTA) 10 through SP1 allows remote attackers to read arbitrary files via an api/login request containing an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, as demonstrated by…
    emc · cloud tiering appliance
    EPSS53%
    1 exploit
    Published Apr 16, 2014
  • CVE-2014-2850High 8.5
    The network interface configuration page (netinterface) in Sophos Web Appliance before 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.
    sophos · web appliance
    EPSS58%
    3 exploits
    Published Apr 11, 2014
  • CVE-2014-2849High 8.5
    The Change Password dialog box (change_password) in Sophos Web Appliance before 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.
    sophos · web appliance
    EPSS61%
    3 exploits
    Published Apr 11, 2014
  • CVE-2014-1691High 7.5
    The framework/Util/lib/Horde/Variables.php script in the Util library in Horde before 5.1.1 allows remote attackers to conduct object injection attacks and execute arbitrary PHP code via a crafted serialized object in the _formvars form.
    horde · horde application framework
    EPSS43%
    2 exploits
    Published Apr 1, 2014
  • CVE-2014-0784High 8.3
    Stack-based buffer overflow in BKBCopyD.exe in Yokogawa CENTUM CS 3000 R3.09.50 and earlier allows remote attackers to execute arbitrary code via a crafted TCP packet.
    yokogawa · centum cs 3000
    EPSS36%
    2 exploits
    Published Mar 14, 2014
  • CVE-2014-1903High 7.5
    admin/libraries/view.functions.php in FreePBX 2.9 before 2.9.0.14, 2.10 before 2.10.1.15, 2.11 before 2.11.0.23, and 12 before 12.0.1alpha22 does not restrict the set of functions accessible to the API handler, which allows remote attackers to execute arbitrary PHP code via the…
    freepbx · freepbx
    EPSS52%
    3 exploits
    Published Feb 18, 2014
  • CVE-2012-0270High 7.5
    Multiple stack-based buffer overflows in Csound before 5.16.6 allow remote attackers to execute arbitrary code via a crafted (1) hetro file to the getnum function in util/heti_main.c or (2) PVOC file to the getnum function in util/pv_import.c.
    csounds · csound
    EPSS55%
    2 exploits
    Published Feb 17, 2014
  • CVE-2013-5014High 7.5
    The management console in Symantec Endpoint Protection Manager (SEPM) 11.0 before 11.0.7405.1424 and 12.1 before 12.1.4023.4080, and Symantec Protection Center Small Business Edition 12.x before 12.1.4023.4080, allows remote attackers to read arbitrary files via XML data…
    symantec · endpoint protection manager
    EPSS68%
    3 exploits
    Published Feb 14, 2014
  • CVE-2014-0750High 7.5
    Directory traversal vulnerability in gefebt.exe in the WebView CimWeb components in GE Intelligent Platforms Proficy HMI/SCADA - CIMPLICITY through 8.2 SIM 24, and Proficy Process Systems with CIMPLICITY, allows remote attackers to execute arbitrary code via a crafted HTTP…
    ge · intelligent platforms proficy hmi\/scada cimplicity
    EPSS70%
    2 exploits
    Published Jan 25, 2014
  • CVE-2013-2827High 7.5
    An unspecified ActiveX control in WellinTech KingSCADA before 3.1.2, KingAlarm&Event before 3.1, and KingGraphic before 3.1.2 allows remote attackers to download arbitrary DLL code onto a client machine and execute this code via the ProjectURL property value.
    wellintech · kingalarm\&event
    EPSS48%
    2 exploits
    Published Jan 15, 2014
  • CVE-2014-8636High 7.5
    Mozilla: XrayWrapper bypass through DOM objects (MFSA 2015-09)
    mozilla · firefox
    EPSS65%
    2 exploits
    Published Jan 15, 2014
  • CVE-2013-7260High 7.5
    Multiple stack-based buffer overflows in RealNetworks RealPlayer before 17.0.4.61 on Windows, and Mac RealPlayer before 12.0.1.1738, allow remote attackers to execute arbitrary code via a long (1) version number or (2) encoding declaration in the XML declaration of an RMP file,…
    realnetworks · realplayer
    EPSS67%
    2 exploits
    Published Jan 3, 2014
  • CVE-2013-1349High 7.5
    Eval injection vulnerability in ajax.php in openSIS 4.5 through 5.2 allows remote attackers to execute arbitrary PHP code via the modname parameter.
    os4ed · opensis
    EPSS23%
    2 exploits
    Published Dec 9, 2013
  • CVE-2013-4547High 7.5
    nginx 0.8.41 through 1.4.3 and 1.5.x before 1.5.7 allows remote attackers to bypass intended restrictions via an unescaped space character in a URI.
    f5 · nginx
    EPSS68%
    1 exploit
    Published Nov 23, 2013
  • CVE-2013-6829High 7.5
    admin/confnetworking.html in PineApp Mail-SeCure allows remote attackers to execute arbitrary commands via shell metacharacters in the pinghost parameter during a ping operation.
    pineapp · mail-secure
    EPSS80%
    2 exploits
    Published Nov 20, 2013
  • CVE-2013-4557High 7.5
    The Security Screen (_core_/securite/ecran_securite.php) before 1.1.8 for SPIP, as used in SPIP 3.0.x before 3.0.12, allows remote attackers to execute arbitrary PHP via the connect parameter.
    spip · spip
    EPSS25%
    1 exploit
    Published Nov 18, 2013
  • CVE-2013-4835High 7.5
    The APISiteScopeImpl SOAP service in HP SiteScope 10.1x and 11.x before 11.22 allows remote attackers to bypass authentication and execute arbitrary code via a direct request to the issueSiebelCmd method, aka ZDI-CAN-1765.
    hp · sitescope
    EPSS71%
    2 exploits
    Published Nov 4, 2013
  • CVE-2013-6129High 7.5
    The install/upgrade.php scripts in vBulletin 4.1 and 5 allow remote attackers to create administrative accounts via the customerid, htmldata[password], htmldata[confirmpassword], and htmldata[email] parameters, as exploited in the wild in October 2013.
    vbulletin · vbulletin
    EPSS52%
    1 exploit
    Published Oct 19, 2013
  • CVE-2013-3861High 7.8
    Microsoft .NET Framework 2.0 SP2, 3.5, 3.5 SP1, 3.5.1, 4, and 4.5 allows remote attackers to cause a denial of service (application crash or hang) via crafted character sequences in JSON data, aka "JSON Parsing Vulnerability."
    microsoft · .net framework
    EPSS82%
    ·
    Published Oct 9, 2013
  • CVE-2013-0810High 8.1
    Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, and Windows Server 2008 SP2 allow remote attackers to execute arbitrary code via a crafted screensaver in a theme file, aka "Windows Theme File Remote Code Execution Vulnerability."
    microsoft · windows server 2003
    EPSS60%
    2 exploits
    Published Sep 11, 2013
  • CVE-2013-3183High 7.8
    The TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not properly perform memory allocation for inbound ICMPv6 packets, which allows remote attackers to cause a denial of…
    microsoft · windows 7
    EPSS78%
    ·
    Published Aug 14, 2013
  • CVE-2013-3182High 7.8
    The Windows NAT Driver (aka winnat) service in Microsoft Windows Server 2012 does not properly validate memory addresses during the processing of ICMP packets, which allows remote attackers to cause a denial of service (memory corruption and system hang) via crafted packets, aka…
    microsoft · windows server 2012
    EPSS95%
    ·
    Published Aug 14, 2013
  • CVE-2013-2370High 7.5
    Unspecified vulnerability in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1671.
    hp · loadrunner
    EPSS62%
    2 exploits
    Published Jul 29, 2013
  • CVE-2013-2028High 7.5
    The ngx_http_parse_chunked function in http/ngx_http_parse.c in nginx 1.3.9 through 1.4.0 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a chunked Transfer-Encoding request with a large chunk size, which triggers an integer signedness…
    f5 · nginx
    EPSS87%
    6 exploits
    Published Jul 18, 2013
  • CVE-2013-1362High 7.5
    Incomplete blacklist vulnerability in nrpc.c in Nagios Remote Plug-In Executor (NRPE) before 2.14 might allow remote attackers to execute arbitrary shell commands via "$()" shell metacharacters, which are processed by bash.
    nagios · remote plug in executor
    EPSS66%
    2 exploits
    Published Jul 9, 2013
  • CVE-2013-4786High 7.5
    freeipmi: Leakage of password hashes via RAKP authentication
    intel · intelligent platform management interface
    EPSS79%
    1 exploit
    Published Jul 8, 2013
  • CVE-2013-3563High 7.5
    Stack-based buffer overflow in db_netserver in Lianja SQL Server before 1.0.0RC5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted string to TCP port 8001.
    lianja · lianja sql server
    EPSS49%
    3 exploits
    Published Jul 4, 2013
  • CVE-2013-3520High 7.5
    VMware vCenter Chargeback Manager (aka CBM) before 2.5.1 does not proper handle uploads, which allows remote attackers to execute arbitrary code via unspecified vectors.
    vmware · vcenter chargeback manager
    EPSS56%
    2 exploits
    Published Jun 17, 2013
  • CVE-2013-3138High 7.1
    Integer overflow in the TCP/IP kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (system hang) via crafted TCP packets, aka…
    microsoft · windows 7
    EPSS59%
    ·
    Published Jun 12, 2013
  • CVE-2013-0136High 8.5
    Multiple directory traversal vulnerabilities in the EditDocument servlet in the Frontend in Mutiny before 5.0-1.11 allow remote authenticated users to upload and execute arbitrary programs, read arbitrary files, or cause a denial of service (file deletion or renaming) via (1)…
    mutiny · mutiny
    EPSS40%
    2 exploits
    Published Jun 1, 2013
  • CVE-2013-1305High 7.8
    HTTP.sys in Microsoft Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (infinite loop) via a crafted HTTP header, aka "HTTP.sys Denial of Service Vulnerability."
    microsoft · windows 8
    EPSS55%
    ·
    Published May 15, 2013
  • CVE-2013-0232High 7.5
    includes/functions.php in ZoneMinder Video Server 1.24.0, 1.25.0, and earlier allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) runState parameter in the packageControl function; or (2) key or (3) command parameter in the…
    zoneminder · zoneminder
    EPSS48%
    2 exploits
    Published Mar 20, 2013
  • CVE-2013-1081High 7.5
    Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter.
    novell · zenworks mobile management
    EPSS68%
    2 exploits
    Published Mar 11, 2013
  • CVE-2013-0075High 7.8
    The TCP/IP implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, Windows 7 Gold and SP1, Windows 8, Windows Server 2012, and Windows RT allows remote attackers to cause a denial of service (reboot) via a crafted packet that terminates a TCP…
    microsoft · windows 7
    EPSS70%
    ·
    Published Feb 13, 2013
  • CVE-2013-0229High 7.8
    The ProcessSSDPRequest function in minissdp.c in the SSDP handler in MiniUPnP MiniUPnPd before 1.4 allows remote attackers to cause a denial of service (service crash) via a crafted request that triggers a buffer over-read.
    miniupnp project · miniupnpd
    EPSS76%
    2 exploits
    Published Jan 31, 2013
  • CVE-2012-6530High 7.1
    Stack-based buffer overflow in Sysax Multi Server before 5.52, when HTTP is enabled, allows remote authenticated users with the create folder permission to execute arbitrary code via a crafted request.
    sysax · multi server
    EPSS46%
    5 exploits
    Published Jan 31, 2013
  • CVE-2013-0209High 7.5
    lib/MT/Upgrade.pm in mt-upgrade.cgi in Movable Type 4.2x and 4.3x through 4.38 does not require authentication for requests to database-migration functions, which allows remote attackers to conduct eval injection and SQL injection attacks via crafted parameters, as demonstrated…
    sixapart · movable type
    EPSS45%
    2 exploits
    Published Jan 22, 2013
  • CVE-2012-6096High 7.5
    Multiple stack-based buffer overflows in the get_history function in history.cgi in Nagios Core before 3.4.4, and Icinga 1.6.x before 1.6.2, 1.7.x before 1.7.4, and 1.8.x before 1.8.4, might allow remote attackers to execute arbitrary code via a long (1) host_name variable (host…
    icinga · icinga
    EPSS66%
    5 exploits
    Published Jan 22, 2013
  • CVE-2012-4915High 7.5
    Google Doc Embedder < 2.5.4 - Directory Traversal
    davistribe · google doc embedder
    EPSS50%
    2 exploits
    Published Jan 7, 2013
  • CVE-2012-6329High 7.5
    The _compile function in Maketext.pm in the Locale::Maketext implementation in Perl before 5.17.7 does not properly handle backslashes and fully qualified method names during compilation of bracket notation, which allows context-dependent attackers to execute arbitrary commands…
    perl · perl
    EPSS64%
    4 exploits
    Published Jan 4, 2013
  • CVE-2012-4958High 7.8
    Directory traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a 126 /FSF/CMD request with a ..
    novell · file reporter
    EPSS74%
    1 exploit
    Published Nov 18, 2012
  • CVE-2012-4957High 7.8
    Absolute path traversal vulnerability in NFRAgent.exe in Novell File Reporter 1.0.2 allows remote attackers to read arbitrary files via a /FSF/CMD request with a full pathname in a PATH element of an SRS record.
    novell · file reporter
    EPSS68%
    1 exploit
    Published Nov 18, 2012
  • CVE-2012-5687High 7.8
    Directory traversal vulnerability in the web-based management feature on the TP-LINK TL-WR841N router with firmware 3.13.9 build 120201 Rel.54965n and earlier allows remote attackers to read arbitrary files via a ..
    tp-link · tl-wr841n
    EPSS69%
    1 exploit
    Published Nov 1, 2012
  • CVE-2012-3001High 8.5
    Mutiny Standard before 4.5-1.12 allows remote attackers to execute arbitrary commands via the network-interface menu, related to a "command injection vulnerability."
    mutiny · standard
    EPSS27%
    2 exploits
    Published Oct 22, 2012
  • CVE-2011-4929High 7.5
    Unspecified vulnerability in the bazaar repository adapter in Redmine 0.9.x and 1.0.x before 1.0.5 allows remote attackers to execute arbitrary commands via unknown vectors.
    redmine · redmine
    EPSS46%
    2 exploits
    Published Oct 8, 2012
  • CVE-2012-5223High 7.5
    The proc_deutf function in includes/functions_vbseocp_abstract.php in vBSEO 3.5.0, 3.5.1, 3.5.2, 3.6.0, and earlier allows remote attackers to insert and execute arbitrary PHP code via "complex curly syntax" in the char_repl parameter, which is inserted into a regular expression…
    crawlability · vbseo
    EPSS41%
    3 exploits
    Published Oct 1, 2012
Showing 1,101–1,150 of 1,474

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.