Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2022-24223Critical 9.8AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php.thedigitalcraft · atomcmsEPSS62%3 exploitsPublished Feb 1, 2022
- CVE-2021-24762Critical 9.8The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection.getperfectsurvey · perfect surveyEPSS87%2 exploitsPublished Feb 1, 2022
- CVE-2021-23017High 7.7nginx - security updatef5 · nginxEPSS53%1 exploitPublished Feb 1, 2022
- CVE-2022-24124High 7.5SQL Injection in Casdoorcasbin · casdoorEPSS55%1 exploitPublished Feb 1, 2022
- CVE-2022-23944Critical 9.1Missing authentication in ShenYuapache · shenyuEPSS79%·Published Jan 28, 2022
- CVE-2021-23174Medium 4.8Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].wpchill · download monitorEPSS84%·Published Jan 28, 2022
- CVE-2021-46065Medium 4.8A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.zohocorp · manageengine servicedesk plusEPSS92%1 exploitPublished Jan 27, 2022
- CVE-2022-0306High 8.8Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.google · chromeEPSS85%·Published Jan 26, 2022
- CVE-2021-25080Medium 6.1Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scriptingcrmperks · contact form entriesEPSS84%·Published Jan 25, 2022
- CVE-2022-23302High 8.8Deserialization of Untrusted Data in Log4j 1.xapache · log4jEPSS64%·Published Jan 21, 2022
- CVE-2022-23221Critical 9.8Arbitrary code execution in H2 Consoledebian · debian linuxEPSS65%·Published Jan 21, 2022
- CVE-2022-21371High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS93%2 exploitsPublished Jan 19, 2022
- CVE-2022-21280Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysqlEPSS77%·Published Jan 19, 2022
- CVE-2022-21279Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysqlEPSS79%·Published Jan 19, 2022
- CVE-2020-10188Critical 9.8utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions.netkit telnet project · netkit telnetEPSS74%·Published Jan 19, 2022
- CVE-2021-26691Critical 9.8In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflowapache · http serverEPSS68%·Published Jan 19, 2022
- CVE-2021-44703High 7.8Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of…adobe · acrobatEPSS57%·Published Jan 17, 2022
- CVE-2022-23178Critical 9.8An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices.crestron · hd-md4x2-4k-e firmwareEPSS75%1 exploitPublished Jan 15, 2022
- CVE-2021-34996High 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.commvault · commcellEPSS82%·Published Jan 13, 2022
- CVE-2021-34995High 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22.commvault · commcellEPSS69%·Published Jan 13, 2022
- CVE-2022-20615Medium 5.4jenkins-2-plugins/matrix-project: does not escape HTML metacharacters which could result in XSSjenkins · matrix projectEPSS82%·Published Jan 13, 2022
- CVE-2021-24862High 7.2The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issuemetagauss · registrationmagicEPSS73%3 exploitsPublished Jan 10, 2022
- CVE-2021-42392Critical 9.8The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database.h2database · h2EPSS83%·Published Jan 10, 2022
- CVE-2021-45456Critical 9.8Command Injection in Apache Kylinapache · kylinEPSS89%·Published Jan 8, 2022
- CVE-2022-21662Medium 5.4Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users.wordpress · wordpressEPSS65%·Published Jan 6, 2022
- CVE-2021-21667Medium 5.4Stored XSS vulnerability in Jenkins Scriptler Pluginjenkins · scriptlerEPSS76%·Published Jan 6, 2022
- CVE-2021-21668Medium 5.4Stored XSS vulnerability in Jenkins Scriptler Pluginjenkins · scriptlerEPSS76%·Published Jan 6, 2022
- CVE-2021-43857Critical 9.3Gerapy may cause remote code executiongerapy · gerapyEPSS55%1 exploitPublished Jan 6, 2022
- CVE-2021-44832Medium 6.6Improper Input Validation and Injection in Apache Log4j2apache · log4jEPSS98%·Published Jan 4, 2022
- CVE-2021-20039High 8.8Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user.sonicwall · sma 200 firmwareEPSS79%2 exploitsPublished Jan 4, 2022
- CVE-2021-43942Medium 6.1Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint.atlassian · jira serverEPSS55%·Published Jan 4, 2022
- CVE-2021-45428Critical 9.8TLR-2005KSH is affected by an incorrect access control vulnerability.telesquare · tlr-2005ksh firmwareEPSS57%2 exploitsPublished Jan 3, 2022
- CVE-2021-45232Critical 9.8In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin…apache · apisix dashboardEPSS86%·Published Dec 28, 2021
- CVE-2021-45105Medium 5.9Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursionapache · log4jEPSS100%·Published Dec 18, 2021
- CVE-2021-36450Medium 6.1Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.verint · workforce optimizationEPSS64%·Published Dec 15, 2021
- CVE-2021-4044High 7.5Invalid handling of X509_verify_cert() internal errors in libsslopenssl · opensslEPSS50%·Published Dec 15, 2021
- CVE-2021-43829High 8.8In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature.patrowl · patrowlmanagerEPSS59%·Published Dec 14, 2021
- CVE-2021-39312High 7.5The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file.trueranker · true rankerEPSS78%2 exploitsPublished Dec 14, 2021
- CVE-2021-24946Critical 9.8The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issuewebnus · modern events calendar liteEPSS73%3 exploitsPublished Dec 13, 2021
- CVE-2020-26259Medium 6.8In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling.xstream · xstreamEPSS82%·Published Dec 13, 2021
- CVE-2021-21351Critical 9.1In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.xstream · xstreamEPSS82%·Published Dec 13, 2021
- CVE-2021-21344Critical 9.8In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream.xstream · xstreamEPSS76%·Published Dec 13, 2021
- CVE-2021-21345Critical 9.9In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream.xstream · xstreamEPSS72%·Published Dec 13, 2021
- CVE-2021-44152Critical 9.8Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user.reprisesoftware · reprise license managerEPSS59%1 exploitPublished Dec 13, 2021
- CVE-2021-40856High 7.5Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.auerswald · comfortel 1400 ip firmwareEPSS50%1 exploitPublished Dec 13, 2021
- CVE-2019-19609High 7.2Duplicate Advisory: OS Command Injection in Strapistrapi · strapiEPSS54%1 exploitPublished Dec 10, 2021
- CVE-2021-40859Critical 9.8Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device.auerswald · compact 5500r firmwareEPSS72%1 exploitPublished Dec 7, 2021
- CVE-2021-42132High 8.8A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.ivanti · avalancheEPSS70%·Published Dec 7, 2021
- CVE-2021-42131High 8.8A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation.ivanti · avalancheEPSS67%·Published Dec 7, 2021
- CVE-2021-42130High 8.8A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution.ivanti · avalancheEPSS62%·Published Dec 7, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-24223 | AtomCMS v2.0 was discovered to contain a SQL injection vulnerability via /admin/login.php. thedigitalcraft · atomcms | Critical 9.8 | 62% | 3 exploits | |
| CVE-2021-24762 | The Perfect Survey WordPress plugin before 1.5.2 does not validate and escape the question_id GET parameter before using it in a SQL statement in the get_question AJAX action, allowing unauthenticated users to perform SQL injection. getperfectsurvey · perfect survey | Critical 9.8 | 87% | 2 exploits | |
| CVE-2021-23017 | nginx - security update f5 · nginx | High 7.7 | 53% | 1 exploit | |
| CVE-2022-24124 | SQL Injection in Casdoor casbin · casdoor | High 7.5 | 55% | 1 exploit | |
| CVE-2022-23944 | Missing authentication in ShenYu apache · shenyu | Critical 9.1 | 79% | · | |
| CVE-2021-23174 | Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0]. wpchill · download monitor | Medium 4.8 | 84% | · | |
| CVE-2021-46065 | A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code. zohocorp · manageengine servicedesk plus | Medium 4.8 | 92% | 1 exploit | |
| CVE-2022-0306 | Heap buffer overflow in PDFium in Google Chrome prior to 97.0.4692.99 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. google · chrome | High 8.8 | 85% | · | |
| CVE-2021-25080 | Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting crmperks · contact form entries | Medium 6.1 | 84% | · | |
| CVE-2022-23302 | Deserialization of Untrusted Data in Log4j 1.x apache · log4j | High 8.8 | 64% | · | |
| CVE-2022-23221 | Arbitrary code execution in H2 Console debian · debian linux | Critical 9.8 | 65% | · | |
| CVE-2022-21371 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle WebLogic Server. oracle · weblogic server | High 7.5 | 93% | 2 exploits | |
| CVE-2022-21280 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql | Medium 6.3 | 77% | · | |
| CVE-2022-21279 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql | Medium 6.3 | 79% | · | |
| CVE-2020-10188 | utility.c in telnetd in netkit telnet through 0.17 allows remote attackers to execute arbitrary code via short writes or urgent data, because of a buffer overflow involving the netclear and nextitem functions. netkit telnet project · netkit telnet | Critical 9.8 | 74% | · | |
| CVE-2021-26691 | In Apache HTTP Server versions 2.4.0 to 2.4.46 a specially crafted SessionHeader sent by an origin server could cause a heap overflow apache · http server | Critical 9.8 | 68% | · | |
| CVE-2021-44703 | Acrobat Reader DC version 21.007.20099 (and earlier), 20.004.30017 (and earlier) and 17.011.30204 (and earlier) are affected by a stack buffer overflow vulnerability due to insecure handling of a crafted file, potentially resulting in arbitrary code execution in the context of… adobe · acrobat | High 7.8 | 57% | · | |
| CVE-2022-23178 | An issue was discovered on Crestron HD-MD4X2-4K-E 1.0.0.2159 devices. crestron · hd-md4x2-4k-e firmware | Critical 9.8 | 75% | 1 exploit | |
| CVE-2021-34996 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. commvault · commcell | High 8.8 | 82% | · | |
| CVE-2021-34995 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Commvault CommCell 11.22.22. commvault · commcell | High 8.8 | 69% | · | |
| CVE-2022-20615 | jenkins-2-plugins/matrix-project: does not escape HTML metacharacters which could result in XSS jenkins · matrix project | Medium 5.4 | 82% | · | |
| CVE-2021-24862 | The RegistrationMagic WordPress plugin before 5.0.1.6 does not escape user input in its rm_chronos_ajax AJAX action before using it in a SQL statement when duplicating tasks in batches, which could lead to a SQL injection issue metagauss · registrationmagic | High 7.2 | 73% | 3 exploits | |
| CVE-2021-42392 | The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. h2database · h2 | Critical 9.8 | 83% | · | |
| CVE-2021-45456 | Command Injection in Apache Kylin apache · kylin | Critical 9.8 | 89% | · | |
| CVE-2022-21662 | Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. wordpress · wordpress | Medium 5.4 | 65% | · | |
| CVE-2021-21667 | Stored XSS vulnerability in Jenkins Scriptler Plugin jenkins · scriptler | Medium 5.4 | 76% | · | |
| CVE-2021-21668 | Stored XSS vulnerability in Jenkins Scriptler Plugin jenkins · scriptler | Medium 5.4 | 76% | · | |
| CVE-2021-43857 | Gerapy may cause remote code execution gerapy · gerapy | Critical 9.3 | 55% | 1 exploit | |
| CVE-2021-44832 | Improper Input Validation and Injection in Apache Log4j2 apache · log4j | Medium 6.6 | 98% | · | |
| CVE-2021-20039 | Improper neutralization of special elements in the SMA100 management interface '/cgi-bin/viewcert' POST http method allows a remote authenticated attacker to inject arbitrary commands as a 'nobody' user. sonicwall · sma 200 firmware | High 8.8 | 79% | 2 exploits | |
| CVE-2021-43942 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. atlassian · jira server | Medium 6.1 | 55% | · | |
| CVE-2021-45428 | TLR-2005KSH is affected by an incorrect access control vulnerability. telesquare · tlr-2005ksh firmware | Critical 9.8 | 57% | 2 exploits | |
| CVE-2021-45232 | In Apache APISIX Dashboard before 2.10.1, the Manager API uses two frameworks and introduces framework droplet on the basis of framework gin, all APIs and authentication middleware are developed based on framework droplet, but some API directly use the interface of framework gin… apache · apisix dashboard | Critical 9.8 | 86% | · | |
| CVE-2021-45105 | Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion apache · log4j | Medium 5.9 | 100% | · | |
| CVE-2021-36450 | Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. verint · workforce optimization | Medium 6.1 | 64% | · | |
| CVE-2021-4044 | Invalid handling of X509_verify_cert() internal errors in libssl openssl · openssl | High 7.5 | 50% | · | |
| CVE-2021-43829 | In versions prior to 1.7.7 PatrowlManager unrestrictly handle upload files in the findings import feature. patrowl · patrowlmanager | High 8.8 | 59% | · | |
| CVE-2021-39312 | The True Ranker plugin <= 2.2.2 for WordPress allows arbitrary files, including sensitive configuration files such as wp-config.php, to be accessed via the src parameter found in the ~/admin/vendor/datatables/examples/resources/examples.php file. trueranker · true ranker | High 7.5 | 78% | 2 exploits | |
| CVE-2021-24946 | The Modern Events Calendar Lite WordPress plugin before 6.1.5 does not sanitise and escape the time parameter before using it in a SQL statement in the mec_load_single_page AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection issue webnus · modern events calendar lite | Critical 9.8 | 73% | 3 exploits | |
| CVE-2020-26259 | In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. xstream · xstream | Medium 6.8 | 82% | · | |
| CVE-2021-21351 | In XStream before version 1.4.16, there is a vulnerability may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. xstream · xstream | Critical 9.1 | 82% | · | |
| CVE-2021-21344 | In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker to load and execute arbitrary code from a remote host only by manipulating the processed input stream. xstream · xstream | Critical 9.8 | 76% | · | |
| CVE-2021-21345 | In XStream before version 1.4.16, there is a vulnerability which may allow a remote attacker who has sufficient rights to execute commands of the host only by manipulating the processed input stream. xstream · xstream | Critical 9.9 | 72% | · | |
| CVE-2021-44152 | Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. reprisesoftware · reprise license manager | Critical 9.8 | 59% | 1 exploit | |
| CVE-2021-40856 | Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring. auerswald · comfortel 1400 ip firmware | High 7.5 | 50% | 1 exploit | |
| CVE-2019-19609 | Duplicate Advisory: OS Command Injection in Strapi strapi · strapi | High 7.2 | 54% | 1 exploit | |
| CVE-2021-40859 | Backdoors were discovered in Auerswald COMpact 5500R 7.8A and 8.0B devices, that allow attackers with access to the web based management application full administrative access to the device. auerswald · compact 5500r firmware | Critical 9.8 | 72% | 1 exploit | |
| CVE-2021-42132 | A command Injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution. ivanti · avalanche | High 8.8 | 70% | · | |
| CVE-2021-42131 | A SQL Injection vulnerability exists in Ivanti Avalance before 6.3.3 allows an attacker with access to the Inforail Service to perform privilege escalation. ivanti · avalanche | High 8.8 | 67% | · | |
| CVE-2021-42130 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary code execution. ivanti · avalanche | High 8.8 | 62% | · |
Showing 1,151–1,200 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.