Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2021-42129High 8.8A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution.ivanti · avalancheEPSS77%·Published Dec 7, 2021
- CVE-2021-42127Critical 9.8A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service.ivanti · avalancheEPSS66%·Published Dec 7, 2021
- CVE-2021-42125High 8.8An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.ivanti · avalancheEPSS82%·Published Dec 7, 2021
- CVE-2021-24917High 7.5The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user.wpserveur · wps hide loginEPSS72%·Published Dec 6, 2021
- CVE-2021-39316High 7.5ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversaldigitalzoomstudio · zoomsoundsEPSS66%1 exploitPublished Dec 6, 2021
- CVE-2021-44427Critical 9.8SQL Injection in rosariosisrosariosis · rosariosisEPSS51%1 exploitPublished Dec 2, 2021
- CVE-2021-38147High 7.5Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel,…wipro · holmesEPSS53%1 exploitPublished Nov 29, 2021
- CVE-2021-36160High 7.5A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS).apache · http serverEPSS63%·Published Nov 25, 2021
- CVE-2021-43778High 7.5GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability.glpi-project · barcodeEPSS53%1 exploitPublished Nov 24, 2021
- CVE-2021-43267Critical 9.8The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type.linux · linux kernelEPSS58%·Published Nov 23, 2021
- CVE-2021-42362High 8.8WordPress Popular Posts <= 5.3.2 - Authenticated Arbitrary File Uploadwordpress popular posts project · wordpress popular postsEPSS80%3 exploitsPublished Nov 18, 2021
- CVE-2021-41951Medium 6.1ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter.montala · resourcespaceEPSS78%·Published Nov 15, 2021
- CVE-2021-41950Critical 9.1A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php.montala · resourcespaceEPSS75%·Published Nov 15, 2021
- CVE-2021-41765Critical 9.8A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter.montala · resourcespaceEPSS68%·Published Nov 15, 2021
- CVE-2021-21699Medium 5.4Stored XSS vulnerability in Jenkins Active Choices Pluginjenkins · active choicesEPSS88%·Published Nov 15, 2021
- CVE-2020-16152Critical 9.8The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file.extremenetworks · aerohive netconfigEPSS36%2 exploitsPublished Nov 14, 2021
- CVE-2021-41653Critical 9.8The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field.tp-link · tl-wr840n firmwareEPSS76%·Published Nov 13, 2021
- CVE-2021-3577High 8.8An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device.binatoneglobal · cn28 firmwareEPSS60%·Published Nov 12, 2021
- CVE-2021-42847Critical 9.8Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files.zohocorp · manageengine adaudit plusEPSS70%1 exploitPublished Nov 11, 2021
- CVE-2021-41081Critical 9.8Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search.zohocorp · manageengine network configuration managerEPSS64%·Published Nov 11, 2021
- CVE-2021-41349Medium 6.5Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange serverEPSS93%·Published Nov 9, 2021
- CVE-2021-31602High 7.5The Security Model has different layers of Access Control.hitachi · vantara pentahoEPSS52%1 exploitPublished Nov 9, 2021
- CVE-2021-41174Medium 6.1XSS vulnerability allowing arbitrary JavaScript executiongrafana · grafanaEPSS85%·Published Nov 8, 2021
- CVE-2021-39906Medium 6.1Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.gitlab · gitlabEPSS61%·Published Nov 4, 2021
- CVE-2021-35215High 8.8Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5.solarwinds · orion platformEPSS70%·Published Oct 27, 2021
- CVE-2021-40344High 7.2In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image.nagios · nagios xiEPSS65%·Published Oct 27, 2021
- CVE-2021-38294Critical 9.8Command injection leading to Remote Code Execution in Apache Stormapache · stormEPSS84%2 exploitsPublished Oct 26, 2021
- CVE-2021-40865Critical 9.8Deserialization of Untrusted Data leading to Remote Code Execution in Apache Stormapache · stormEPSS64%·Published Oct 26, 2021
- CVE-2021-20837Critical 9.8Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type…sixapart · movable typeEPSS88%2 exploitsPublished Oct 26, 2021
- CVE-2021-42840High 8.8SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting.salesagility · suitecrmEPSS59%3 exploitsPublished Oct 22, 2021
- CVE-2021-39352High 7.2The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation.catchplugins · catch themes demo importEPSS56%5 exploitsPublished Oct 21, 2021
- CVE-2021-28169Medium 5.3For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory.eclipse · jettyEPSS78%·Published Oct 21, 2021
- CVE-2021-35590Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS88%·Published Oct 21, 2021
- CVE-2021-35592Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS52%·Published Oct 21, 2021
- CVE-2021-35598Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS51%·Published Oct 21, 2021
- CVE-2021-35594Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS51%·Published Oct 21, 2021
- CVE-2021-35593Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS51%·Published Oct 21, 2021
- CVE-2021-35621Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS50%·Published Oct 21, 2021
- CVE-2021-21745Medium 4.3ZTE MF971R product has a Referer authentication bypass vulnerability.zte · mf971r firmwareEPSS56%·Published Oct 20, 2021
- CVE-2021-40728High 7.8Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result…adobe · acrobatEPSS55%·Published Oct 18, 2021
- CVE-2021-42342Critical 9.8In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix.embedthis · goaheadEPSS59%·Published Oct 14, 2021
- CVE-2021-40493Critical 9.8Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module.zohocorp · manageengine opmanagerEPSS50%·Published Oct 13, 2021
- CVE-2013-3630Medium 4.6Moodle Authenticated Spelling Binary Remote Code Executionmoodle · moodleEPSS42%3 exploitsPublished Oct 13, 2021
- CVE-2021-21809Critical 9.1Moodle command execution vulnerability exists in the default legacy spellchecker pluginmoodle · moodleEPSS24%3 exploitsPublished Oct 13, 2021
- CVE-2021-33035High 7.8Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets.apache · openofficeEPSS51%·Published Oct 12, 2021
- CVE-2021-42071Critical 9.8In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header.visual-tools · dvr vx16 firmwareEPSS70%1 exploitPublished Oct 7, 2021
- CVE-2021-37926Critical 9.8Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.zohocorp · manageengine admanager plusEPSS74%·Published Oct 7, 2021
- CVE-2021-37918Critical 9.8Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution.zohocorp · manageengine admanager plusEPSS74%·Published Oct 7, 2021
- CVE-2021-32172Critical 9.8Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin.maianscriptworld · maian cartEPSS66%3 exploitsPublished Oct 7, 2021
- CVE-2021-28125Medium 6.1Open Redirect in Apache Supersetapache · supersetEPSS64%·Published Oct 6, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-42129 | A command injection vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to perform arbitrary command execution. ivanti · avalanche | High 8.8 | 77% | · | |
| CVE-2021-42127 | A deserialization of untrusted data vulnerability exists in Ivanti Avalanche before 6.3.3 using Inforail Service allows arbitrary code execution via Data Repository Service. ivanti · avalanche | Critical 9.8 | 66% | · | |
| CVE-2021-42125 | An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files. ivanti · avalanche | High 8.8 | 82% | · | |
| CVE-2021-24917 | The WPS Hide Login WordPress plugin before 1.9.1 has a bug which allows to get the secret login page by setting a random referer string and making a request to /wp-admin/options.php as an unauthenticated user. wpserveur · wps hide login | High 7.5 | 72% | · | |
| CVE-2021-39316 | ZoomSounds - WordPress Wave Audio Player with Playlist <= 6.45 - Directory Traversal digitalzoomstudio · zoomsounds | High 7.5 | 66% | 1 exploit | |
| CVE-2021-44427 | SQL Injection in rosariosis rosariosis · rosariosis | Critical 9.8 | 51% | 1 exploit | |
| CVE-2021-38147 | Wipro Holmes Orchestrator 20.4.1 (20.4.1_02_11_2020) allows remote attackers to download arbitrary files, such as reports containing sensitive information, because authentication is not required for API access to processexecution/DownloadExcelFile/Domain_Credential_Report_Excel,… wipro · holmes | High 7.5 | 53% | 1 exploit | |
| CVE-2021-36160 | A carefully crafted request uri-path can cause mod_proxy_uwsgi to read above the allocated memory and crash (DoS). apache · http server | High 7.5 | 63% | · | |
| CVE-2021-43778 | GLPI instances version 2.x prior to version 2.6.1 with the barcode plugin installed are vulnerable to a path traversal vulnerability. glpi-project · barcode | High 7.5 | 53% | 1 exploit | |
| CVE-2021-43267 | The Transparent Inter-Process Communication (TIPC) functionality allows remote attackers to exploit insufficient validation of user-supplied sizes for the MSG_CRYPTO message type. linux · linux kernel | Critical 9.8 | 58% | · | |
| CVE-2021-42362 | WordPress Popular Posts <= 5.3.2 - Authenticated Arbitrary File Upload wordpress popular posts project · wordpress popular posts | High 8.8 | 80% | 3 exploits | |
| CVE-2021-41951 | ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. montala · resourcespace | Medium 6.1 | 78% | · | |
| CVE-2021-41950 | A directory traversal issue in ResourceSpace 9.6 before 9.6 rev 18277 allows remote unauthenticated attackers to delete arbitrary files on the ResourceSpace server via the provider and variant parameters in pages/ajax/tiles.php. montala · resourcespace | Critical 9.1 | 75% | · | |
| CVE-2021-41765 | A SQL injection issue in pages/edit_fields/9_ajax/add_keyword.php of ResourceSpace 9.5 and 9.6 < rev 18274 allows remote unauthenticated attackers to execute arbitrary SQL commands via the k parameter. montala · resourcespace | Critical 9.8 | 68% | · | |
| CVE-2021-21699 | Stored XSS vulnerability in Jenkins Active Choices Plugin jenkins · active choices | Medium 5.4 | 88% | · | |
| CVE-2020-16152 | The NetConfig UI administrative interface in Extreme Networks ExtremeWireless Aerohive HiveOS and IQ Engine through 10.0r8a allows attackers to execute PHP code as the root user via remote HTTP requests that insert this code into a log file and then traverse to that file. extremenetworks · aerohive netconfig | Critical 9.8 | 36% | 2 exploits | |
| CVE-2021-41653 | The PING function on the TP-Link TL-WR840N EU v5 router with firmware through TL-WR840N(EU)_V5_171211 is vulnerable to remote code execution via a crafted payload in an IP address input field. tp-link · tl-wr840n firmware | Critical 9.8 | 76% | · | |
| CVE-2021-3577 | An unauthenticated remote code execution vulnerability was reported in some Motorola-branded Binatone Hubble Cameras that could allow an attacker on the same network unauthorized access to the device. binatoneglobal · cn28 firmware | High 8.8 | 60% | · | |
| CVE-2021-42847 | Zoho ManageEngine ADAudit Plus before 7006 allows attackers to write to, and execute, arbitrary files. zohocorp · manageengine adaudit plus | Critical 9.8 | 70% | 1 exploit | |
| CVE-2021-41081 | Zoho ManageEngine Network Configuration Manager before 125465 is vulnerable to SQL Injection in a configuration search. zohocorp · manageengine network configuration manager | Critical 9.8 | 64% | · | |
| CVE-2021-41349 | Microsoft Exchange Server Spoofing Vulnerability microsoft · exchange server | Medium 6.5 | 93% | · | |
| CVE-2021-31602 | The Security Model has different layers of Access Control. hitachi · vantara pentaho | High 7.5 | 52% | 1 exploit | |
| CVE-2021-41174 | XSS vulnerability allowing arbitrary JavaScript execution grafana · grafana | Medium 6.1 | 85% | · | |
| CVE-2021-39906 | Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf. gitlab · gitlab | Medium 6.1 | 61% | · | |
| CVE-2021-35215 | Insecure deserialization leading to Remote Code Execution was detected in the Orion Platform version 2020.2.5. solarwinds · orion platform | High 8.8 | 70% | · | |
| CVE-2021-40344 | In the Custom Includes section of the Admin panel, an administrator can upload files with arbitrary extensions as long as the MIME type corresponds to an image. nagios · nagios xi | High 7.2 | 65% | · | |
| CVE-2021-38294 | Command injection leading to Remote Code Execution in Apache Storm apache · storm | Critical 9.8 | 84% | 2 exploits | |
| CVE-2021-40865 | Deserialization of Untrusted Data leading to Remote Code Execution in Apache Storm apache · storm | Critical 9.8 | 64% | · | |
| CVE-2021-20837 | Movable Type 7 r.5002 and earlier (Movable Type 7 Series), Movable Type 6.8.2 and earlier (Movable Type 6 Series), Movable Type Advanced 7 r.5002 and earlier (Movable Type Advanced 7 Series), Movable Type Advanced 6.8.2 and earlier (Movable Type Advanced 6 Series), Movable Type… sixapart · movable type | Critical 9.8 | 88% | 2 exploits | |
| CVE-2021-42840 | SuiteCRM before 7.11.19 allows remote code execution via the system settings Log File Name setting. salesagility · suitecrm | High 8.8 | 59% | 3 exploits | |
| CVE-2021-39352 | The Catch Themes Demo Import WordPress plugin is vulnerable to arbitrary file uploads via the import functionality found in the ~/inc/CatchThemesDemoImport.php file, in versions up to and including 1.7, due to insufficient file type validation. catchplugins · catch themes demo import | High 7.2 | 56% | 5 exploits | |
| CVE-2021-28169 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. eclipse · jetty | Medium 5.3 | 78% | · | |
| CVE-2021-35590 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 88% | · | |
| CVE-2021-35592 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 52% | · | |
| CVE-2021-35598 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 51% | · | |
| CVE-2021-35594 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 51% | · | |
| CVE-2021-35593 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 51% | · | |
| CVE-2021-35621 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 50% | · | |
| CVE-2021-21745 | ZTE MF971R product has a Referer authentication bypass vulnerability. zte · mf971r firmware | Medium 4.3 | 56% | · | |
| CVE-2021-40728 | Adobe Acrobat Reader DC version 21.007.20095 (and earlier), 21.007.20096 (and earlier), 20.004.30015 (and earlier), and 17.011.30202 (and earlier) is affected by a use-after-free vulnerability in the processing of the GetURL function on a global object window that could result… adobe · acrobat | High 7.8 | 55% | · | |
| CVE-2021-42342 | In the file upload filter, user form variables can be passed to CGI scripts without being prefixed with the CGI prefix. embedthis · goahead | Critical 9.8 | 59% | · | |
| CVE-2021-40493 | Zoho ManageEngine OpManager before 125437 is vulnerable to SQL Injection in the support diagnostics module. zohocorp · manageengine opmanager | Critical 9.8 | 50% | · | |
| CVE-2013-3630 | Moodle Authenticated Spelling Binary Remote Code Execution moodle · moodle | Medium 4.6 | 42% | 3 exploits | |
| CVE-2021-21809 | Moodle command execution vulnerability exists in the default legacy spellchecker plugin moodle · moodle | Critical 9.1 | 24% | 3 exploits | |
| CVE-2021-33035 | Apache OpenOffice opens dBase/DBF documents and shows the contents as spreadsheets. apache · openoffice | High 7.8 | 51% | · | |
| CVE-2021-42071 | In Visual Tools DVR VX16 4.2.28.0, an unauthenticated attacker can achieve remote command execution via shell metacharacters in the cgi-bin/slogin/login.py User-Agent HTTP header. visual-tools · dvr vx16 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2021-37926 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. zohocorp · manageengine admanager plus | Critical 9.8 | 74% | · | |
| CVE-2021-37918 | Zoho ManageEngine ADManager Plus version 7110 and prior allows unrestricted file upload which leads to remote code execution. zohocorp · manageengine admanager plus | Critical 9.8 | 74% | · | |
| CVE-2021-32172 | Maian Cart v3.8 contains a preauthorization remote code execution (RCE) exploit via a broken access control issue in the Elfinder plugin. maianscriptworld · maian cart | Critical 9.8 | 66% | 3 exploits | |
| CVE-2021-28125 | Open Redirect in Apache Superset apache · superset | Medium 6.1 | 64% | · |
Showing 1,201–1,250 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.