Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2021-40323High 9.3Cobbler before 3.3.0 allows log poisoningcobbler project · cobblerEPSS87%·Published Oct 5, 2021
- CVE-2021-40324High 8.7Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data.cobbler project · cobblerEPSS69%·Published Oct 5, 2021
- CVE-2021-41649Critical 9.8An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter.online-shopping-system-advanced project · online-shopping-system-advancedEPSS52%1 exploitPublished Oct 1, 2021
- CVE-2021-41288Critical 9.8Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API.zohocorp · manageengine opmanagerEPSS80%·Published Sep 30, 2021
- CVE-2021-41291High 7.5ECOA BAS controller suffers from a path traversal content disclosure vulnerability.ecoa · riskterminatorEPSS83%·Published Sep 30, 2021
- CVE-2021-39843High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user.adobe · acrobatEPSS77%·Published Sep 29, 2021
- CVE-2021-39840High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForms that could result in arbitrary code execution in the context of the current user.adobe · acrobatEPSS51%·Published Sep 29, 2021
- CVE-2021-39839High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm getItem action that could result in arbitrary code execution in the context of…adobe · acrobatEPSS65%·Published Sep 29, 2021
- CVE-2021-39838High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetCaption action that could result in arbitrary code execution in the…adobe · acrobatEPSS65%·Published Sep 29, 2021
- CVE-2021-39837High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm deleteItemAt action that could result in arbitrary code execution in the…adobe · acrobatEPSS65%·Published Sep 29, 2021
- CVE-2021-39836High 7.8Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the…adobe · acrobatEPSS70%·Published Sep 29, 2021
- CVE-2021-36749Medium 6.5Druid ingestion system Authenticated users can read data from other sources than intendedapache · druidEPSS81%·Published Sep 27, 2021
- CVE-2021-20034Critical 9.1An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings.sonicwall · sma 500vEPSS81%2 exploitsPublished Sep 27, 2021
- CVE-2021-37539Critical 9.8Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution.zohocorp · manageengine admanager plusEPSS93%·Published Sep 27, 2021
- CVE-2021-41381High 7.5Payara Micro Community 5.2021.6 and below allows Directory Traversal.payara · micro communityEPSS53%4 exploitsPublished Sep 23, 2021
- CVE-2021-41303Critical 9.8Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypassapache · shiroEPSS76%·Published Sep 20, 2021
- CVE-2021-39327Medium 5.3The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files.ait-pro · bulletproof securityEPSS72%3 exploitsPublished Sep 17, 2021
- CVE-2021-33690Critical 9.9Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who…sap · netweaver development infrastructureEPSS69%·Published Sep 15, 2021
- CVE-2021-38156Medium 5.4In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.nagios · nagios xiEPSS93%·Published Sep 15, 2021
- CVE-2021-36952High 7.8Visual Studio Remote Code Execution Vulnerabilitymicrosoft · visual studio 2017EPSS51%·Published Sep 15, 2021
- CVE-2021-33554High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS59%1 exploitPublished Sep 13, 2021
- CVE-2021-33553High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS51%1 exploitPublished Sep 13, 2021
- CVE-2021-33552High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS51%1 exploitPublished Sep 13, 2021
- CVE-2021-33551High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS51%1 exploitPublished Sep 13, 2021
- CVE-2021-33550High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS59%1 exploitPublished Sep 13, 2021
- CVE-2021-33549High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS69%2 exploitsPublished Sep 13, 2021
- CVE-2021-33548High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS59%1 exploitPublished Sep 13, 2021
- CVE-2021-33544High 7.2Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code.geutebrueck · g-cam ebc-2110 firmwareEPSS96%1 exploitPublished Sep 13, 2021
- CVE-2021-33543Critical 9.8Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings.geutebrueck · g-cam ebc-2110 firmwareEPSS81%1 exploitPublished Sep 13, 2021
- CVE-2019-14931Critical 9.8An issue was discovered on Mitsubishi Electric Europe B.V.inea · me-rtu firmwareEPSS57%1 exploitPublished Sep 10, 2021
- CVE-2021-28958Critical 9.8Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password.zohocorp · manageengine adselfservice plusEPSS73%·Published Sep 9, 2021
- CVE-2021-35217High 8.8Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI.solarwinds · patch managerEPSS73%·Published Sep 8, 2021
- CVE-2021-30641Medium 5.3Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'apache · http serverEPSS53%·Published Sep 3, 2021
- CVE-2021-28560High 8.8Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability.adobe · acrobatEPSS67%·Published Sep 2, 2021
- CVE-2021-35218High 8.8Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution.solarwinds · orion platformEPSS76%·Published Sep 1, 2021
- CVE-2021-35216High 8.8Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module.solarwinds · patch managerEPSS81%·Published Sep 1, 2021
- CVE-2021-34646Critical 9.8Booster for WooCommerce <= 5.4.3 - Authentication Bypassbooster · booster for woocommerceEPSS51%1 exploitPublished Aug 31, 2021
- CVE-2021-36356Critical 9.8KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI).kramerav · viawareEPSS54%2 exploitsPublished Aug 31, 2021
- CVE-2021-22242Medium 5.4Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdowngitlab · gitlabEPSS64%·Published Aug 25, 2021
- CVE-2021-37538Critical 9.8Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the…smartdatasoft · smartblogEPSS74%·Published Aug 24, 2021
- CVE-2021-22238Medium 5.4GitLab was vulnerable to a stored XSS by using the design feature in issues.gitlab · gitlabEPSS72%·Published Aug 20, 2021
- CVE-2020-27223Medium 5.3In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e.eclipse · jettyEPSS78%·Published Aug 19, 2021
- CVE-2021-35393Critical 9.8Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.realtek · rtl819x jungle software development kitEPSS68%·Published Aug 16, 2021
- CVE-2021-35392High 7.5Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols.realtek · rtl819x jungle software development kitEPSS83%·Published Aug 16, 2021
- CVE-2021-37350Critical 9.8Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation.nagios · nagios xiEPSS79%·Published Aug 16, 2021
- CVE-2021-33037Medium 5.3HTTP Request Smuggling in Apache Tomcatapache · tomcatEPSS75%·Published Aug 13, 2021
- CVE-2021-37346Critical 9.8Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection).nagios · nagios xi watchguard wizardEPSS74%·Published Aug 13, 2021
- CVE-2021-37344Critical 9.8Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection).nagios · nagios xi switch wizardEPSS97%·Published Aug 13, 2021
- CVE-2021-37343High 8.8A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios.nagios · nagios xiEPSS24%2 exploitsPublished Aug 13, 2021
- CVE-2021-34478High 7.8Microsoft Office Remote Code Execution Vulnerabilitymicrosoft · officeEPSS52%·Published Aug 12, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-40323 | Cobbler before 3.3.0 allows log poisoning cobbler project · cobbler | High 9.3 | 87% | · | |
| CVE-2021-40324 | Cobbler before 3.3.0 allows arbitrary file write operations via upload_log_data. cobbler project · cobbler | High 8.7 | 69% | · | |
| CVE-2021-41649 | An un-authenticated SQL Injection exists in PuneethReddyHC online-shopping-system-advanced through the /homeaction.php cat_id parameter. online-shopping-system-advanced project · online-shopping-system-advanced | Critical 9.8 | 52% | 1 exploit | |
| CVE-2021-41288 | Zoho ManageEngine OpManager version 125466 and below is vulnerable to SQL Injection in the getReportData API. zohocorp · manageengine opmanager | Critical 9.8 | 80% | · | |
| CVE-2021-41291 | ECOA BAS controller suffers from a path traversal content disclosure vulnerability. ecoa · riskterminator | High 7.5 | 83% | · | |
| CVE-2021-39843 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. adobe · acrobat | High 7.8 | 77% | · | |
| CVE-2021-39840 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability when processing AcroForms that could result in arbitrary code execution in the context of the current user. adobe · acrobat | High 7.8 | 51% | · | |
| CVE-2021-39839 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm getItem action that could result in arbitrary code execution in the context of… adobe · acrobat | High 7.8 | 65% | · | |
| CVE-2021-39838 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetCaption action that could result in arbitrary code execution in the… adobe · acrobat | High 7.8 | 65% | · | |
| CVE-2021-39837 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm deleteItemAt action that could result in arbitrary code execution in the… adobe · acrobat | High 7.8 | 65% | · | |
| CVE-2021-39836 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by a use-after-free vulnerability in the processing of the AcroForm buttonGetIcon action that could result in arbitrary code execution in the… adobe · acrobat | High 7.8 | 70% | · | |
| CVE-2021-36749 | Druid ingestion system Authenticated users can read data from other sources than intended apache · druid | Medium 6.5 | 81% | · | |
| CVE-2021-20034 | An improper access control vulnerability in SMA100 allows a remote unauthenticated attacker to bypass the path traversal checks and delete an arbitrary file potentially resulting in a reboot to factory default settings. sonicwall · sma 500v | Critical 9.1 | 81% | 2 exploits | |
| CVE-2021-37539 | Zoho ManageEngine ADManager Plus before 7111 is vulnerable to unrestricted file which leads to Remote code execution. zohocorp · manageengine admanager plus | Critical 9.8 | 93% | · | |
| CVE-2021-41381 | Payara Micro Community 5.2021.6 and below allows Directory Traversal. payara · micro community | High 7.5 | 53% | 4 exploits | |
| CVE-2021-41303 | Apache Shiro vulnerable to a specially crafted HTTP request causing an authentication bypass apache · shiro | Critical 9.8 | 76% | · | |
| CVE-2021-39327 | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. ait-pro · bulletproof security | Medium 5.3 | 72% | 3 exploits | |
| CVE-2021-33690 | Server-Side Request Forgery (SSRF) vulnerability has been detected in the SAP NetWeaver Development Infrastructure Component Build Service versions - 7.11, 7.20, 7.30, 7.31, 7.40, 7.50The SAP NetWeaver Development Infrastructure Component Build Service allows a threat actor who… sap · netweaver development infrastructure | Critical 9.9 | 69% | · | |
| CVE-2021-38156 | In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. nagios · nagios xi | Medium 5.4 | 93% | · | |
| CVE-2021-36952 | Visual Studio Remote Code Execution Vulnerability microsoft · visual studio 2017 | High 7.8 | 51% | · | |
| CVE-2021-33554 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 59% | 1 exploit | |
| CVE-2021-33553 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 51% | 1 exploit | |
| CVE-2021-33552 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 51% | 1 exploit | |
| CVE-2021-33551 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 51% | 1 exploit | |
| CVE-2021-33550 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 59% | 1 exploit | |
| CVE-2021-33549 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to a stack-based buffer overflow condition in the action parameter, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 69% | 2 exploits | |
| CVE-2021-33548 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 59% | 1 exploit | |
| CVE-2021-33544 | Multiple camera devices by UDP Technology, Geutebrück and other vendors are vulnerable to command injection, which may allow an attacker to remotely execute arbitrary code. geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 96% | 1 exploit | |
| CVE-2021-33543 | Multiple camera devices by UDP Technology, Geutebrück and other vendors allow unauthenticated remote access to sensitive files due to default user authentication settings. geutebrueck · g-cam ebc-2110 firmware | Critical 9.8 | 81% | 1 exploit | |
| CVE-2019-14931 | An issue was discovered on Mitsubishi Electric Europe B.V. inea · me-rtu firmware | Critical 9.8 | 57% | 1 exploit | |
| CVE-2021-28958 | Zoho ManageEngine ADSelfService Plus through 6101 is vulnerable to unauthenticated Remote Code Execution while changing the password. zohocorp · manageengine adselfservice plus | Critical 9.8 | 73% | · | |
| CVE-2021-35217 | Insecure Deseralization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module and reported to us by ZDI. solarwinds · patch manager | High 8.8 | 73% | · | |
| CVE-2021-30641 | Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' apache · http server | Medium 5.3 | 53% | · | |
| CVE-2021-28560 | Acrobat Reader DC versions versions 2021.001.20150 (and earlier), 2020.001.30020 (and earlier) and 2017.011.30194 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability. adobe · acrobat | High 8.8 | 67% | · | |
| CVE-2021-35218 | Deserialization of Untrusted Data in the Web Console Chart Endpoint can lead to remote code execution. solarwinds · orion platform | High 8.8 | 76% | · | |
| CVE-2021-35216 | Insecure Deserialization of untrusted data remote code execution vulnerability was discovered in Patch Manager Orion Platform Integration module. solarwinds · patch manager | High 8.8 | 81% | · | |
| CVE-2021-34646 | Booster for WooCommerce <= 5.4.3 - Authentication Bypass booster · booster for woocommerce | Critical 9.8 | 51% | 1 exploit | |
| CVE-2021-36356 | KRAMER VIAware through August 2021 allows remote attackers to execute arbitrary code because ajaxPages/writeBrowseFilePathAjax.php accepts arbitrary executable pathnames (even though browseSystemFiles.php is no longer reachable via the GUI). kramerav · viaware | Critical 9.8 | 54% | 2 exploits | |
| CVE-2021-22242 | Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown gitlab · gitlab | Medium 5.4 | 64% | · | |
| CVE-2021-37538 | Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote unauthenticated attacker to execute arbitrary SQL commands via the day, month, or year parameter to the controllers/front/archive.php archive controller, or the… smartdatasoft · smartblog | Critical 9.8 | 74% | · | |
| CVE-2021-22238 | GitLab was vulnerable to a stored XSS by using the design feature in issues. gitlab · gitlab | Medium 5.4 | 72% | · | |
| CVE-2020-27223 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. eclipse · jetty | Medium 5.3 | 78% | · | |
| CVE-2021-35393 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. realtek · rtl819x jungle software development kit | Critical 9.8 | 68% | · | |
| CVE-2021-35392 | Realtek Jungle SDK version v2.x up to v3.4.14B provides a 'WiFi Simple Config' server that implements both UPnP and SSDP protocols. realtek · rtl819x jungle software development kit | High 7.5 | 83% | · | |
| CVE-2021-37350 | Nagios XI before version 5.8.5 is vulnerable to SQL injection vulnerability in Bulk Modifications Tool due to improper input sanitisation. nagios · nagios xi | Critical 9.8 | 79% | · | |
| CVE-2021-33037 | HTTP Request Smuggling in Apache Tomcat apache · tomcat | Medium 5.3 | 75% | · | |
| CVE-2021-37346 | Nagios XI WatchGuard Wizard before version 1.4.8 is vulnerable to remote code execution through Improper neutralisation of special elements used in an OS Command (OS Command injection). nagios · nagios xi watchguard wizard | Critical 9.8 | 74% | · | |
| CVE-2021-37344 | Nagios XI Switch Wizard before version 2.5.7 is vulnerable to remote code execution through improper neutralisation of special elements used in an OS Command (OS Command injection). nagios · nagios xi switch wizard | Critical 9.8 | 97% | · | |
| CVE-2021-37343 | A path traversal vulnerability exists in Nagios XI below version 5.8.5 AutoDiscovery component and could lead to post authenticated RCE under security context of the user running Nagios. nagios · nagios xi | High 8.8 | 24% | 2 exploits | |
| CVE-2021-34478 | Microsoft Office Remote Code Execution Vulnerability microsoft · office | High 7.8 | 52% | · |
Showing 1,251–1,300 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.