Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
1,474 vulnerabilities · highest exploit probability first
  • CVE-2007-4818High 7.5
    Multiple PHP remote file inclusion vulnerabilities in Txx CMS 0.2 allow remote attackers to execute arbitrary PHP code via a URL in the doc_root parameter to (1) addons/plugin.php, (2) addons/sidebar.php, (3) mail/index.php, or (4) mail/mailbox.php in modules/.
    txx cms · txx cms
    EPSS56%
    ·
    Published Sep 11, 2007
  • CVE-2007-4809High 7.5
    Multiple PHP remote file inclusion vulnerabilities in Online Fantasy Football League (OFFL) 0.2.6 allow remote attackers to execute arbitrary PHP code via a URL in the DOC_ROOT parameter to (1) lib/functions.php or (2) lib/header.php.
    online fantasy football league · offl
    EPSS56%
    ·
    Published Sep 11, 2007
  • CVE-2007-4790High 7.5
    Stack-based buffer overflow in certain ActiveX controls in (1) FPOLE.OCX 6.0.8450.0 and (2) Foxtlib.ocx, as used in the Microsoft Visual FoxPro 6.0 fpole 1.0 Type Library; and Internet Explorer 5.01, 6 SP1 and SP2, and 7; allows remote attackers to execute arbitrary code via a…
    microsoft · internet explorer
    EPSS55%
    ·
    Published Sep 10, 2007
  • CVE-2007-4757High 7.5
    PHP remote file inclusion vulnerability in menu.php in phpMytourney allows remote attackers to execute arbitrary PHP code via a URL in the functions_file parameter.
    phpmytourney · phpmytourney
    EPSS65%
    ·
    Published Sep 8, 2007
  • CVE-2007-4712High 7.5
    PHP remote file inclusion vulnerability in index.php in eNetman 1 allows remote attackers to execute arbitrary PHP code via a URL in the page parameter.
    enetman · enetman
    EPSS58%
    ·
    Published Sep 5, 2007
  • CVE-2007-4636High 7.5
    Multiple PHP remote file inclusion vulnerabilities in phpBG 0.9.1 allow remote attackers to execute arbitrary PHP code via a URL in the rootdir parameter to (1) intern/admin/other/backup.php, (2) intern/admin/, (3) intern/clan/member_add.php, (4) intern/config/key_2.php, or (5)…
    phpbg · phpbg
    EPSS71%
    ·
    Published Aug 31, 2007
  • CVE-2007-4560High 7.6
    clamav-milter in ClamAV before 0.91.2, when run in black hole mode, allows remote attackers to execute arbitrary commands via shell metacharacters that are used in a certain popen call, involving the "recipient field of sendmail."
    clam anti-virus · clamav
    EPSS84%
    4 exploits
    Published Aug 28, 2007
  • CVE-2007-4440High 7.5
    Stack-based buffer overflow in the MercuryS SMTP server in Mercury Mail Transport System, possibly 4.51 and earlier, allows remote attackers to execute arbitrary code via a long AUTH CRAM-MD5 string.
    pmail · mercury mail transport system
    EPSS65%
    3 exploits
    Published Aug 20, 2007
  • CVE-2007-4370High 7.5
    Multiple buffer overflows in the (1) client and (2) server in Racer 0.5.3 beta 5 allow remote attackers to execute arbitrary code via a long string to UDP port 26000.
    racer · racer
    EPSS59%
    3 exploits
    Published Aug 15, 2007
  • CVE-2007-4320High 7.5
    PHP remote file inclusion vulnerability in admin/addons/archive/archive.php in Ncaster 1.7.2 allows remote attackers to execute arbitrary PHP code via a URL in the adminfolder parameter.
    ncaster · ncaster
    EPSS72%
    ·
    Published Aug 13, 2007
  • CVE-2007-4279High 7.5
    PHP remote file inclusion vulnerability in config.php in FrontAccounting 1.12 Build 31 allows remote attackers to execute arbitrary PHP code via a URL in the path_to_root parameter.
    frontaccounting · frontaccounting
    EPSS75%
    ·
    Published Aug 9, 2007
  • CVE-2007-3566High 7.5
    Stack-based buffer overflow in the database service (ibserver.exe) in Borland InterBase 2007 before SP2 allows remote attackers to execute arbitrary code via a long size value in a create request to port 3050/tcp.
    borland software · interbase
    EPSS66%
    2 exploits
    Published Jul 26, 2007
  • CVE-2007-0042High 7.8
    Interpretation conflict in ASP.NET in Microsoft .NET Framework 1.0, 1.1, and 2.0 for Windows 2000, XP, Server 2003, and Vista allows remote attackers to access configuration files and obtain sensitive information, and possibly bypass security mechanisms that try to constrain the…
    microsoft · .net framework
    EPSS76%
    1 exploit
    Published Jul 10, 2007
  • CVE-2007-3614High 7.5
    Multiple stack-based buffer overflows in waHTTP.exe (aka the SAP DB Web Server) in SAP DB, possibly 7.3 through 7.5, allow remote attackers to execute arbitrary code via (1) a certain cookie value; (2) a certain additional parameter, related to sapdbwa_GetQueryString; and other…
    sap · sap db
    EPSS70%
    4 exploits
    Published Jul 6, 2007
  • CVE-2007-3605High 7.6
    Stack-based buffer overflow in the kweditcontrol.kwedit.1 ActiveX control in FrontEnd\SapGui\kwedit.dll in the EnjoySAP SAP GUI allows remote attackers to execute arbitrary code via a long argument to the PrepareToPostHTML function.
    sap · enjoysap
    EPSS70%
    2 exploits
    Published Jul 6, 2007
  • CVE-2007-3401High 7.5
    PHP remote file inclusion vulnerability in footer.inc.php in B1G b1gBB 2.24 allows remote attackers to execute arbitrary PHP code via a URL in the tfooter parameter.
    b1g · b1gbb
    EPSS74%
    ·
    Published Jun 26, 2007
  • CVE-2007-3370High 7.5
    Multiple PHP remote file inclusion vulnerabilities in Sun Board 1.00.00 Alpha allow remote attackers to execute arbitrary PHP code via a URL in (1) the sunPath parameter to include.php or (2) the dir parameter to skin/board/default/doctype.php.
    kim kyoung min · sun board
    EPSS75%
    ·
    Published Jun 22, 2007
  • CVE-2007-3371High 7.5
    PHP remote file inclusion vulnerability in plugins/widgets/htmledit/htmledit.php in Powl 0.94 allows remote attackers to execute arbitrary PHP code via a URL in the _POWL[installPath] parameter.
    powl · powl
    EPSS71%
    ·
    Published Jun 22, 2007
  • CVE-2007-3325High 7.5
    PHP remote file inclusion vulnerability in lib/language.php in LAN Management System (LMS) 1.9.6 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the _LIB_DIR parameter, a different vector than CVE-2007-1643 and CVE-2007-2205.
    lms · lan management system
    EPSS64%
    ·
    Published Jun 21, 2007
  • CVE-2007-3306High 7.5
    PHP remote file inclusion vulnerability in crontab/run_billing.php in MiniBill 1.2.5 allows remote attackers to execute arbitrary PHP code via a URL in the config[include_dir] parameter, a different vector than CVE-2006-4489.
    ultrize · minibill
    EPSS64%
    ·
    Published Jun 20, 2007
  • CVE-2007-3236High 7.5
    PHP remote file inclusion vulnerability in footer.php in the Horoscope 1.0 module for XOOPS allows remote attackers to execute arbitrary PHP code via a URL in the xoopsConfig[root_path] parameter.
    xoops · horoscope module
    EPSS77%
    ·
    Published Jun 14, 2007
  • CVE-2007-2986High 7.5
    PHP remote file inclusion vulnerability in lib/live_status.lib.php in AdminBot MX 9.0.5 allows remote attackers to execute arbitrary PHP code via a URL in the ROOT parameter.
    nexen · adminbot mx
    EPSS64%
    ·
    Published Jun 1, 2007
  • CVE-2007-2969High 7.5
    PHP remote file inclusion vulnerability in newsletter.php in WAnewsletter 2.1.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the waroot parameter.
    wanewsletter · wanewsletter
    EPSS62%
    ·
    Published May 31, 2007
  • CVE-2007-2937High 7.5
    PHP remote file inclusion vulnerability in admin/admin.php in TROforum 0.1 allows remote attackers to execute arbitrary PHP code via a URL in the site_url parameter.
    troforum · troforum
    EPSS64%
    ·
    Published May 30, 2007
  • CVE-2007-2897High 7.5
    Microsoft Internet Information Services (IIS) 6.0 allows remote attackers to cause a denial of service (server instability or device hang), and possibly obtain sensitive information (device communication traffic); and might allow attackers with physical access to execute…
    microsoft · internet information server
    EPSS74%
    ·
    Published May 30, 2007
  • CVE-2007-2888High 7.6
    Stack-based buffer overflow in UltraISO 8.6.2.2011 and earlier allows user-assisted remote attackers to execute arbitrary code via a long FILE string (filename) in a .cue file, a related issue to CVE-2007-2761.
    ezb systems · ultraiso
    EPSS55%
    4 exploits
    Published May 29, 2007
  • CVE-2007-2793High 7.5
    PHP remote file inclusion vulnerability in ImageImageMagick.php in Geeklog 2.x allows remote attackers to execute arbitrary PHP code via a URL in the glConf[path_system] parameter.
    geeklog · geeklog
    EPSS64%
    ·
    Published May 21, 2007
  • CVE-2007-2708High 7.5
    PHP remote file inclusion vulnerability in newsadmin.php in Feindt Computerservice News (News-Script) 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the action parameter.
    feindt computerservice · news-script
    EPSS63%
    ·
    Published May 16, 2007
  • CVE-2007-2676High 7.5
    PHP remote file inclusion vulnerability in skins/header.php in Open Translation Engine (OTE) 0.7.8 allows remote attackers to execute arbitrary PHP code via a URL in the ote_home parameter.
    open translation engine · open translation engine
    EPSS71%
    ·
    Published May 14, 2007
  • CVE-2007-2607High 7.5
    PHP remote file inclusion vulnerability in views/print/printbar.php in LaVague 0.3 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the views_path parameter.
    lavague · lavague
    EPSS71%
    ·
    Published May 11, 2007
  • CVE-2007-2545High 7.5
    Multiple PHP remote file inclusion vulnerabilities in Persism CMS 0.9.2 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the system[path] parameter to (1) blocks/headerfile.php, (2) files/blocks/latest_files.php, (3) filters/headerfile.php, (4)…
    persism cms · persism cms
    EPSS69%
    ·
    Published May 8, 2007
  • CVE-2007-2175High 7.6
    Apple QuickTime Java extensions (QTJava.dll), as used in Safari and other browsers, and when Java is enabled, allows remote attackers to execute arbitrary code via parameters to the toQTPointer method in quicktime.util.QTHandleRef, which can be used to modify arbitrary memory…
    apple · safari
    EPSS84%
    4 exploits
    Published Apr 24, 2007
  • CVE-2007-1404High 7.3
    tftpd.exe in ProSysInfo TFTP Server TFTPDWIN 0.4.2 allows remote attackers to cause a denial of service via a long UDP packet that is not properly handled in a recv_from call.
    prosysinfo · tftp server tftpdwin
    EPSS68%
    1 exploit
    Published Mar 10, 2007
  • CVE-2007-0774High 7.5
    Stack-based buffer overflow in the map_uri_to_worker function (native/common/jk_uri_worker_map.c) in mod_jk.so for Apache Tomcat JK Web Server Connector 1.2.19 and 1.2.20, as used in Tomcat 4.1.34 and 5.5.20, allows remote attackers to execute arbitrary code via a long URL that…
    apache · tomcat jk web server connector
    EPSS82%
    3 exploits
    Published Mar 4, 2007
  • CVE-2007-1036High 7.5
    The default configuration of JBoss does not restrict access to the (1) console and (2) web management interfaces, which allows remote attackers to bypass authentication and gain administrative access via direct requests.
    jboss · jboss application server
    EPSS82%
    4 exploits
    Published Feb 21, 2007
  • CVE-2007-0785High 7.5
    PHP remote file inclusion vulnerability in previewtheme.php in Flipsource Flip 2.01-final 1.0 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the inc_path parameter.
    flipsource · flip
    EPSS69%
    ·
    Published Feb 6, 2007
  • CVE-2007-0584High 7.5
    PHP remote file inclusion vulnerability in membres/membreManager.php in PhP Generic Library & Framework for comm (g-neric) allows remote attackers to execute arbitrary PHP code via a URL in the include_path parameter.
    g-neric · php generic library and framework
    EPSS70%
    ·
    Published Jan 30, 2007
  • CVE-2007-0169High 7.5
    Multiple buffer overflows in Computer Associates (CA) BrightStor ARCserve Backup 9.01 through 11.5, Enterprise Backup 10.5, and CA Server/Business Protection Suite r2 allow remote attackers to execute arbitrary code via RPC requests with crafted data for opnums (1) 0x2F and (2)…
    broadcom · brightstor arcserve backup
    EPSS71%
    2 exploits
    Published Jan 11, 2007
  • CVE-2007-0046High 7.5
    Double free vulnerability in the Adobe Acrobat Reader Plugin before 8.0.0, as used in Mozilla Firefox 1.5.0.7, allows remote attackers to execute arbitrary code by causing an error via a javascript: URI call to document.write in the (1) FDF, (2) XML, or (3) XFDF AJAX request…
    adobe · acrobat reader
    EPSS57%
    1 exploit
    Published Jan 3, 2007
  • CVE-2006-6707High 7.5
    Stack-based buffer overflow in the NeoTraceExplorer.NeoTraceLoader ActiveX control (NeoTraceExplorer.dll) in NeoTrace Express 3.25 and NeoTrace Pro (aka McAfee Visual Trace) 3.25 allows remote attackers to execute arbitrary code via a long argument string to the TraceTarget…
    mcafee · neotrace
    EPSS56%
    3 exploits
    Published Dec 22, 2006
  • CVE-2006-6576High 7.5
    Heap-based buffer overflow in Golden FTP Server (goldenftpd) 1.92 allows remote attackers to cause a denial of service (application crash) and possibly execute arbitrary code via a long PASS command.
    goldenftpserver · golden ftp server
    EPSS67%
    6 exploits
    Published Dec 15, 2006
  • CVE-2006-6251High 7.5
    Stack-based buffer overflow in VUPlayer 2.44 and earlier allows remote attackers to execute arbitrary code via a long string in an M3U file, aka an "M3U UNC Name" attack.
    vuplayer · vuplayer
    EPSS68%
    2 exploits
    Published Dec 4, 2006
  • CVE-2006-5854High 7.5
    Multiple buffer overflows in the Spooler service (nwspool.dll) in Novell Netware Client 4.91 through 4.91 SP2 allow remote attackers to execute arbitrary code via a long argument to the (1) EnumPrinters and (2) OpenPrinter functions.
    novell · netware client
    EPSS58%
    2 exploits
    Published Dec 3, 2006
  • CVE-2006-6199High 7.5
    Stack-based buffer overflow in BlazeVideo BlazeDVD Standard and Professional 5.0, and possibly earlier, allows remote attackers to execute arbitrary code via a long filename in a PLF playlist.
    blazevideo · blaze dvd
    EPSS65%
    9 exploits
    Published Nov 30, 2006
  • CVE-2006-6133High 7.6
    Stack-based buffer overflow in Visual Studio Crystal Reports for Microsoft Visual Studio .NET 2002 and 2002 SP1, .NET 2003 and 2003 SP1, and 2005 and 2005 SP1 (formerly Business Objects Crystal Reports XI Professional) allows user-assisted remote attackers to execute arbitrary…
    businessobjects · crystal reports xi
    EPSS52%
    1 exploit
    Published Nov 27, 2006
  • CVE-2006-6063High 7.5
    Stack-based buffer overflow in Un4seen XMPlay 3.3.0.5 and earlier allows remote attackers to execute arbitrary code via a M3U file containing a long (1) FileName, and cause a crash via a long (2) DisplayName.
    un4seen · xmplay
    EPSS59%
    3 exploits
    Published Nov 22, 2006
  • CVE-2006-4688High 7.5
    Buffer overflow in Client Service for NetWare (CSNW) in Microsoft Windows 2000 SP4, XP SP2, and Server 2003 up to SP1 allows remote attackers to execute arbitrary code via crafted messages, aka "Client Service for NetWare Memory Corruption Vulnerability."
    microsoft · windows 2000
    EPSS76%
    4 exploits
    Published Nov 14, 2006
  • CVE-2006-5792High 7.5
    Unspecified vulnerability in XLink Omni-NFS Enterprise allows remote attackers to execute arbitrary code via unspecified vectors, as demonstrated by vd_xlink2.pm, an "Omni-NFS Enterprise remote exploit." NOTE: this is probably a different vulnerability than CVE-2006-5780.
    xlink technology · omni-nfs x enterprise
    EPSS61%
    4 exploits
    Published Nov 7, 2006
  • CVE-2006-5779High 7.5
    OpenLDAP before 2.3.29 allows remote attackers to cause a denial of service (daemon crash) via LDAP BIND requests with long authcid names, which triggers an assertion failure.
    openldap · openldap
    EPSS77%
    ·
    Published Nov 7, 2006
  • CVE-2006-5650High 7.5
    The ICQPhone.SipxPhoneManager ActiveX control in America Online ICQ 5.1 allows remote attackers to download and execute arbitrary code via the DownloadAgent function, as demonstrated using an ICQ avatar.
    aol · icq
    EPSS67%
    3 exploits
    Published Nov 7, 2006
Showing 1,251–1,300 of 1,474

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.