Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2019-17567Medium 5.3Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP…apache · http serverEPSS60%·Published Jun 11, 2021
- CVE-2021-20081High 7.2Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges.zohocorp · manageengine servicedesk plusEPSS52%·Published Jun 10, 2021
- CVE-2021-33393High 8.8lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account.ipfire · ipfireEPSS59%4 exploitsPublished Jun 9, 2021
- CVE-2021-3007Critical 9.8Remote code execution in zendframework and laminas-httpgetlaminas · laminas-httpEPSS75%1 exploitPublished Jun 8, 2021
- CVE-2021-3277High 7.2Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files.nagios · nagios xiEPSS55%·Published Jun 7, 2021
- CVE-2020-8450High 7.3squid3 - security updatesquid-cache · squidEPSS72%·Published Jun 7, 2021
- CVE-2021-31250Medium 5.4Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi.chiyu-tech · bf-430 firmwareEPSS80%·Published Jun 4, 2021
- CVE-2021-3490High 7.8The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution.linux · linux kernelEPSS27%2 exploitsPublished Jun 4, 2021
- CVE-2021-31806Medium 6.5squid3 - security updatesquid-cache · squidEPSS95%·Published Jun 3, 2021
- CVE-2021-28662Medium 6.5squid: denial of service in HTTP response processingsquid-cache · squidEPSS72%·Published Jun 3, 2021
- CVE-2021-33564Critical 9.8Dragonfly contains remote code execution vulnerabilitydragonfly project · dragonflyEPSS72%·Published Jun 2, 2021
- CVE-2021-22160Critical 9.8Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlowapache · pulsarEPSS53%·Published Jun 1, 2021
- CVE-2021-22123High 8.8An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page.fortinet · fortiwebEPSS84%·Published Jun 1, 2021
- CVE-2021-31643Medium 5.4An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter.chiyu-tech · bf-630 firmwareEPSS88%1 exploitPublished Jun 1, 2021
- CVE-2021-24321Critical 9.8The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement,…bold-themes · belloEPSS67%·Published Jun 1, 2021
- CVE-2021-29492High 8.3Envoy does not decode escaped slash sequences %2F and %5C in HTTP URL paths in versions 1.18.2 and before.envoyproxy · envoyEPSS66%·Published May 28, 2021
- CVE-2021-33620Medium 6.5Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response.squid-cache · squidEPSS80%·Published May 28, 2021
- CVE-2021-22911Critical 9.8A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE.rocket.chat · rocket.chatEPSS95%4 exploitsPublished May 27, 2021
- CVE-2021-22908High 8.8A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user.ivanti · connect secureEPSS69%·Published May 27, 2021
- CVE-2021-31474Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1.solarwinds · network performance monitorEPSS94%·Published May 24, 2021
- CVE-2021-24307High 8.8The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host.aioseo · all in one seoEPSS53%·Published May 24, 2021
- CVE-2021-29505High 8.8XStream is vulnerable to a Remote Command Execution attackxstream · xstreamEPSS77%·Published May 18, 2021
- CVE-2021-32305Critical 9.8WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter.websvn · websvnEPSS87%2 exploitsPublished May 18, 2021
- CVE-2021-32819High 8.8Insecure template handling in Squirrellysquirrelly · squirrellyEPSS58%·Published May 17, 2021
- CVE-2020-36289Medium 5.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.atlassian · data centerEPSS99%·Published May 12, 2021
- CVE-2021-31213High 7.8Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerabilitymicrosoft · remoteEPSS53%·Published May 11, 2021
- CVE-2021-31195High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS74%·Published May 11, 2021
- CVE-2021-31181High 8.8Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint enterprise serverEPSS29%2 exploitsPublished May 11, 2021
- CVE-2021-28474High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS51%·Published May 11, 2021
- CVE-2021-27068High 8.8Visual Studio Remote Code Execution Vulnerabilitymicrosoft · visual studio 2019EPSS54%·Published May 11, 2021
- CVE-2020-28429Critical 9.8Command Injection in geojson2kmlgeojson2kml project · geojson2kmlEPSS63%·Published May 10, 2021
- CVE-2020-28018Critical 9.8Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL.exim · eximEPSS56%·Published May 7, 2021
- CVE-2021-29203Critical 9.8The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration.hp · edgeline infrastructure managerEPSS68%·Published May 6, 2021
- CVE-2021-28966High 7.5Tempfile on Windows path traversal vulnerabilityruby-lang · rubyEPSS58%·Published May 6, 2021
- CVE-2021-29490Medium 5.8Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter.jellyfin · jellyfinEPSS70%·Published May 6, 2021
- CVE-2020-13943Medium 4.3tomcat8 - security updateapache · tomcatEPSS55%·Published May 5, 2021
- CVE-2015-0235Critical 10.0Heap-based buffer overflow in the nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."gnu · glibcEPSS95%8 exploitsPublished May 5, 2021
- CVE-2017-16944High 7.5The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the…exim · eximEPSS63%1 exploitPublished May 5, 2021
- CVE-2020-28019High 7.5Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences.exim · eximEPSS62%·Published May 5, 2021
- CVE-2021-21983Medium 6.5Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating…vmware · vrealize operations managerEPSS69%2 exploitsPublished May 4, 2021
- CVE-2020-8277High 7.5A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses.nodejs · node.jsEPSS54%·Published May 3, 2021
- CVE-2021-27651Critical 9.8In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks.pega · infinityEPSS54%·Published Apr 29, 2021
- CVE-2021-31856Critical 9.8A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go).layer5 · mesheryEPSS75%·Published Apr 28, 2021
- CVE-2021-29442High 7.5Authentication bypass for specific endpointalibaba · nacosEPSS66%2 exploitsPublished Apr 27, 2021
- CVE-2021-29441Critical 9.8In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication.alibaba · nacosEPSS83%·Published Apr 27, 2021
- CVE-2021-30128Critical 9.8Apache OFBiz has unsafe deserialization prior to 17.12.07 versionapache · ofbizEPSS81%·Published Apr 27, 2021
- CVE-2021-29200Critical 9.8Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attackapache · ofbizEPSS55%·Published Apr 27, 2021
- CVE-2021-3287Critical 9.8Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class.zohocorp · manageengine opmanagerEPSS51%2 exploitsPublished Apr 26, 2021
- CVE-2020-5791High 7.2Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user.nagios · nagios xiEPSS79%4 exploitsPublished Apr 21, 2021
- CVE-2019-0232High 8.1tomcat: Remote Code Execution on Windowsapache · tomcatEPSS100%2 exploitsPublished Apr 21, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-17567 | Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP… apache · http server | Medium 5.3 | 60% | · | |
| CVE-2021-20081 | Incomplete List of Disallowed Inputs in ManageEngine ServiceDesk Plus before version 11205 allows a remote, authenticated attacker to execute arbitrary commands with SYSTEM privileges. zohocorp · manageengine servicedesk plus | High 7.2 | 52% | · | |
| CVE-2021-33393 | lfs/backup in IPFire 2.25-core155 does not ensure that /var/ipfire/backup/bin/backup.pl is owned by the root account. ipfire · ipfire | High 8.8 | 59% | 4 exploits | |
| CVE-2021-3007 | Remote code execution in zendframework and laminas-http getlaminas · laminas-http | Critical 9.8 | 75% | 1 exploit | |
| CVE-2021-3277 | Nagios XI 5.7.5 and earlier allows authenticated admins to upload arbitrary files due to improper validation of the rename functionality in custom-includes component, which leads to remote code execution by uploading php files. nagios · nagios xi | High 7.2 | 55% | · | |
| CVE-2020-8450 | squid3 - security update squid-cache · squid | High 7.3 | 72% | · | |
| CVE-2021-31250 | Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi. chiyu-tech · bf-430 firmware | Medium 5.4 | 80% | · | |
| CVE-2021-3490 | The eBPF ALU32 bounds tracking for bitwise ops (AND, OR and XOR) in the Linux kernel did not properly update 32-bit bounds, which could be turned into out of bounds reads and writes in the Linux kernel and therefore, arbitrary code execution. linux · linux kernel | High 7.8 | 27% | 2 exploits | |
| CVE-2021-31806 | squid3 - security update squid-cache · squid | Medium 6.5 | 95% | · | |
| CVE-2021-28662 | squid: denial of service in HTTP response processing squid-cache · squid | Medium 6.5 | 72% | · | |
| CVE-2021-33564 | Dragonfly contains remote code execution vulnerability dragonfly project · dragonfly | Critical 9.8 | 72% | · | |
| CVE-2021-22160 | Improper Verification of Cryptographic Signature in Apache Pulsar in TensorFlow apache · pulsar | Critical 9.8 | 53% | · | |
| CVE-2021-22123 | An OS command injection vulnerability in FortiWeb's management interface 6.3.7 and below, 6.2.3 and below, 6.1.x, 6.0.x, 5.9.x may allow a remote authenticated attacker to execute arbitrary commands on the system via the SAML server configuration page. fortinet · fortiweb | High 8.8 | 84% | · | |
| CVE-2021-31643 | An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter. chiyu-tech · bf-630 firmware | Medium 5.4 | 88% | 1 exploit | |
| CVE-2021-24321 | The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement,… bold-themes · bello | Critical 9.8 | 67% | · | |
| CVE-2021-29492 | Envoy does not decode escaped slash sequences %2F and %5C in HTTP URL paths in versions 1.18.2 and before. envoyproxy · envoy | High 8.3 | 66% | · | |
| CVE-2021-33620 | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. squid-cache · squid | Medium 6.5 | 80% | · | |
| CVE-2021-22911 | A improper input sanitization vulnerability exists in Rocket.Chat server 3.11, 3.12 & 3.13 that could lead to unauthenticated NoSQL injection, resulting potentially in RCE. rocket.chat · rocket.chat | Critical 9.8 | 95% | 4 exploits | |
| CVE-2021-22908 | A buffer overflow vulnerability exists in Windows File Resource Profiles in 9.X allows a remote authenticated user with privileges to browse SMB shares to execute arbitrary code as the root user. ivanti · connect secure | High 8.8 | 69% | · | |
| CVE-2021-31474 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Network Performance Monitor 2020.2.1. solarwinds · network performance monitor | Critical 9.8 | 94% | · | |
| CVE-2021-24307 | The All in One SEO – Best WordPress SEO Plugin – Easily Improve Your SEO Rankings before 4.1.0.2 enables authenticated users with "aioseo_tools_settings" privilege (most of the time admin) to execute arbitrary code on the underlying host. aioseo · all in one seo | High 8.8 | 53% | · | |
| CVE-2021-29505 | XStream is vulnerable to a Remote Command Execution attack xstream · xstream | High 8.8 | 77% | · | |
| CVE-2021-32305 | WebSVN before 2.6.1 allows remote attackers to execute arbitrary commands via shell metacharacters in the search parameter. websvn · websvn | Critical 9.8 | 87% | 2 exploits | |
| CVE-2021-32819 | Insecure template handling in Squirrelly squirrelly · squirrelly | High 8.8 | 58% | · | |
| CVE-2020-36289 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. atlassian · data center | Medium 5.3 | 99% | · | |
| CVE-2021-31213 | Visual Studio Code Remote Containers Extension Remote Code Execution Vulnerability microsoft · remote | High 7.8 | 53% | · | |
| CVE-2021-31195 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 74% | · | |
| CVE-2021-31181 | Microsoft SharePoint Remote Code Execution Vulnerability microsoft · sharepoint enterprise server | High 8.8 | 29% | 2 exploits | |
| CVE-2021-28474 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 51% | · | |
| CVE-2021-27068 | Visual Studio Remote Code Execution Vulnerability microsoft · visual studio 2019 | High 8.8 | 54% | · | |
| CVE-2020-28429 | Command Injection in geojson2kml geojson2kml project · geojson2kml | Critical 9.8 | 63% | · | |
| CVE-2020-28018 | Exim 4 before 4.94.2 allows Use After Free in smtp_reset in certain situations that may be common for builds with OpenSSL. exim · exim | Critical 9.8 | 56% | · | |
| CVE-2021-29203 | The vulnerability could be remotely exploited to bypass remote authentication leading to execution of arbitrary commands, gaining privileged access, causing denial of service, and changing the configuration. hp · edgeline infrastructure manager | Critical 9.8 | 68% | · | |
| CVE-2021-28966 | Tempfile on Windows path traversal vulnerability ruby-lang · ruby | High 7.5 | 58% | · | |
| CVE-2021-29490 | Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. jellyfin · jellyfin | Medium 5.8 | 70% | · | |
| CVE-2020-13943 | tomcat8 - security update apache · tomcat | Medium 4.3 | 55% | · | |
| CVE-2015-0235 | Heap-based buffer overflow in the nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST." gnu · glibc | Critical 10.0 | 95% | 8 exploits | |
| CVE-2017-16944 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service (infinite loop and stack exhaustion) via vectors involving BDAT commands and an improper check for a '.' character signifying the end of the… exim · exim | High 7.5 | 63% | 1 exploit | |
| CVE-2020-28019 | Exim 4 before 4.94.2 has Improper Initialization that can lead to recursion-based stack consumption or other consequences. exim · exim | High 7.5 | 62% | · | |
| CVE-2021-21983 | Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating… vmware · vrealize operations manager | Medium 6.5 | 69% | 2 exploits | |
| CVE-2020-8277 | A Node.js application that allows an attacker to trigger a DNS request for a host of their choice could trigger a Denial of Service in versions < 15.2.1, < 14.15.1, and < 12.19.1 by getting the application to resolve a DNS record with a larger number of responses. nodejs · node.js | High 7.5 | 54% | · | |
| CVE-2021-27651 | In versions 8.2.1 through 8.5.2 of Pega Infinity, the password reset functionality for local accounts can be used to bypass local authentication checks. pega · infinity | Critical 9.8 | 54% | · | |
| CVE-2021-31856 | A SQL Injection vulnerability in the REST API in Layer5 Meshery 0.5.2 allows an attacker to execute arbitrary SQL commands via the /experimental/patternfiles endpoint (order parameter in GetMesheryPatterns in models/meshery_pattern_persister.go). layer5 · meshery | Critical 9.8 | 75% | · | |
| CVE-2021-29442 | Authentication bypass for specific endpoint alibaba · nacos | High 7.5 | 66% | 2 exploits | |
| CVE-2021-29441 | In Nacos before version 1.4.1, when configured to use authentication (-Dnacos.core.auth.enabled=true) Nacos uses the AuthFilter servlet filter to enforce authentication. alibaba · nacos | Critical 9.8 | 83% | · | |
| CVE-2021-30128 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version apache · ofbiz | Critical 9.8 | 81% | · | |
| CVE-2021-29200 | Apache OFBiz has unsafe deserialization prior to 17.12.07 version An unauthenticated user can perform an RCE attack apache · ofbiz | Critical 9.8 | 55% | · | |
| CVE-2021-3287 | Zoho ManageEngine OpManager before 12.5.329 allows unauthenticated Remote Code Execution due to a general bypass in the deserialization class. zohocorp · manageengine opmanager | Critical 9.8 | 51% | 2 exploits | |
| CVE-2020-5791 | Improper neutralization of special elements used in an OS command in Nagios XI 5.7.3 allows a remote, authenticated admin user to execute operating system commands with the privileges of the apache user. nagios · nagios xi | High 7.2 | 79% | 4 exploits | |
| CVE-2019-0232 | tomcat: Remote Code Execution on Windows apache · tomcat | High 8.1 | 100% | 2 exploits |
Showing 1,351–1,400 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.