Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2019-0230Critical 9.8struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributesapache · strutsEPSS97%4 exploitsPublished Apr 21, 2021
- CVE-2021-2190High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline.oracle · sales offlineEPSS93%·Published Apr 21, 2021
- CVE-2017-5645Critical 9.8In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.apache · log4jEPSS90%·Published Apr 21, 2021
- CVE-2021-2198High 8.2Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management.oracle · knowledge managementEPSS80%·Published Apr 21, 2021
- CVE-2019-10098Medium 6.1In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.apache · http serverEPSS74%1 exploitPublished Apr 21, 2021
- CVE-2019-0233High 7.5struts2: access permission override when performing a file upload leads to DoSapache · strutsEPSS66%·Published Apr 21, 2021
- CVE-2020-1927Medium 6.1In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.apache · http serverEPSS57%·Published Apr 21, 2021
- CVE-2020-1967High 7.5Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension.openssl · opensslEPSS53%·Published Apr 21, 2021
- CVE-2021-27030High 7.8A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system.autodesk · fbx reviewEPSS60%·Published Apr 19, 2021
- CVE-2021-29447Medium 6.5A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks.wordpress · wordpressEPSS86%2 exploitsPublished Apr 15, 2021
- CVE-2021-3017High 7.5The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.intelbras · win 300 firmwareEPSS63%·Published Apr 14, 2021
- CVE-2021-26030Medium 6.13.0.0 through 3.9.25.joomla · joomla\!EPSS82%·Published Apr 14, 2021
- CVE-2021-27250Medium 6.5This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points.dlink · dap-2020 firmwareEPSS67%·Published Apr 14, 2021
- CVE-2021-28482High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS83%Ransomware1 actorPublished Apr 14, 2021
- CVE-2021-28480Critical 9.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS71%·Published Apr 14, 2021
- CVE-2021-26812Medium 6.1Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module.jitsi · meetEPSS97%1 exploitPublished Apr 14, 2021
- CVE-2021-28472High 7.8Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerabilitymicrosoft · vscode-mavenEPSS62%·Published Apr 13, 2021
- CVE-2021-28325Medium 6.5Windows SMB Information Disclosure Vulnerabilitymicrosoft · windows 10EPSS62%·Published Apr 13, 2021
- CVE-2020-24391Critical 9.8Remote code execution in mongo-expressmongo-express project · mongo-expressEPSS75%·Published Apr 13, 2021
- CVE-2011-2523Critical 9.8vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp.vsftpd project · vsftpdEPSS96%3 exploitsPublished Apr 13, 2021
- CVE-2021-20080Medium 6.1Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.zohocorp · manageengine servicedesk plusEPSS93%·Published Apr 9, 2021
- CVE-2020-8264Medium 6.1Cross-site scripting in actionpackrubyonrails · railsEPSS67%·Published Apr 7, 2021
- CVE-2021-21425Critical 9.8In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials.getgrav · grav-plugin-adminEPSS81%2 exploitsPublished Apr 7, 2021
- CVE-2021-28165High 7.5Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resourceseclipse · jettyEPSS54%·Published Apr 6, 2021
- CVE-2021-24155High 7.2The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE.backup-guard · backup guardEPSS84%4 exploitsPublished Apr 5, 2021
- CVE-2020-9490High 7.5Apache HTTP Server versions 2.4.20 to 2.4.43.apache · http serverEPSS89%·Published Apr 5, 2021
- CVE-2021-20078Critical 9.1Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component.zohocorp · manageengine opmanagerEPSS60%·Published Apr 1, 2021
- CVE-2021-22992Critical 9.8On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy…f5 · big-ip access policy managerEPSS73%·Published Mar 31, 2021
- CVE-2021-27273High 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26.netgear · prosafe network management systemEPSS66%·Published Mar 30, 2021
- CVE-2021-27276High 7.1This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26.netgear · prosafe network management systemEPSS73%·Published Mar 29, 2021
- CVE-2021-27275High 8.3This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26.netgear · prosafe network management systemEPSS74%·Published Mar 29, 2021
- CVE-2021-27272High 7.1This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26.netgear · prosafe network management systemEPSS75%·Published Mar 29, 2021
- CVE-2020-7774Critical 9.8Prototype Pollution in y18ny18n project · y18nEPSS69%·Published Mar 29, 2021
- CVE-2021-29156High 7.5ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol.forgerock · openamEPSS77%1 exploitPublished Mar 25, 2021
- CVE-2021-21402Medium 6.5In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system.jellyfin · jellyfinEPSS79%·Published Mar 23, 2021
- CVE-2021-21346Critical 9.8XStream is vulnerable to an Arbitrary Code Execution attackxstream · xstreamEPSS76%·Published Mar 22, 2021
- CVE-2021-21341High 7.5XStream can cause a Denial of Service.xstream · xstreamEPSS78%·Published Mar 22, 2021
- CVE-2021-25921Medium 5.4In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the Allergies section.open-emr · openemrEPSS91%·Published Mar 22, 2021
- CVE-2021-25919Medium 4.8In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly.open-emr · openemrEPSS70%·Published Mar 22, 2021
- CVE-2021-26295Critical 9.8Apache OFBiz has unsafe deserialization prior to 17.12.06.apache · ofbizEPSS98%2 exploitsPublished Mar 22, 2021
- CVE-2021-27084High 7.8Visual Studio Code Java Extension Pack Remote Code Execution Vulnerabilitymicrosoft · visual studio codeEPSS62%·Published Mar 11, 2021
- CVE-2021-27083High 7.8Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerabilitymicrosoft · remote developmentEPSS62%·Published Mar 11, 2021
- CVE-2021-21300High 7.5In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS…git-scm · gitEPSS89%2 exploitsPublished Mar 9, 2021
- CVE-2021-21480High 8.8SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment).sap · manufacturing integration and intelligenceEPSS52%·Published Mar 9, 2021
- CVE-2021-21978Critical 9.8VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability.vmware · view plannerEPSS99%2 exploitsPublished Mar 5, 2021
- CVE-2021-22881Medium 6.1Actionpack Open Redirect Vulnerabilityrubyonrails · railsEPSS87%·Published Mar 2, 2021
- CVE-2021-26120Critical 9.8PHP Code Injection by malicious function name in smartysmarty · smartyEPSS82%·Published Feb 26, 2021
- CVE-2021-24086High 7.5Windows TCP/IP Denial of Service Vulnerabilitymicrosoft · windows 10EPSS59%·Published Feb 25, 2021
- CVE-2021-27670Critical 9.8Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter.appspace · appspaceEPSS61%1 exploitPublished Feb 24, 2021
- CVE-2016-6304High 7.5Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.openssl · opensslEPSS63%·Published Feb 24, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-0230 | struts2: possible RCE due to forced double OGNL evaluation when evaluated on raw user input in tag attributes apache · struts | Critical 9.8 | 97% | 4 exploits | |
| CVE-2021-2190 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Sales Offline. oracle · sales offline | High 7.5 | 93% | · | |
| CVE-2017-5645 | In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code. apache · log4j | Critical 9.8 | 90% | · | |
| CVE-2021-2198 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Knowledge Management. oracle · knowledge management | High 8.2 | 80% | · | |
| CVE-2019-10098 | In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. apache · http server | Medium 6.1 | 74% | 1 exploit | |
| CVE-2019-0233 | struts2: access permission override when performing a file upload leads to DoS apache · struts | High 7.5 | 66% | · | |
| CVE-2020-1927 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. apache · http server | Medium 6.1 | 57% | · | |
| CVE-2020-1967 | Server or client applications that call the SSL_check_chain() function during or after a TLS 1.3 handshake may crash due to a NULL pointer dereference as a result of incorrect handling of the "signature_algorithms_cert" TLS extension. openssl · openssl | High 7.5 | 53% | · | |
| CVE-2021-27030 | A user may be tricked into opening a malicious FBX file which may exploit a Directory Traversal Remote Code Execution vulnerability in FBX’s Review causing it to run arbitrary code on the system. autodesk · fbx review | High 7.8 | 60% | · | |
| CVE-2021-29447 | A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. wordpress · wordpress | Medium 6.5 | 86% | 2 exploits | |
| CVE-2021-3017 | The web interface on Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code. intelbras · win 300 firmware | High 7.5 | 63% | · | |
| CVE-2021-26030 | 3.0.0 through 3.9.25. joomla · joomla\! | Medium 6.1 | 82% | · | |
| CVE-2021-27250 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. dlink · dap-2020 firmware | Medium 6.5 | 67% | · | |
| CVE-2021-28482 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 83% | Ransomware1 actor | |
| CVE-2021-28480 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | Critical 9.8 | 71% | · | |
| CVE-2021-26812 | Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. jitsi · meet | Medium 6.1 | 97% | 1 exploit | |
| CVE-2021-28472 | Visual Studio Code Maven for Java Extension Remote Code Execution Vulnerability microsoft · vscode-maven | High 7.8 | 62% | · | |
| CVE-2021-28325 | Windows SMB Information Disclosure Vulnerability microsoft · windows 10 | Medium 6.5 | 62% | · | |
| CVE-2020-24391 | Remote code execution in mongo-express mongo-express project · mongo-express | Critical 9.8 | 75% | · | |
| CVE-2011-2523 | vsftpd 2.3.4 downloaded between 20110630 and 20110703 contains a backdoor which opens a shell on port 6200/tcp. vsftpd project · vsftpd | Critical 9.8 | 96% | 3 exploits | |
| CVE-2021-20080 | Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file. zohocorp · manageengine servicedesk plus | Medium 6.1 | 93% | · | |
| CVE-2020-8264 | Cross-site scripting in actionpack rubyonrails · rails | Medium 6.1 | 67% | · | |
| CVE-2021-21425 | In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. getgrav · grav-plugin-admin | Critical 9.8 | 81% | 2 exploits | |
| CVE-2021-28165 | Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources eclipse · jetty | High 7.5 | 54% | · | |
| CVE-2021-24155 | The WordPress Backup and Migrate Plugin – Backup Guard WordPress plugin before 1.6.0 did not ensure that the imported files are of the SGBP format and extension, allowing high privilege users (admin+) to upload arbitrary files, including PHP ones, leading to RCE. backup-guard · backup guard | High 7.2 | 84% | 4 exploits | |
| CVE-2020-9490 | Apache HTTP Server versions 2.4.20 to 2.4.43. apache · http server | High 7.5 | 89% | · | |
| CVE-2021-20078 | Manage Engine OpManager builds below 125346 are vulnerable to a remote denial of service vulnerability due to a path traversal issue in spark gateway component. zohocorp · manageengine opmanager | Critical 9.1 | 60% | · | |
| CVE-2021-22992 | On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, 12.1.x before 12.1.5.3, and 11.6.x before 11.6.5.3, a malicious HTTP response to an Advanced WAF/BIG-IP ASM virtual server with Login Page configured in its policy… f5 · big-ip access policy manager | Critical 9.8 | 73% | · | |
| CVE-2021-27273 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. netgear · prosafe network management system | High 8.8 | 66% | · | |
| CVE-2021-27276 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. netgear · prosafe network management system | High 7.1 | 73% | · | |
| CVE-2021-27275 | This vulnerability allows remote attackers to disclose sensitive information and delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. netgear · prosafe network management system | High 8.3 | 74% | · | |
| CVE-2021-27272 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of NETGEAR ProSAFE Network Management System 1.6.0.26. netgear · prosafe network management system | High 7.1 | 75% | · | |
| CVE-2020-7774 | Prototype Pollution in y18n y18n project · y18n | Critical 9.8 | 69% | · | |
| CVE-2021-29156 | ForgeRock OpenAM before 13.5.1 allows LDAP injection via the Webfinger protocol. forgerock · openam | High 7.5 | 77% | 1 exploit | |
| CVE-2021-21402 | In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. jellyfin · jellyfin | Medium 6.5 | 79% | · | |
| CVE-2021-21346 | XStream is vulnerable to an Arbitrary Code Execution attack xstream · xstream | Critical 9.8 | 76% | · | |
| CVE-2021-21341 | XStream can cause a Denial of Service. xstream · xstream | High 7.5 | 78% | · | |
| CVE-2021-25921 | In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the Allergies section. open-emr · openemr | Medium 5.4 | 91% | · | |
| CVE-2021-25919 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. open-emr · openemr | Medium 4.8 | 70% | · | |
| CVE-2021-26295 | Apache OFBiz has unsafe deserialization prior to 17.12.06. apache · ofbiz | Critical 9.8 | 98% | 2 exploits | |
| CVE-2021-27084 | Visual Studio Code Java Extension Pack Remote Code Execution Vulnerability microsoft · visual studio code | High 7.8 | 62% | · | |
| CVE-2021-27083 | Remote Development Extension for Visual Studio Code Remote Code Execution Vulnerability microsoft · remote development | High 7.8 | 62% | · | |
| CVE-2021-21300 | In affected versions of Git a specially crafted repository that contains symbolic links as well as files using a clean/smudge filter such as Git LFS, may cause just-checked out script to be executed while cloning onto a case-insensitive file system such as NTFS, HFS+ or APFS… git-scm · git | High 7.5 | 89% | 2 exploits | |
| CVE-2021-21480 | SAP MII allows users to create dashboards and save them as JSP through the SSCE (Self Service Composition Environment). sap · manufacturing integration and intelligence | High 8.8 | 52% | · | |
| CVE-2021-21978 | VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. vmware · view planner | Critical 9.8 | 99% | 2 exploits | |
| CVE-2021-22881 | Actionpack Open Redirect Vulnerability rubyonrails · rails | Medium 6.1 | 87% | · | |
| CVE-2021-26120 | PHP Code Injection by malicious function name in smarty smarty · smarty | Critical 9.8 | 82% | · | |
| CVE-2021-24086 | Windows TCP/IP Denial of Service Vulnerability microsoft · windows 10 | High 7.5 | 59% | · | |
| CVE-2021-27670 | Appspace 6.2.4 allows SSRF via the api/v1/core/proxy/jsonprequest url parameter. appspace · appspace | Critical 9.8 | 61% | 1 exploit | |
| CVE-2016-6304 | Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions. openssl · openssl | High 7.5 | 63% | · |
Showing 1,401–1,450 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.