Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,918 vulnerabilities · highest exploit probability first
- CVE-2025-46618Medium 6.1In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tabjetbrains · teamcityEPSS63%·Published Apr 25, 2025
- CVE-2025-32969Critical 9.3org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST APIxwiki · xwikiEPSS80%1 exploitPublished Apr 23, 2025
- CVE-2025-22037Medium 5.5Linux kernel: ksmbd: fix null pointer dereference in alloc_preauth_hash()EPSS70%·Published Apr 16, 2025
- CVE-2025-2563High 8.1The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privilegeswpeverest · user registration \& membershipEPSS49%1 exploitPublished Apr 14, 2025
- CVE-2025-3102High 8.1SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User CreationEPSS76%1 exploitPublished Apr 9, 2025
- CVE-2025-32375Critical 9.8BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserializationbentoml · bentomlEPSS52%1 exploitPublished Apr 9, 2025
- CVE-2025-27520Critical 9.8BentoML Allows Remote Code Execution (RCE) via Insecure Deserializationbentoml · bentomlEPSS41%1 exploitPublished Apr 4, 2025
- CVE-2025-2945High 8.8pgAdmin 4 Vulnerable to Remote Code Executionpgadmin · pgadmin 4EPSS56%1 exploitPublished Apr 3, 2025
- CVE-2025-30676Medium 6.1Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.apache · ofbizEPSS68%·Published Apr 1, 2025
- CVE-2024-56325Critical 9.3Apache Pinot Vulnerable to Authentication Bypassapache · pinotEPSS80%·Published Apr 1, 2025
- CVE-2025-2294Critical 9.8Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File InclusionEPSS78%1 exploitPublished Mar 28, 2025
- CVE-2024-55963Medium 6.5A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart.appsmith · appsmithEPSS31%2 exploitsPublished Mar 26, 2025
- CVE-2025-30208High 7.5Vite bypasses server.fs.deny when using ?raw??vitejs · viteEPSS75%3 exploitsPublished Mar 25, 2025
- CVE-2025-1974Critical 9.8ingress-nginx admission controller RCE escalationEPSS99%1 exploitPublished Mar 25, 2025
- CVE-2025-1098High 8.8ingress-nginx controller - configuration injection via unsanitized mirror annotationsEPSS82%1 exploitPublished Mar 25, 2025
- CVE-2025-2748Medium 6.1The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.kentico · xperienceEPSS61%·Published Mar 24, 2025
- CVE-2025-29927Critical 9.1Authorization Bypass in Next.js Middlewarevercel · next.jsEPSS99%Ransomware1 exploit1 actorPublished Mar 21, 2025
- CVE-2025-24799Critical 9.8An unauthenticated user can perform a SQL injection through the inventory endpoint.glpi-project · glpiEPSS87%·Published Mar 18, 2025
- CVE-2024-12971High 8.6Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6artica · pandora fmsEPSS61%1 exploitPublished Mar 17, 2025
- CVE-2025-25292Critical 9.3Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential)onelogin · ruby-samlEPSS65%·Published Mar 12, 2025
- CVE-2025-29891Medium 4.8Apache Camel Message Header Injection through request parametersapache · camelEPSS76%1 exploitPublished Mar 12, 2025
- CVE-2025-1661Critical 9.8HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusionpluginus · husky - products filter professional for woocommerceEPSS56%·Published Mar 11, 2025
- CVE-2025-27636Medium 6.3Apache Camel: Camel Message Header Injection via Improper Filteringapache · camelEPSS97%·Published Mar 9, 2025
- CVE-2025-26319High 9.3FlowiseAI Flowise arbitrary file upload vulnerabilityflowiseai · flowiseEPSS56%·Published Mar 5, 2025
- CVE-2019-8900Medium 6.8A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devices.apple · secureromEPSS69%·Published Feb 21, 2025
- CVE-2025-26794Critical 9.8Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection.exim · eximEPSS77%·Published Feb 21, 2025
- CVE-2025-27218Medium 5.3Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.EPSS65%2 exploitsPublished Feb 20, 2025
- CVE-2025-1338Medium 6.9It has been declared as critical.EPSS51%·Published Feb 16, 2025
- CVE-2025-1094High 8.1Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns.EPSS90%1 exploitPublished Feb 13, 2025
- CVE-2025-1044Critical 9.8Logsign Unified SecOps Platform Authentication Bypass Vulnerability.logsign · unified secops platformEPSS75%·Published Feb 11, 2025
- CVE-2024-36404Critical 9.8GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressionsEPSS76%·Published Feb 5, 2025
- CVE-2025-24367High 8.7An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server.cacti · cactiEPSS54%2 exploitsPublished Jan 27, 2025
- CVE-2024-12084Critical 9.8rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handlingsamba · rsyncEPSS72%1 exploitPublished Jan 16, 2025
- CVE-2025-21298Critical 9.8Windows OLE Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS81%·Published Jan 15, 2025
- CVE-2024-48760Critical 9.8An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function.gestioip · gestioipEPSS45%3 exploitsPublished Jan 14, 2025
- CVE-2024-13162High 7.2SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.ivanti · endpoint managerEPSS64%·Published Jan 14, 2025
- CVE-2024-13179Critical 9.8Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication.ivanti · avalancheEPSS63%·Published Jan 14, 2025
- CVE-2025-21285High 7.5Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 1507EPSS56%·Published Jan 13, 2025
- CVE-2025-0107High 7.7An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API…paloaltonetworks · expeditionEPSS78%·Published Jan 11, 2025
- CVE-2024-12847Critical 9.8NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability.netgear · dgn1000 firmwareEPSS30%3 exploitsPublished Jan 10, 2025
- CVE-2024-56511Critical 9.3Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access.dataease · dataeaseEPSS50%1 exploitPublished Jan 10, 2025
- CVE-2024-54676Critical 9.3Apache OpenMeetings vulnerable to Deserialization of Untrusted Dataapache · openmeetingsEPSS69%·Published Jan 8, 2025
- CVE-2024-55556Critical 9.8A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data.EPSS44%1 exploitPublished Jan 7, 2025
- CVE-2024-11972Critical 9.8The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk…themehunk · hunk companionEPSS59%1 exploitPublished Dec 31, 2024
- CVE-2024-12856High 7.2The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability.four-faith · f3x24 firmwareEPSS84%·Published Dec 27, 2024
- CVE-2024-43441Critical 9.8Apache HugeGraph-Server: Fixed JWT Token (Secret)apache · hugegraphEPSS73%·Published Dec 24, 2024
- CVE-2024-39931Critical 9.9Gogs allows deletion of internal filesgogs · gogsEPSS53%·Published Dec 23, 2024
- CVE-2024-55947High 8.7Path Traversal in file update API in gogsgogs · gogsEPSS78%·Published Dec 23, 2024
- CVE-2024-38819High 7.5Spring Framework Path Traversal vulnerabilityEPSS56%·Published Dec 19, 2024
- CVE-2024-49112Critical 9.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS72%·Published Dec 12, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-46618 | In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab jetbrains · teamcity | Medium 6.1 | 63% | · | |
| CVE-2025-32969 | org.xwiki.platform:xwiki-platform-rest-server allows SQL injection in query endpoint of REST API xwiki · xwiki | Critical 9.3 | 80% | 1 exploit | |
| CVE-2025-22037 | Linux kernel: ksmbd: fix null pointer dereference in alloc_preauth_hash() | Medium 5.5 | 70% | · | |
| CVE-2025-2563 | The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges wpeverest · user registration \& membership | High 8.1 | 49% | 1 exploit | |
| CVE-2025-3102 | SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation | High 8.1 | 76% | 1 exploit | |
| CVE-2025-32375 | BentoML's runner server Vulnerable to Remote Code Execution (RCE) via Insecure Deserialization bentoml · bentoml | Critical 9.8 | 52% | 1 exploit | |
| CVE-2025-27520 | BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization bentoml · bentoml | Critical 9.8 | 41% | 1 exploit | |
| CVE-2025-2945 | pgAdmin 4 Vulnerable to Remote Code Execution pgadmin · pgadmin 4 | High 8.8 | 56% | 1 exploit | |
| CVE-2025-30676 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. apache · ofbiz | Medium 6.1 | 68% | · | |
| CVE-2024-56325 | Apache Pinot Vulnerable to Authentication Bypass apache · pinot | Critical 9.3 | 80% | · | |
| CVE-2025-2294 | Kubio AI Page Builder <= 2.5.1 - Unauthenticated Local File Inclusion | Critical 9.8 | 78% | 1 exploit | |
| CVE-2024-55963 | A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. appsmith · appsmith | Medium 6.5 | 31% | 2 exploits | |
| CVE-2025-30208 | Vite bypasses server.fs.deny when using ?raw?? vitejs · vite | High 7.5 | 75% | 3 exploits | |
| CVE-2025-1974 | ingress-nginx admission controller RCE escalation | Critical 9.8 | 99% | 1 exploit | |
| CVE-2025-1098 | ingress-nginx controller - configuration injection via unsanitized mirror annotations | High 8.8 | 82% | 1 exploit | |
| CVE-2025-2748 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178. kentico · xperience | Medium 6.1 | 61% | · | |
| CVE-2025-29927 | Authorization Bypass in Next.js Middleware vercel · next.js | Critical 9.1 | 99% | Ransomware1 exploit1 actor | |
| CVE-2025-24799 | An unauthenticated user can perform a SQL injection through the inventory endpoint. glpi-project · glpi | Critical 9.8 | 87% | · | |
| CVE-2024-12971 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 artica · pandora fms | High 8.6 | 61% | 1 exploit | |
| CVE-2025-25292 | Ruby SAML allows a SAML authentication bypass due to namespace handling (parser differential) onelogin · ruby-saml | Critical 9.3 | 65% | · | |
| CVE-2025-29891 | Apache Camel Message Header Injection through request parameters apache · camel | Medium 4.8 | 76% | 1 exploit | |
| CVE-2025-1661 | HUSKY – Products Filter Professional for WooCommerce <= 1.3.6.5 - Unauthenticated Local File Inclusion pluginus · husky - products filter professional for woocommerce | Critical 9.8 | 56% | · | |
| CVE-2025-27636 | Apache Camel: Camel Message Header Injection via Improper Filtering apache · camel | Medium 6.3 | 97% | · | |
| CVE-2025-26319 | FlowiseAI Flowise arbitrary file upload vulnerability flowiseai · flowise | High 9.3 | 56% | · | |
| CVE-2019-8900 | A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devices. apple · securerom | Medium 6.8 | 69% | · | |
| CVE-2025-26794 | Exim 4.98 before 4.98.1, when SQLite hints and ETRN serialization are used, allows remote SQL injection. exim · exim | Critical 9.8 | 77% | · | |
| CVE-2025-27218 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. | Medium 5.3 | 65% | 2 exploits | |
| CVE-2025-1338 | It has been declared as critical. | Medium 6.9 | 51% | · | |
| CVE-2025-1094 | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. | High 8.1 | 90% | 1 exploit | |
| CVE-2025-1044 | Logsign Unified SecOps Platform Authentication Bypass Vulnerability. logsign · unified secops platform | Critical 9.8 | 75% | · | |
| CVE-2024-36404 | GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions | Critical 9.8 | 76% | · | |
| CVE-2025-24367 | An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. cacti · cacti | High 8.7 | 54% | 2 exploits | |
| CVE-2024-12084 | rsync: Heap Buffer Overflow in Rsync due to Improper Checksum Length Handling samba · rsync | Critical 9.8 | 72% | 1 exploit | |
| CVE-2025-21298 | Windows OLE Remote Code Execution Vulnerability microsoft · windows 10 1507 | Critical 9.8 | 81% | · | |
| CVE-2024-48760 | An issue in GestioIP v3.5.7 allows a remote attacker to execute arbitrary code via the file upload function. gestioip · gestioip | Critical 9.8 | 45% | 3 exploits | |
| CVE-2024-13162 | SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. ivanti · endpoint manager | High 7.2 | 64% | · | |
| CVE-2024-13179 | Path Traversal in Ivanti Avalanche before version 6.4.7 allows a remote unauthenticated attacker to bypass authentication. ivanti · avalanche | Critical 9.8 | 63% | · | |
| CVE-2025-21285 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability microsoft · windows 10 1507 | High 7.5 | 56% | · | |
| CVE-2025-0107 | An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API… paloaltonetworks · expedition | High 7.7 | 78% | · | |
| CVE-2024-12847 | NETGEAR DGN1000 before 1.1.00.48 is vulnerable to an authentication bypass vulnerability. netgear · dgn1000 firmware | Critical 9.8 | 30% | 3 exploits | |
| CVE-2024-56511 | Prior to 2.10.4, there is a flaw in the authentication in the io.dataease.auth.filter.TokenFilter class, which can be bypassed and cause the risk of unauthorized access. dataease · dataease | Critical 9.3 | 50% | 1 exploit | |
| CVE-2024-54676 | Apache OpenMeetings vulnerable to Deserialization of Untrusted Data apache · openmeetings | Critical 9.3 | 69% | · | |
| CVE-2024-55556 | A vulnerability in Crater Invoice allows an unauthenticated attacker with knowledge of the APP_KEY to achieve remote command execution on the server by manipulating the laravel_session cookie, exploiting arbitrary deserialization through the encrypted session data. | Critical 9.8 | 44% | 1 exploit | |
| CVE-2024-11972 | The Hunk Companion WordPress plugin before 1.9.0 does not correctly authorize some REST API endpoints, allowing unauthenticated requests to install and activate arbitrary Hunk Companion WordPress plugin before 1.9.0 from the WordPress.org repo, including vulnerable Hunk… themehunk · hunk companion | Critical 9.8 | 59% | 1 exploit | |
| CVE-2024-12856 | The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. four-faith · f3x24 firmware | High 7.2 | 84% | · | |
| CVE-2024-43441 | Apache HugeGraph-Server: Fixed JWT Token (Secret) apache · hugegraph | Critical 9.8 | 73% | · | |
| CVE-2024-39931 | Gogs allows deletion of internal files gogs · gogs | Critical 9.9 | 53% | · | |
| CVE-2024-55947 | Path Traversal in file update API in gogs gogs · gogs | High 8.7 | 78% | · | |
| CVE-2024-38819 | Spring Framework Path Traversal vulnerability | High 7.5 | 56% | · | |
| CVE-2024-49112 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability microsoft · windows 10 1507 | Critical 9.8 | 72% | · |
Showing 101–150 of 3,918
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.