Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2024-5932Critical 9.8GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Executiongivewp · givewpEPSS77%1 exploitPublished Sep 30, 2024
- CVE-2024-8353Critical 9.8GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injectiongivewp · givewpEPSS29%1 exploitPublished Sep 30, 2024
- CVE-2024-47175Critical 9.8The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer.openprinting · libppdEPSS64%2 exploitsPublished Sep 26, 2024
- CVE-2024-29847Critical 9.8Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.ivanti · endpoint managerEPSS53%·Published Sep 12, 2024
- CVE-2024-8503Critical 9.8An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records.EPSS79%1 exploitPublished Sep 10, 2024
- CVE-2024-8517Critical 9.8SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue.spip · spipEPSS95%1 exploitPublished Sep 6, 2024
- CVE-2024-45488Critical 9.8One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies.EPSS51%·Published Aug 29, 2024
- CVE-2024-7954Critical 9.8The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability.EPSS90%1 exploitPublished Aug 23, 2024
- CVE-2024-38063Critical 9.8Windows TCP/IP Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS71%·Published Aug 14, 2024
- CVE-2024-41730Critical 9.8In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint.sap · business objects business intelligence platformEPSS76%·Published Aug 13, 2024
- CVE-2024-6782Critical 9.8Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.EPSS84%1 exploitPublished Aug 6, 2024
- CVE-2023-30625Critical 9.3rudder-server is vulnerable to SQL injectionrudderstack · rudder-serverEPSS86%1 exploitPublished Aug 5, 2024
- CVE-2023-49785Critical 9.3NextChat has full-read SSRF and XSS vulnerability in /api/cors endpointnextchat · nextchatEPSS83%1 exploitPublished Aug 5, 2024
- CVE-2024-7314Critical 9.8anji-plus AJ-Report is affected by an authentication bypass vulnerability.anji-plus · reportEPSS52%2 exploitsPublished Aug 2, 2024
- CVE-2024-20419Critical 10.0A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.cisco · smart software manager on-premEPSS81%1 exploitPublished Jul 18, 2024
- CVE-2024-6396Critical 9.8A vulnerability in the _backup_run function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data.aimstack · aimEPSS53%·Published Jul 11, 2024
- CVE-2024-38077Critical 9.8Windows Remote Desktop Licensing Service Remote Code Execution Vulnerabilitymicrosoft · windows server 2008EPSS84%·Published Jul 10, 2024
- CVE-2024-5806Critical 9.8Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.progress · moveit transferEPSS81%·Published Jun 26, 2024
- CVE-2024-37843Critical 9.3Craft CMS SQL injection vulnerability via the GraphQL API endpointcraftcms · craft cmsEPSS53%·Published Jun 25, 2024
- CVE-2024-5276Critical 9.1A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.fortra · filecatalyst workflowEPSS90%·Published Jun 25, 2024
- CVE-2024-4883Critical 9.8In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold.progress · whatsup goldEPSS65%·Published Jun 25, 2024
- CVE-2022-0435Critical 9.2A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.linux · linux kernelEPSS68%·Published Jun 24, 2024
- CVE-2012-6664Critical 9.1Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a ..EPSS30%1 exploitPublished Jun 21, 2024
- CVE-2024-3552Critical 9.8Web Directory Free <= 1.6.9 - Unauthenticated SQL Injectionsalephpscripts · web directory freeEPSS67%·Published Jun 14, 2024
- CVE-2024-3922Critical 9.8Dokan Pro <= 3.10.3 - Unauthenticated SQL Injectiondokan · dokanEPSS53%·Published Jun 14, 2024
- CVE-2024-36104Critical 9.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.apache · ofbizEPSS88%·Published Jun 7, 2024
- CVE-2024-29972Critical 9.8UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating…zyxel · nas326 firmwareEPSS89%·Published Jun 7, 2024
- CVE-2024-29973Critical 9.8UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS)…zyxel · nas326 firmwareEPSS86%·Published Jun 7, 2024
- CVE-2024-25600Critical 10.0Bricks <= 1.9.6 - Unauthenticated Remote Code ExecutionEPSS88%Ransomware3 exploits1 actorPublished Jun 7, 2024
- CVE-2024-4990Critical 9.1Unsafe Reflection in base Component class in yiisoft/yii2yiiframework · yiiEPSS80%·Published Jun 2, 2024
- CVE-2024-5084Critical 9.8Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Executionhashthemes · hash formEPSS51%1 exploitPublished May 24, 2024
- CVE-2024-27954Critical 9.3Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request ForgeryEPSS73%·Published May 20, 2024
- CVE-2024-29895Critical 10.0Cacti provides an operational monitoring and fault management framework.EPSS99%·Published May 13, 2024
- CVE-2024-32964Critical 9.0lobe-chat /api/proxy endpoint Server-Side Request Forgery vulnerabilitylobehub · lobe chatEPSS53%·Published May 10, 2024
- CVE-2024-4548Critical 9.8An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator.deltaww · diaenergieEPSS29%1 exploitPublished May 6, 2024
- CVE-2023-40504Critical 9.8LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability.lg · simple editorEPSS89%1 exploitPublished May 3, 2024
- CVE-2023-40498Critical 9.8LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability.lg · simple editorEPSS85%1 exploitPublished May 3, 2024
- CVE-2023-40502Critical 9.1LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability.lg · simple editorEPSS83%·Published May 3, 2024
- CVE-2023-40494Critical 9.1LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability.lg · simple editorEPSS83%·Published May 3, 2024
- CVE-2023-40492Critical 9.1LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability.lg · simple editorEPSS83%·Published May 3, 2024
- CVE-2023-40497Critical 9.8LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability.lg · simple editorEPSS69%·Published May 3, 2024
- CVE-2023-38096Critical 9.8NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability.netgear · prosafe network management systemEPSS82%1 exploitPublished May 3, 2024
- CVE-2023-50231Critical 9.6NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability.netgear · prosafe network management systemEPSS53%·Published May 3, 2024
- CVE-2023-39475Critical 9.8Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS64%·Published May 3, 2024
- CVE-2023-32165Critical 9.8D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability.dlink · d-view 8EPSS73%·Published May 3, 2024
- CVE-2023-32169Critical 9.8D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability.dlink · d-view 8EPSS56%·Published May 3, 2024
- CVE-2024-2876Critical 9.8Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL InjectionEPSS81%·Published May 3, 2024
- CVE-2023-49606Critical 9.8A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0.tinyproxy project · tinyproxyEPSS63%·Published May 1, 2024
- CVE-2024-32238Critical 9.8H3C ER8300G2-X is vulnerable to Incorrect Access Control.EPSS53%·Published Apr 22, 2024
- CVE-2024-1728Critical 9.2Duplicate Advisory: Gradio Local File Inclusion vulnerabilitygradio project · gradioEPSS85%·Published Apr 10, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-5932 | GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution givewp · givewp | Critical 9.8 | 77% | 1 exploit | |
| CVE-2024-8353 | GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection givewp · givewp | Critical 9.8 | 29% | 1 exploit | |
| CVE-2024-47175 | The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. openprinting · libppd | Critical 9.8 | 64% | 2 exploits | |
| CVE-2024-29847 | Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. ivanti · endpoint manager | Critical 9.8 | 53% | · | |
| CVE-2024-8503 | An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. | Critical 9.8 | 79% | 1 exploit | |
| CVE-2024-8517 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. spip · spip | Critical 9.8 | 95% | 1 exploit | |
| CVE-2024-45488 | One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. | Critical 9.8 | 51% | · | |
| CVE-2024-7954 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. | Critical 9.8 | 90% | 1 exploit | |
| CVE-2024-38063 | Windows TCP/IP Remote Code Execution Vulnerability microsoft · windows 10 1507 | Critical 9.8 | 71% | · | |
| CVE-2024-41730 | In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. sap · business objects business intelligence platform | Critical 9.8 | 76% | · | |
| CVE-2024-6782 | Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. | Critical 9.8 | 84% | 1 exploit | |
| CVE-2023-30625 | rudder-server is vulnerable to SQL injection rudderstack · rudder-server | Critical 9.3 | 86% | 1 exploit | |
| CVE-2023-49785 | NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint nextchat · nextchat | Critical 9.3 | 83% | 1 exploit | |
| CVE-2024-7314 | anji-plus AJ-Report is affected by an authentication bypass vulnerability. anji-plus · report | Critical 9.8 | 52% | 2 exploits | |
| CVE-2024-20419 | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. cisco · smart software manager on-prem | Critical 10.0 | 81% | 1 exploit | |
| CVE-2024-6396 | A vulnerability in the _backup_run function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. aimstack · aim | Critical 9.8 | 53% | · | |
| CVE-2024-38077 | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability microsoft · windows server 2008 | Critical 9.8 | 84% | · | |
| CVE-2024-5806 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2. progress · moveit transfer | Critical 9.8 | 81% | · | |
| CVE-2024-37843 | Craft CMS SQL injection vulnerability via the GraphQL API endpoint craftcms · craft cms | Critical 9.3 | 53% | · | |
| CVE-2024-5276 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. fortra · filecatalyst workflow | Critical 9.1 | 90% | · | |
| CVE-2024-4883 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. progress · whatsup gold | Critical 9.8 | 65% | · | |
| CVE-2022-0435 | A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. linux · linux kernel | Critical 9.2 | 68% | · | |
| CVE-2012-6664 | Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. | Critical 9.1 | 30% | 1 exploit | |
| CVE-2024-3552 | Web Directory Free <= 1.6.9 - Unauthenticated SQL Injection salephpscripts · web directory free | Critical 9.8 | 67% | · | |
| CVE-2024-3922 | Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection dokan · dokan | Critical 9.8 | 53% | · | |
| CVE-2024-36104 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. apache · ofbiz | Critical 9.1 | 88% | · | |
| CVE-2024-29972 | UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating… zyxel · nas326 firmware | Critical 9.8 | 89% | · | |
| CVE-2024-29973 | UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS)… zyxel · nas326 firmware | Critical 9.8 | 86% | · | |
| CVE-2024-25600 | Bricks <= 1.9.6 - Unauthenticated Remote Code Execution | Critical 10.0 | 88% | Ransomware3 exploits1 actor | |
| CVE-2024-4990 | Unsafe Reflection in base Component class in yiisoft/yii2 yiiframework · yii | Critical 9.1 | 80% | · | |
| CVE-2024-5084 | Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution hashthemes · hash form | Critical 9.8 | 51% | 1 exploit | |
| CVE-2024-27954 | Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery | Critical 9.3 | 73% | · | |
| CVE-2024-29895 | Cacti provides an operational monitoring and fault management framework. | Critical 10.0 | 99% | · | |
| CVE-2024-32964 | lobe-chat /api/proxy endpoint Server-Side Request Forgery vulnerability lobehub · lobe chat | Critical 9.0 | 53% | · | |
| CVE-2024-4548 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. deltaww · diaenergie | Critical 9.8 | 29% | 1 exploit | |
| CVE-2023-40504 | LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-40498 | LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 85% | 1 exploit | |
| CVE-2023-40502 | LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability. lg · simple editor | Critical 9.1 | 83% | · | |
| CVE-2023-40494 | LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability. lg · simple editor | Critical 9.1 | 83% | · | |
| CVE-2023-40492 | LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability. lg · simple editor | Critical 9.1 | 83% | · | |
| CVE-2023-40497 | LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 69% | · | |
| CVE-2023-38096 | NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. netgear · prosafe network management system | Critical 9.8 | 82% | 1 exploit | |
| CVE-2023-50231 | NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. netgear · prosafe network management system | Critical 9.6 | 53% | · | |
| CVE-2023-39475 | Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. inductiveautomation · ignition | Critical 9.8 | 64% | · | |
| CVE-2023-32165 | D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability. dlink · d-view 8 | Critical 9.8 | 73% | · | |
| CVE-2023-32169 | D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. dlink · d-view 8 | Critical 9.8 | 56% | · | |
| CVE-2024-2876 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection | Critical 9.8 | 81% | · | |
| CVE-2023-49606 | A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. tinyproxy project · tinyproxy | Critical 9.8 | 63% | · | |
| CVE-2024-32238 | H3C ER8300G2-X is vulnerable to Incorrect Access Control. | Critical 9.8 | 53% | · | |
| CVE-2024-1728 | Duplicate Advisory: Gradio Local File Inclusion vulnerability gradio project · gradio | Critical 9.2 | 85% | · |
Showing 101–150 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.