Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2023-44450High 8.8NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability.netgear · prosafe network management systemEPSS54%·Published May 3, 2024
- CVE-2023-44449High 8.8NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability.netgear · prosafe network management systemEPSS53%·Published May 3, 2024
- CVE-2023-39473High 8.8Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS62%·Published May 3, 2024
- CVE-2023-38124High 8.8Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS60%·Published May 3, 2024
- CVE-2023-50218High 8.8Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS55%·Published May 3, 2024
- CVE-2023-50223High 8.8Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS55%·Published May 3, 2024
- CVE-2023-32164High 7.5D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability.dlink · d-view 8EPSS85%·Published May 3, 2024
- CVE-2023-44412High 8.2D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability.dlink · d-view 8EPSS82%·Published May 3, 2024
- CVE-2023-32166High 8.1D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability.dlink · d-view 8EPSS74%·Published May 3, 2024
- CVE-2023-44444High 7.8GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability.gimp · gimpEPSS56%·Published May 3, 2024
- CVE-2023-44443High 7.8GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability.gimp · gimpEPSS94%·Published May 3, 2024
- CVE-2023-44442High 7.8GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.gimp · gimpEPSS61%·Published May 3, 2024
- CVE-2023-39469High 7.2PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability.papercut · papercut ngEPSS61%·Published May 3, 2024
- CVE-2024-26331High 7.5ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID.EPSS51%·Published Apr 30, 2024
- CVE-2024-31621High 7.2Flowise vulnerable to code injection via api/v1flowiseai · flowiseEPSS61%·Published Apr 29, 2024
- CVE-2020-14144High 7.2Arbitrary Code Execution in Giteagitea · giteaEPSS95%2 exploitsPublished Apr 22, 2024
- CVE-2024-24992High 8.8A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.ivanti · avalancheEPSS71%·Published Apr 19, 2024
- CVE-2024-24994High 8.8A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.ivanti · avalancheEPSS68%·Published Apr 19, 2024
- CVE-2024-23535High 8.8A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.ivanti · avalancheEPSS68%·Published Apr 19, 2024
- CVE-2024-2961High 7.3The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.gnu · glibcEPSS88%1 exploitPublished Apr 17, 2024
- CVE-2024-31817High 7.5In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg.totolink · ex200 firmwareEPSS55%·Published Apr 15, 2024
- CVE-2024-31997High 8.8XWiki Platform remote code execution from account through UIExtension parametersxwiki · xwikiEPSS74%1 exploitPublished Apr 10, 2024
- CVE-2024-31984High 8.8XWiki Platform: Remote code execution through space title and Solr space facetxwiki · xwikiEPSS83%1 exploitPublished Apr 10, 2024
- CVE-2024-31465High 8.8XWiki Platform: Remote code execution from account via SearchSuggestSourceSheetxwiki · xwikiEPSS76%·Published Apr 10, 2024
- CVE-2024-24809High 8.5Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type.EPSS54%2 exploitsPublished Apr 10, 2024
- CVE-2024-31309High 7.5HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.apache · traffic serverEPSS95%·Published Apr 10, 2024
- CVE-2024-26256High 7.8Libarchive Remote Code Execution Vulnerabilitylibarchive · libarchiveEPSS88%·Published Apr 9, 2024
- CVE-2024-26212High 7.5DHCP Server Service Denial of Service Vulnerabilitymicrosoft · windows server 2008EPSS63%·Published Apr 9, 2024
- CVE-2024-27983High 8.2An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside.EPSS87%·Published Apr 9, 2024
- CVE-2024-28741High 8.8Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.EPSS78%1 exploitPublished Apr 6, 2024
- CVE-2023-45288High 7.5net/http, x/net/http2: close connections when receiving too many headersEPSS92%·Published Apr 4, 2024
- CVE-2024-27316High 7.5HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response.fedoraproject · fedoraEPSS91%·Published Apr 4, 2024
- CVE-2024-30255High 7.5The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames.envoyproxy · envoyEPSS88%·Published Apr 4, 2024
- CVE-2024-27919High 7.5In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames.envoyproxy · envoyEPSS87%·Published Apr 4, 2024
- CVE-2024-2653High 8.2AMPHP Denial of Service via HTTP/2 CONTINUATION FramesEPSS83%·Published Apr 3, 2024
- CVE-2024-0637High 8.8Centreon updateDirectory SQL Injection Remote Code Execution Vulnerabilitycentreon · centreon webEPSS72%·Published Apr 2, 2024
- CVE-2024-23115High 7.2Centreon updateGroups SQL Injection Remote Code Execution Vulnerabilitycentreon · centreonEPSS67%·Published Apr 2, 2024
- CVE-2024-23118High 7.2Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerabilitycentreon · centreon webEPSS53%·Published Apr 2, 2024
- CVE-2024-23117High 7.2Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerabilitycentreon · centreon webEPSS53%·Published Apr 2, 2024
- CVE-2024-23116High 7.2Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerabilitycentreon · centreon webEPSS53%·Published Apr 2, 2024
- CVE-2024-24725High 8.8Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.gibbonedu · gibbonEPSS51%2 exploitsPublished Mar 23, 2024
- CVE-2024-27921High 8.8Grav File Upload Path Traversalgetgrav · gravEPSS61%1 exploitPublished Mar 22, 2024
- CVE-2024-2448High 8.8An OS command injection vulnerability has been identified in LoadMaster.progress · loadmasterEPSS55%·Published Mar 22, 2024
- CVE-2024-1800High 8.8In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.progress · telerik report serverEPSS40%1 exploitPublished Mar 20, 2024
- CVE-2024-28254High 8.8The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution.open-metadata · openmetadataEPSS46%1 exploitPublished Mar 15, 2024
- CVE-2024-2194High 7.2WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site ScriptingEPSS68%·Published Mar 10, 2024
- CVE-2024-25111High 7.5Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug.squid-cache · squidEPSS65%·Published Mar 6, 2024
- CVE-2024-0692High 8.8The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability.solarwinds · security event managerEPSS92%·Published Mar 4, 2024
- CVE-2024-27292High 7.5Docassemble unauthorized access through URL manipulationjhpyle · docassembleEPSS69%·Published Feb 29, 2024
- CVE-2024-25723High 7.1ZenML Server Remote Privilege Escalation Vulnerabilityzenml · zenmlEPSS71%·Published Feb 27, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-44450 | NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. netgear · prosafe network management system | High 8.8 | 54% | · | |
| CVE-2023-44449 | NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. netgear · prosafe network management system | High 8.8 | 53% | · | |
| CVE-2023-39473 | Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability. inductiveautomation · ignition | High 8.8 | 62% | · | |
| CVE-2023-38124 | Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. inductiveautomation · ignition | High 8.8 | 60% | · | |
| CVE-2023-50218 | Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. inductiveautomation · ignition | High 8.8 | 55% | · | |
| CVE-2023-50223 | Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. inductiveautomation · ignition | High 8.8 | 55% | · | |
| CVE-2023-32164 | D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability. dlink · d-view 8 | High 7.5 | 85% | · | |
| CVE-2023-44412 | D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. dlink · d-view 8 | High 8.2 | 82% | · | |
| CVE-2023-32166 | D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability. dlink · d-view 8 | High 8.1 | 74% | · | |
| CVE-2023-44444 | GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. gimp · gimp | High 7.8 | 56% | · | |
| CVE-2023-44443 | GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. gimp · gimp | High 7.8 | 94% | · | |
| CVE-2023-44442 | GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. gimp · gimp | High 7.8 | 61% | · | |
| CVE-2023-39469 | PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability. papercut · papercut ng | High 7.2 | 61% | · | |
| CVE-2024-26331 | ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. | High 7.5 | 51% | · | |
| CVE-2024-31621 | Flowise vulnerable to code injection via api/v1 flowiseai · flowise | High 7.2 | 61% | · | |
| CVE-2020-14144 | Arbitrary Code Execution in Gitea gitea · gitea | High 7.2 | 95% | 2 exploits | |
| CVE-2024-24992 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ivanti · avalanche | High 8.8 | 71% | · | |
| CVE-2024-24994 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ivanti · avalanche | High 8.8 | 68% | · | |
| CVE-2024-23535 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ivanti · avalanche | High 8.8 | 68% | · | |
| CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. gnu · glibc | High 7.3 | 88% | 1 exploit | |
| CVE-2024-31817 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg. totolink · ex200 firmware | High 7.5 | 55% | · | |
| CVE-2024-31997 | XWiki Platform remote code execution from account through UIExtension parameters xwiki · xwiki | High 8.8 | 74% | 1 exploit | |
| CVE-2024-31984 | XWiki Platform: Remote code execution through space title and Solr space facet xwiki · xwiki | High 8.8 | 83% | 1 exploit | |
| CVE-2024-31465 | XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet xwiki · xwiki | High 8.8 | 76% | · | |
| CVE-2024-24809 | Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. | High 8.5 | 54% | 2 exploits | |
| CVE-2024-31309 | HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. apache · traffic server | High 7.5 | 95% | · | |
| CVE-2024-26256 | Libarchive Remote Code Execution Vulnerability libarchive · libarchive | High 7.8 | 88% | · | |
| CVE-2024-26212 | DHCP Server Service Denial of Service Vulnerability microsoft · windows server 2008 | High 7.5 | 63% | · | |
| CVE-2024-27983 | An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. | High 8.2 | 87% | · | |
| CVE-2024-28741 | Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component. | High 8.8 | 78% | 1 exploit | |
| CVE-2023-45288 | net/http, x/net/http2: close connections when receiving too many headers | High 7.5 | 92% | · | |
| CVE-2024-27316 | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. fedoraproject · fedora | High 7.5 | 91% | · | |
| CVE-2024-30255 | The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. envoyproxy · envoy | High 7.5 | 88% | · | |
| CVE-2024-27919 | In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. envoyproxy · envoy | High 7.5 | 87% | · | |
| CVE-2024-2653 | AMPHP Denial of Service via HTTP/2 CONTINUATION Frames | High 8.2 | 83% | · | |
| CVE-2024-0637 | Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability centreon · centreon web | High 8.8 | 72% | · | |
| CVE-2024-23115 | Centreon updateGroups SQL Injection Remote Code Execution Vulnerability centreon · centreon | High 7.2 | 67% | · | |
| CVE-2024-23118 | Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability centreon · centreon web | High 7.2 | 53% | · | |
| CVE-2024-23117 | Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability centreon · centreon web | High 7.2 | 53% | · | |
| CVE-2024-23116 | Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability centreon · centreon web | High 7.2 | 53% | · | |
| CVE-2024-24725 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI. gibbonedu · gibbon | High 8.8 | 51% | 2 exploits | |
| CVE-2024-27921 | Grav File Upload Path Traversal getgrav · grav | High 8.8 | 61% | 1 exploit | |
| CVE-2024-2448 | An OS command injection vulnerability has been identified in LoadMaster. progress · loadmaster | High 8.8 | 55% | · | |
| CVE-2024-1800 | In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability. progress · telerik report server | High 8.8 | 40% | 1 exploit | |
| CVE-2024-28254 | The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. open-metadata · openmetadata | High 8.8 | 46% | 1 exploit | |
| CVE-2024-2194 | WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting | High 7.2 | 68% | · | |
| CVE-2024-25111 | Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. squid-cache · squid | High 7.5 | 65% | · | |
| CVE-2024-0692 | The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. solarwinds · security event manager | High 8.8 | 92% | · | |
| CVE-2024-27292 | Docassemble unauthorized access through URL manipulation jhpyle · docassemble | High 7.5 | 69% | · | |
| CVE-2024-25723 | ZenML Server Remote Privilege Escalation Vulnerability zenml · zenml | High 7.1 | 71% | · |
Showing 101–150 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.