Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
780 vulnerabilities · highest exploit probability first
- CVE-2022-36021Medium 5.5Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time.redis · redisEPSS60%·Published Mar 1, 2023
- CVE-2023-27293Medium 6.1Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission.opencats · opencatsEPSS57%·Published Feb 28, 2023
- CVE-2022-48343Medium 6.1In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process.jetbrains · teamcityEPSS59%·Published Feb 23, 2023
- CVE-2022-29273Medium 6.1pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters.netgate · pfsenseEPSS60%·Published Feb 22, 2023
- CVE-2023-22232Medium 5.3Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass.adobe · connectEPSS83%2 exploitsPublished Feb 17, 2023
- CVE-2022-4830Medium 6.1The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be…strangerstudios · paid memberships proEPSS65%·Published Feb 13, 2023
- CVE-2022-44268Medium 6.5ImageMagick 7.1.0-49 is vulnerable to Information Disclosure.imagemagick · imagemagickEPSS90%1 exploitPublished Feb 6, 2023
- CVE-2022-44267Medium 6.5ImageMagick 7.1.0-49 is vulnerable to Denial of Service.imagemagick · imagemagickEPSS77%1 exploitPublished Feb 6, 2023
- CVE-2023-25136Medium 6.5OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling.openbsd · opensshEPSS90%·Published Feb 3, 2023
- CVE-2023-23074Medium 6.1Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component.zohocorp · manageengine servicedesk plusEPSS84%·Published Feb 2, 2023
- CVE-2023-3388Medium 6.1Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scriptingbeautiful-cookie-banner · beautiful cookie consent bannerEPSS84%·Published Jan 30, 2023
- CVE-2022-32215Medium 6.5The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers.llhttp · llhttpEPSS70%·Published Jan 25, 2023
- CVE-2022-31711Medium 5.3VMware vRealize Log Insight contains an Information Disclosure Vulnerability.vmware · vrealize log insightEPSS24%1 exploitPublished Jan 25, 2023
- CVE-2023-22458Medium 5.5Authenticated users can issue a HRANDFIELD or ZRANDMEMBER command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure.redis · redisEPSS72%·Published Jan 20, 2023
- CVE-2022-46889Medium 5.4A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php.nexusphp · nexusphpEPSS60%·Published Jan 19, 2023
- CVE-2022-44793Medium 6.5net-snmp - security updatenet-snmp · net-snmpEPSS53%2 exploitsPublished Jan 16, 2023
- CVE-2022-44792Medium 6.5net-snmp - security updatenet-snmp · net-snmpEPSS52%2 exploitsPublished Jan 16, 2023
- CVE-2023-0028Medium 5.4Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+.linagora · twakeEPSS56%·Published Dec 31, 2022
- CVE-2022-47938Medium 6.5fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT.linux · linux kernelEPSS60%·Published Dec 27, 2022
- CVE-2022-3562Medium 5.4Cross-site Scripting in librenms/librenmslibrenms · librenmsEPSS94%·Published Nov 20, 2022
- CVE-2022-4067Medium 5.4Cross-site Scripting in librenms/librenmslibrenms · librenmsEPSS94%·Published Nov 20, 2022
- CVE-2022-4069Medium 4.8Cross-site Scripting in librenms/librenmslibrenms · librenmsEPSS93%·Published Nov 20, 2022
- CVE-2022-28732Medium 6.1Apache JSPWiki XSS due to crafted request in WeblogPluginapache · jspwikiEPSS82%·Published Nov 17, 2022
- CVE-2022-45402Medium 6.1Apache Airflow Contains Open Redirectapache · airflowEPSS82%·Published Nov 15, 2022
- CVE-2022-3265Medium 5.4A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2.gitlab · gitlabEPSS87%·Published Nov 10, 2022
- CVE-2022-2753Medium 6.1The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation madeketchup restaurant reservations project · ketchup restaurant reservationsEPSS84%·Published Sep 19, 2022
- CVE-2022-36097Medium 6.1XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment formxwiki · xwikiEPSS58%1 exploitPublished Sep 16, 2022
- CVE-2022-39810Medium 6.1A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter.wso2 · enterprise integratorEPSS57%·Published Sep 9, 2022
- CVE-2022-30690Medium 6.1A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.wwbn · avideoEPSS84%·Published Aug 22, 2022
- CVE-2022-34258Medium 4.8Magento stored Cross-Site Scripting (XSS) vulnerabilityadobe · commerceEPSS69%·Published Aug 17, 2022
- CVE-2021-43813Medium 4.3grafana: directory traversal vulnerabilitygrafana · grafanaEPSS57%·Published Aug 15, 2022
- CVE-2022-36801Medium 6.1Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint.atlassian · jira serverEPSS66%·Published Aug 10, 2022
- CVE-2022-2733Medium 6.1Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1.open-emr · openemrEPSS96%·Published Aug 9, 2022
- CVE-2022-28730Medium 6.1Apache JSPWiki XSS due to incomplete patch for CVE-2021-40369apache · jspwikiEPSS86%·Published Aug 5, 2022
- CVE-2022-27166Medium 6.1Apache JSPWiki XSS due to crafted request on XHRHtml2Markup.jspapache · jspwikiEPSS86%·Published Aug 5, 2022
- CVE-2022-28731Medium 6.5Apache JSPWiki CSRF due to crafted request on UserPreferences.jspapache · jspwikiEPSS58%·Published Aug 5, 2022
- CVE-2022-21550Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS51%·Published Jul 19, 2022
- CVE-2022-32214Medium 6.5llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fieldsllhttp · llhttpEPSS82%·Published Jul 15, 2022
- CVE-2022-33098Medium 6.1Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function.magnolia-cms · magnolia cmsEPSS53%1 exploitPublished Jul 7, 2022
- CVE-2022-2230Medium 4.8A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf.gitlab · gitlabEPSS57%·Published Jul 1, 2022
- CVE-2022-26135Medium 6.5A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint.atlassian · jira data centerEPSS72%·Published Jul 1, 2022
- CVE-2022-34783Medium 5.4Cross-site Scripting in Jenkins Plot Pluginjenkins · plotEPSS81%·Published Jul 1, 2022
- CVE-2022-34777Medium 5.4Cross-site Scripting in Jenkins GitLab Pluginjenkins · gitlabEPSS73%·Published Jul 1, 2022
- CVE-2022-34176Medium 5.4Cross-site Scripting in Jenkins JUnit Pluginjenkins · junitEPSS77%·Published Jun 24, 2022
- CVE-2021-34429Medium 5.3For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints.eclipse · jettyEPSS99%1 exploitPublished Jun 20, 2022
- CVE-2022-1707Medium 6.1Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Searchgtm4wp · google tag managerEPSS89%·Published Jun 14, 2022
- CVE-2022-31470Medium 6.1An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and…axigen · axigen mobile webmailEPSS53%1 exploitPublished Jun 7, 2022
- CVE-2022-25772Medium 6.1Cross-site Scripting vulnerability in Mautic's tracking pixel functionalityacquia · mauticEPSS62%·Published May 25, 2022
- CVE-2021-27907Medium 5.4Apache Superset Stored XSS on Dashboard markdownapache · supersetEPSS86%·Published May 24, 2022
- CVE-2019-10405Medium 5.4Exposure of Sensitive Information to an Unauthorized Actor in Jenkinsjenkins · jenkinsEPSS65%·Published May 24, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-36021 | Authenticated users can use string matching commands (like SCAN or KEYS) with a specially crafted pattern to trigger a denial-of-service attack on Redis, causing it to hang and consume 100% CPU time. redis · redis | Medium 5.5 | 60% | · | |
| CVE-2023-27293 | Improper neutralization of input during web page generation allows an unauthenticated attacker to submit malicious Javascript as the answer to a questionnaire which would then be executed when an authenticated user reviews the candidate's submission. opencats · opencats | Medium 6.1 | 57% | · | |
| CVE-2022-48343 | In JetBrains TeamCity before 2022.10.2 there was an XSS vulnerability in the user creation process. jetbrains · teamcity | Medium 6.1 | 59% | · | |
| CVE-2022-29273 | pfSense CE through 2.6.0 and pfSense Plus before 22.05 allow XSS in the WebGUI via URL Table Alias URL parameters. netgate · pfsense | Medium 6.1 | 60% | · | |
| CVE-2023-22232 | Adobe Connect versions 11.4.5 (and earlier), 12.1.5 (and earlier) are affected by an Improper Access Control vulnerability that could result in a Security feature bypass. adobe · connect | Medium 5.3 | 83% | 2 exploits | |
| CVE-2022-4830 | The Paid Memberships Pro WordPress plugin before 2.9.9 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be… strangerstudios · paid memberships pro | Medium 6.1 | 65% | · | |
| CVE-2022-44268 | ImageMagick 7.1.0-49 is vulnerable to Information Disclosure. imagemagick · imagemagick | Medium 6.5 | 90% | 1 exploit | |
| CVE-2022-44267 | ImageMagick 7.1.0-49 is vulnerable to Denial of Service. imagemagick · imagemagick | Medium 6.5 | 77% | 1 exploit | |
| CVE-2023-25136 | OpenSSH server (sshd) 9.1 introduced a double-free vulnerability during options.kex_algorithms handling. openbsd · openssh | Medium 6.5 | 90% | · | |
| CVE-2023-23074 | Cross site scripting (XSS) vulnerability in Zoho ManageEngine ServiceDesk Plus 14 via embedding videos in the language component. zohocorp · manageengine servicedesk plus | Medium 6.1 | 84% | · | |
| CVE-2023-3388 | Beautiful Cookie Consent Banner <= 2.10.1 - Unauthenticated Stored Cross-Site Scripting beautiful-cookie-banner · beautiful cookie consent banner | Medium 6.1 | 84% | · | |
| CVE-2022-32215 | The llhttp parser <v14.20.1, <v16.17.1 and <v18.9.1 in the http module in Node.js does not correctly handle multi-line Transfer-Encoding headers. llhttp · llhttp | Medium 6.5 | 70% | · | |
| CVE-2022-31711 | VMware vRealize Log Insight contains an Information Disclosure Vulnerability. vmware · vrealize log insight | Medium 5.3 | 24% | 1 exploit | |
| CVE-2023-22458 | Authenticated users can issue a HRANDFIELD or ZRANDMEMBER command with specially crafted arguments to trigger a denial-of-service by crashing Redis with an assertion failure. redis · redis | Medium 5.5 | 72% | · | |
| CVE-2022-46889 | A persistent cross-site scripting (XSS) vulnerability in NexusPHP before 1.7.33 allows remote authenticated attackers to permanently inject arbitrary web script or HTML via the title parameter used in /subtitles.php. nexusphp · nexusphp | Medium 5.4 | 60% | · | |
| CVE-2022-44793 | net-snmp - security update net-snmp · net-snmp | Medium 6.5 | 53% | 2 exploits | |
| CVE-2022-44792 | net-snmp - security update net-snmp · net-snmp | Medium 6.5 | 52% | 2 exploits | |
| CVE-2023-0028 | Cross-site Scripting (XSS) - Stored in GitHub repository linagora/twake prior to 2023.Q1.1200+. linagora · twake | Medium 5.4 | 56% | · | |
| CVE-2022-47938 | fs/ksmbd/smb2misc.c has an out-of-bounds read and OOPS for SMB2_TREE_CONNECT. linux · linux kernel | Medium 6.5 | 60% | · | |
| CVE-2022-3562 | Cross-site Scripting in librenms/librenms librenms · librenms | Medium 5.4 | 94% | · | |
| CVE-2022-4067 | Cross-site Scripting in librenms/librenms librenms · librenms | Medium 5.4 | 94% | · | |
| CVE-2022-4069 | Cross-site Scripting in librenms/librenms librenms · librenms | Medium 4.8 | 93% | · | |
| CVE-2022-28732 | Apache JSPWiki XSS due to crafted request in WeblogPlugin apache · jspwiki | Medium 6.1 | 82% | · | |
| CVE-2022-45402 | Apache Airflow Contains Open Redirect apache · airflow | Medium 6.1 | 82% | · | |
| CVE-2022-3265 | A cross-site scripting issue has been discovered in GitLab CE/EE affecting all versions prior to 15.3.5, 15.4 prior to 15.4.4, and 15.5 prior to 15.5.2. gitlab · gitlab | Medium 5.4 | 87% | · | |
| CVE-2022-2753 | The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made ketchup restaurant reservations project · ketchup restaurant reservations | Medium 6.1 | 84% | · | |
| CVE-2022-36097 | XWiki Platform Attachment UI vulnerable to cross-site scripting in the move attachment form xwiki · xwiki | Medium 6.1 | 58% | 1 exploit | |
| CVE-2022-39810 | A Reflected Cross-Site Scripting (XSS) vulnerability has been identified in the Management Console under /carbon/ndatasource/validateconnection/ajaxprocessor.jsp via the driver parameter. wso2 · enterprise integrator | Medium 6.1 | 57% | · | |
| CVE-2022-30690 | A cross-site scripting (xss) vulnerability exists in the image403 functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. wwbn · avideo | Medium 6.1 | 84% | · | |
| CVE-2022-34258 | Magento stored Cross-Site Scripting (XSS) vulnerability adobe · commerce | Medium 4.8 | 69% | · | |
| CVE-2021-43813 | grafana: directory traversal vulnerability grafana · grafana | Medium 4.3 | 57% | · | |
| CVE-2022-36801 | Affected versions of Atlassian Jira Server and Data Center allow anonymous remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (RXSS) vulnerability in the TeamManagement.jspa endpoint. atlassian · jira server | Medium 6.1 | 66% | · | |
| CVE-2022-2733 | Cross-site Scripting (XSS) - Reflected in GitHub repository openemr/openemr prior to 7.0.0.1. open-emr · openemr | Medium 6.1 | 96% | · | |
| CVE-2022-28730 | Apache JSPWiki XSS due to incomplete patch for CVE-2021-40369 apache · jspwiki | Medium 6.1 | 86% | · | |
| CVE-2022-27166 | Apache JSPWiki XSS due to crafted request on XHRHtml2Markup.jsp apache · jspwiki | Medium 6.1 | 86% | · | |
| CVE-2022-28731 | Apache JSPWiki CSRF due to crafted request on UserPreferences.jsp apache · jspwiki | Medium 6.5 | 58% | · | |
| CVE-2022-21550 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 51% | · | |
| CVE-2022-32214 | llhttp allows HTTP Request Smuggling via Improper Delimiting of Header Fields llhttp · llhttp | Medium 6.5 | 82% | · | |
| CVE-2022-33098 | Magnolia CMS v6.2.19 was discovered to contain a cross-site scripting (XSS) vulnerability via the Edit Contact function. magnolia-cms · magnolia cms | Medium 6.1 | 53% | 1 exploit | |
| CVE-2022-2230 | A Stored Cross-Site Scripting vulnerability in the project settings page in GitLab CE/EE affecting all versions from 14.4 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1, allows an attacker to execute arbitrary JavaScript code in GitLab on a victim's behalf. gitlab · gitlab | Medium 4.8 | 57% | · | |
| CVE-2022-26135 | A vulnerability in Mobile Plugin for Jira Data Center and Server allows a remote, authenticated user (including a user who joined via the sign-up feature) to perform a full read server-side request forgery via a batch endpoint. atlassian · jira data center | Medium 6.5 | 72% | · | |
| CVE-2022-34783 | Cross-site Scripting in Jenkins Plot Plugin jenkins · plot | Medium 5.4 | 81% | · | |
| CVE-2022-34777 | Cross-site Scripting in Jenkins GitLab Plugin jenkins · gitlab | Medium 5.4 | 73% | · | |
| CVE-2022-34176 | Cross-site Scripting in Jenkins JUnit Plugin jenkins · junit | Medium 5.4 | 77% | · | |
| CVE-2021-34429 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. eclipse · jetty | Medium 5.3 | 99% | 1 exploit | |
| CVE-2022-1707 | Google Tag Manager for WordPress <= 1.15 - Reflected Cross-Site Scripting via Site Search gtm4wp · google tag manager | Medium 6.1 | 89% | · | |
| CVE-2022-31470 | An XSS vulnerability in the index_mobile_changepass.hsp reset-password section of Axigen Mobile WebMail before 10.2.3.12 and 10.3.x before 10.3.3.47 allows attackers to run arbitrary Javascript code that, using an active end-user session (for a logged-in user), can access and… axigen · axigen mobile webmail | Medium 6.1 | 53% | 1 exploit | |
| CVE-2022-25772 | Cross-site Scripting vulnerability in Mautic's tracking pixel functionality acquia · mautic | Medium 6.1 | 62% | · | |
| CVE-2021-27907 | Apache Superset Stored XSS on Dashboard markdown apache · superset | Medium 5.4 | 86% | · | |
| CVE-2019-10405 | Exposure of Sensitive Information to an Unauthorized Actor in Jenkins jenkins · jenkins | Medium 5.4 | 65% | · |
Showing 101–150 of 780
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.