Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2020-35848Critical 9.8Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function.agentejo · cockpitEPSS75%2 exploitsPublished Dec 29, 2020
- CVE-2020-35847Critical 9.8Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function.agentejo · cockpitEPSS98%4 exploitsPublished Dec 29, 2020
- CVE-2020-35846Critical 9.8Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function.agentejo · cockpitEPSS93%2 exploitsPublished Dec 29, 2020
- CVE-2020-35729Critical 9.8KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.klogserver · klog serverEPSS88%8 exploitsPublished Dec 27, 2020
- CVE-2020-28188Critical 9.8Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter.terra-master · tosEPSS96%1 exploitPublished Dec 24, 2020
- CVE-2020-35665Critical 9.8An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation.terra-master · terramaster operating systemEPSS78%2 exploitsPublished Dec 23, 2020
- CVE-2020-13557High 8.8A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527.foxitsoftware · foxit readerEPSS70%·Published Dec 22, 2020
- CVE-2020-26258High 7.7Server-Side Forgery Request can be activated unmarshalling with XStreamxstream · xstreamEPSS82%·Published Dec 21, 2020
- CVE-2020-7200Critical 9.8A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6.hp · systems insight managerEPSS82%2 exploitsPublished Dec 18, 2020
- CVE-2020-8466Critical 9.8A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password.trendmicro · interscan web security virtual applianceEPSS64%·Published Dec 17, 2020
- CVE-2020-35489Critical 10.0The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters.rocklobster · contact form 7EPSS89%·Published Dec 17, 2020
- CVE-2020-35234High 7.5The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020.wp-ecommerce · easy wp smtpEPSS60%·Published Dec 14, 2020
- CVE-2020-25110Critical 9.8The length byte of a domain name in a DNS query/response is not checked, and is used for internal memory operations.ethernut · nut\/osEPSS54%·Published Dec 11, 2020
- CVE-2020-25109Critical 9.8The number of DNS queries/responses (set in a DNS header) is not checked against the data present.ethernut · nut\/osEPSS54%·Published Dec 11, 2020
- CVE-2020-25108Critical 9.8The DNS response data length is not checked (it can be set to an arbitrary value from a packet).ethernut · nut\/osEPSS54%·Published Dec 11, 2020
- CVE-2020-25107Critical 9.8There is no check on whether a domain name has '\0' termination.ethernut · nut\/osEPSS54%·Published Dec 11, 2020
- CVE-2020-24336Critical 9.8The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane.contiki-ng · contiki-ngEPSS59%·Published Dec 11, 2020
- CVE-2020-3495High 8.8A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code.cisco · jabberEPSS61%·Published Dec 11, 2020
- CVE-2020-17143High 8.8Microsoft Exchange Server Information Disclosure Vulnerabilitymicrosoft · exchange serverEPSS71%·Published Dec 9, 2020
- CVE-2020-17132Critical 9.1Microsoft Exchange Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS90%1 exploitPublished Dec 9, 2020
- CVE-2020-26950High 8.8In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition.mozilla · firefoxEPSS42%2 exploitsPublished Dec 9, 2020
- CVE-2020-29597Critical 9.8IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability.incomcms project · incomcmsEPSS71%3 exploitsPublished Dec 7, 2020
- CVE-2020-13945Medium 6.5In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.apache · apisixEPSS73%2 exploitsPublished Dec 7, 2020
- CVE-2020-11984Critical 9.8Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCEapache · http serverEPSS90%1 exploitPublished Dec 4, 2020
- CVE-2020-11993High 7.5Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools.apache · http serverEPSS56%1 exploitPublished Dec 4, 2020
- CVE-2020-29279Critical 9.8PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution.74cms · 74cmsEPSS53%1 exploitPublished Dec 2, 2020
- CVE-2020-28579High 8.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.trendmicro · interscan web security virtual applianceEPSS51%·Published Nov 18, 2020
- CVE-2020-28578Critical 9.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges.trendmicro · interscan web security virtual applianceEPSS73%·Published Nov 18, 2020
- CVE-2020-27131Critical 9.8Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device.cisco · security managerEPSS88%·Published Nov 17, 2020
- CVE-2020-27130Critical 9.1A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information.cisco · security managerEPSS66%·Published Nov 17, 2020
- CVE-2020-26217High 8.8XStream can be used for Remote Code Executionxstream · xstreamEPSS85%·Published Nov 16, 2020
- CVE-2020-27988Medium 5.4Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).nagios · nagios xiEPSS91%·Published Nov 16, 2020
- CVE-2020-13638Critical 9.8lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation.rconfig · rconfigEPSS77%·Published Nov 13, 2020
- CVE-2020-24719Critical 9.8Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack.couchbase · couchbase serverEPSS23%1 exploitPublished Nov 12, 2020
- CVE-2020-27386High 8.8An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using…flexdotnetcms project · flexdotnetcmsEPSS73%1 exploitPublished Nov 12, 2020
- CVE-2020-28347Critical 9.8tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter.tp-link · ac1750 firmwareEPSS75%5 exploitsPublished Nov 8, 2020
- CVE-2020-26214Critical 9.3LDAP authentication bypass with empty passwordalerta project · alertaEPSS66%·Published Nov 6, 2020
- CVE-2020-28328High 8.8SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting.salesagility · suitecrmEPSS63%6 exploitsPublished Nov 6, 2020
- CVE-2020-27128Medium 6.5A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system.cisco · sd-wanEPSS61%·Published Nov 6, 2020
- CVE-2020-24435High 7.8Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the…adobe · acrobatEPSS53%·Published Nov 5, 2020
- CVE-2020-24881Critical 9.8SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning.enhancesoft · osticketEPSS73%2 exploitsPublished Nov 2, 2020
- CVE-2020-7384High 7.8Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.rapid7 · metasploitEPSS30%4 exploitsPublished Oct 29, 2020
- CVE-2020-11854Critical 9.8Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance…microfocus · application performance managementEPSS74%1 exploitPublished Oct 27, 2020
- CVE-2020-11853High 8.8Arbitrary code execution vulnerability affecting multiple Micro Focus products.microfocus · application performance managementEPSS77%2 exploitsPublished Oct 22, 2020
- CVE-2020-27615Critical 9.8The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip.loginizer · loginizerEPSS52%·Published Oct 21, 2020
- CVE-2020-14841Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS52%·Published Oct 21, 2020
- CVE-2020-5792High 7.2Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user.nagios · nagios xiEPSS59%2 exploitsPublished Oct 20, 2020
- CVE-2020-6308Medium 5.3SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally.sap · businessobjects business intelligence platformEPSS62%·Published Oct 20, 2020
- CVE-2020-16952High 7.8A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package.microsoft · sharepoint serverEPSS71%2 exploitsPublished Oct 16, 2020
- CVE-2020-15867High 7.2The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution.gogs · gogsEPSS87%2 exploitsPublished Oct 16, 2020
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-35848 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php newpassword function. agentejo · cockpit | Critical 9.8 | 75% | 2 exploits | |
| CVE-2020-35847 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php resetpassword function. agentejo · cockpit | Critical 9.8 | 98% | 4 exploits | |
| CVE-2020-35846 | Agentejo Cockpit before 0.11.2 allows NoSQL injection via the Controller/Auth.php check function. agentejo · cockpit | Critical 9.8 | 93% | 2 exploits | |
| CVE-2020-35729 | KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter. klogserver · klog server | Critical 9.8 | 88% | 8 exploits | |
| CVE-2020-28188 | Remote Command Execution (RCE) vulnerability in TerraMaster TOS <= 4.2.06 allow remote unauthenticated attackers to inject OS commands via /include/makecvs.php in Event parameter. terra-master · tos | Critical 9.8 | 96% | 1 exploit | |
| CVE-2020-35665 | An unauthenticated command-execution vulnerability exists in TerraMaster TOS through 4.2.06 via shell metacharacters in the Event parameter in include/makecvs.php during CSV creation. terra-master · terramaster operating system | Critical 9.8 | 78% | 2 exploits | |
| CVE-2020-13557 | A use after free vulnerability exists in the JavaScript engine of Foxit Software’s Foxit PDF Reader, version 10.1.0.37527. foxitsoftware · foxit reader | High 8.8 | 70% | · | |
| CVE-2020-26258 | Server-Side Forgery Request can be activated unmarshalling with XStream xstream · xstream | High 7.7 | 82% | · | |
| CVE-2020-7200 | A potential security vulnerability has been identified in HPE Systems Insight Manager (SIM) version 7.6. hp · systems insight manager | Critical 9.8 | 82% | 2 exploits | |
| CVE-2020-8466 | A command injection vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2, with the improved password hashing method enabled, could allow an unauthenticated attacker to execute certain commands by providing a manipulated password. trendmicro · interscan web security virtual appliance | Critical 9.8 | 64% | · | |
| CVE-2020-35489 | The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters. rocklobster · contact form 7 | Critical 10.0 | 89% | · | |
| CVE-2020-35234 | The easy-wp-smtp plugin before 1.4.4 for WordPress allows Administrator account takeover, as exploited in the wild in December 2020. wp-ecommerce · easy wp smtp | High 7.5 | 60% | · | |
| CVE-2020-25110 | The length byte of a domain name in a DNS query/response is not checked, and is used for internal memory operations. ethernut · nut\/os | Critical 9.8 | 54% | · | |
| CVE-2020-25109 | The number of DNS queries/responses (set in a DNS header) is not checked against the data present. ethernut · nut\/os | Critical 9.8 | 54% | · | |
| CVE-2020-25108 | The DNS response data length is not checked (it can be set to an arbitrary value from a packet). ethernut · nut\/os | Critical 9.8 | 54% | · | |
| CVE-2020-25107 | There is no check on whether a domain name has '\0' termination. ethernut · nut\/os | Critical 9.8 | 54% | · | |
| CVE-2020-24336 | The code for parsing Type A domain name answers in ip64-dns64.c doesn't verify whether the address in the answer's length is sane. contiki-ng · contiki-ng | Critical 9.8 | 59% | · | |
| CVE-2020-3495 | A vulnerability in Cisco Jabber for Windows could allow an authenticated, remote attacker to execute arbitrary code. cisco · jabber | High 8.8 | 61% | · | |
| CVE-2020-17143 | Microsoft Exchange Server Information Disclosure Vulnerability microsoft · exchange server | High 8.8 | 71% | · | |
| CVE-2020-17132 | Microsoft Exchange Remote Code Execution Vulnerability microsoft · exchange server | Critical 9.1 | 90% | 1 exploit | |
| CVE-2020-26950 | In certain circumstances, the MCallGetProperty opcode can be emitted with unmet assumptions resulting in an exploitable use-after-free condition. mozilla · firefox | High 8.8 | 42% | 2 exploits | |
| CVE-2020-29597 | IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. incomcms project · incomcms | Critical 9.8 | 71% | 3 exploits | |
| CVE-2020-13945 | In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. apache · apisix | Medium 6.5 | 73% | 2 exploits | |
| CVE-2020-11984 | Apache HTTP server 2.4.32 to 2.4.44 mod_proxy_uwsgi info disclosure and possible RCE apache · http server | Critical 9.8 | 90% | 1 exploit | |
| CVE-2020-11993 | Apache HTTP Server versions 2.4.20 to 2.4.43 When trace/debug was enabled for the HTTP/2 module and on certain traffic edge patterns, logging statements were made on the wrong connection, causing concurrent use of memory pools. apache · http server | High 7.5 | 56% | 1 exploit | |
| CVE-2020-29279 | PHP remote file inclusion in the assign_resume_tpl method in Application/Common/Controller/BaseController.class.php in 74CMS before 6.0.48 allows remote code execution. 74cms · 74cms | Critical 9.8 | 53% | 1 exploit | |
| CVE-2020-28579 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. trendmicro · interscan web security virtual appliance | High 8.8 | 51% | · | |
| CVE-2020-28578 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an unauthenticated, remote attacker to send a specially crafted HTTP message and achieve remote code execution with elevated privileges. trendmicro · interscan web security virtual appliance | Critical 9.8 | 73% | · | |
| CVE-2020-27131 | Multiple vulnerabilities in the Java deserialization function that is used by Cisco Security Manager could allow an unauthenticated, remote attacker to execute arbitrary commands on an affected device. cisco · security manager | Critical 9.8 | 88% | · | |
| CVE-2020-27130 | A vulnerability in Cisco Security Manager could allow an unauthenticated, remote attacker to gain access to sensitive information. cisco · security manager | Critical 9.1 | 66% | · | |
| CVE-2020-26217 | XStream can be used for Remote Code Execution xstream · xstream | High 8.8 | 85% | · | |
| CVE-2020-27988 | Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). nagios · nagios xi | Medium 5.4 | 91% | · | |
| CVE-2020-13638 | lib/crud/userprocess.php in rConfig 3.9.x before 3.9.7 has an authentication bypass, leading to administrator account creation. rconfig · rconfig | Critical 9.8 | 77% | · | |
| CVE-2020-24719 | Exposed Erlang Cookie could lead to Remote Command Execution (RCE) attack. couchbase · couchbase server | Critical 9.8 | 23% | 1 exploit | |
| CVE-2020-27386 | An unrestricted file upload issue in FlexDotnetCMS before v1.5.9 allows an authenticated remote attacker to upload and execute arbitrary files by using the FileManager to upload malicious code (e.g., ASP code) in the form of a safe file type (e.g., a TXT file), and then using… flexdotnetcms project · flexdotnetcms | High 8.8 | 73% | 1 exploit | |
| CVE-2020-28347 | tdpServer on TP-Link Archer A7 AC1750 devices before 201029 allows remote attackers to execute arbitrary code via the slave_mac parameter. tp-link · ac1750 firmware | Critical 9.8 | 75% | 5 exploits | |
| CVE-2020-26214 | LDAP authentication bypass with empty password alerta project · alerta | Critical 9.3 | 66% | · | |
| CVE-2020-28328 | SuiteCRM before 7.11.17 is vulnerable to remote code execution via the system settings Log File Name setting. salesagility · suitecrm | High 8.8 | 63% | 6 exploits | |
| CVE-2020-27128 | A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. cisco · sd-wan | Medium 6.5 | 61% | · | |
| CVE-2020-24435 | Acrobat Reader DC versions 2020.012.20048 (and earlier), 2020.001.30005 (and earlier) and 2017.011.30175 (and earlier) are affected by a heap-based buffer overflow vulnerability in the submitForm function, potentially resulting in arbitrary code execution in the context of the… adobe · acrobat | High 7.8 | 53% | · | |
| CVE-2020-24881 | SSRF exists in osTicket before 1.14.3, where an attacker can add malicious file to server or perform port scanning. enhancesoft · osticket | Critical 9.8 | 73% | 2 exploits | |
| CVE-2020-7384 | Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine. rapid7 · metasploit | High 7.8 | 30% | 4 exploits | |
| CVE-2020-11854 | Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) vulnerability in Micro Focus products products Operation Bridge Manager, Operation Bridge (containerized) and Application Performance… microfocus · application performance management | Critical 9.8 | 74% | 1 exploit | |
| CVE-2020-11853 | Arbitrary code execution vulnerability affecting multiple Micro Focus products. microfocus · application performance management | High 8.8 | 77% | 2 exploits | |
| CVE-2020-27615 | The Loginizer plugin before 1.6.4 for WordPress allows SQL injection (with resultant XSS), related to loginizer_login_failed and lz_valid_ip. loginizer · loginizer | Critical 9.8 | 52% | · | |
| CVE-2020-14841 | Easily exploitable vulnerability allows unauthenticated attacker with network access via IIOP to compromise Oracle WebLogic Server. oracle · weblogic server | Critical 9.8 | 52% | · | |
| CVE-2020-5792 | Improper neutralization of argument delimiters in a command in Nagios XI 5.7.3 allows a remote, authenticated admin user to write to arbitrary files and ultimately execute code with the privileges of the apache user. nagios · nagios xi | High 7.2 | 59% | 2 exploits | |
| CVE-2020-6308 | SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. sap · businessobjects business intelligence platform | Medium 5.3 | 62% | · | |
| CVE-2020-16952 | A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package. microsoft · sharepoint server | High 7.8 | 71% | 2 exploits | |
| CVE-2020-15867 | The git hook feature in Gogs 0.5.5 through 0.12.2 allows for authenticated remote code execution. gogs · gogs | High 7.2 | 87% | 2 exploits |
Showing 1,501–1,550 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.