Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2019-17444Critical 9.8Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them.jfrog · artifactoryEPSS69%·Published Oct 12, 2020
- CVE-2020-8821Medium 5.4An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint.webmin · webminEPSS79%·Published Oct 12, 2020
- CVE-2020-26948Critical 9.8Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter.emby · embyEPSS87%·Published Oct 10, 2020
- CVE-2020-13340High 8.7An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Loggitlab · gitlabEPSS67%·Published Oct 8, 2020
- CVE-2020-4280High 8.8IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function.ibm · qradar security information and event managerEPSS73%1 exploitPublished Oct 8, 2020
- CVE-2020-15175Critical 9.1In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin.glpi-project · glpiEPSS72%·Published Oct 7, 2020
- CVE-2020-26124High 8.8openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc.openmediavault · openmediavaultEPSS67%2 exploitsPublished Oct 2, 2020
- CVE-2020-12124Critical 9.8A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.wavlink · wn530h4 firmwareEPSS75%·Published Oct 2, 2020
- CVE-2020-36708Critical 9.8Epsilon Framework Themes (Various Versions) - Function Injectioncolorlib · activelloEPSS65%·Published Sep 30, 2020
- CVE-2020-14179Medium 5.3Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint.atlassian · jira serverEPSS76%·Published Sep 20, 2020
- CVE-2020-11698Critical 9.8Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to inject commands into the file snmpd.conf that would allow executing commands on the target server.titanhq · spamtitanEPSS73%4 exploitsPublished Sep 17, 2020
- CVE-2020-6113High 7.8An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table.gonitro · nitro proEPSS64%·Published Sep 17, 2020
- CVE-2020-14181Medium 5.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint.atlassian · data centerEPSS100%2 exploitsPublished Sep 16, 2020
- CVE-2020-6146High 8.8An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300.gonitro · nitro proEPSS75%·Published Sep 16, 2020
- CVE-2020-15148Critical 10.0Unsafe deserialization in Yii 2yiiframework · yiiEPSS78%·Published Sep 15, 2020
- CVE-2020-16875High 7.2A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.microsoft · exchange serverEPSS46%2 exploitsPublished Sep 11, 2020
- CVE-2020-11991High 7.5When using the StreamGenerator, the code parse a user-provided XML.apache · cocoonEPSS72%·Published Sep 11, 2020
- CVE-2020-17408High 7.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1.nec · expresscluster xEPSS69%·Published Sep 10, 2020
- CVE-2020-2038High 7.2An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges.paloaltonetworks · pan-osEPSS86%4 exploitsPublished Sep 9, 2020
- CVE-2020-24949High 8.8Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE).php-fusion · php-fusionEPSS68%3 exploitsPublished Sep 3, 2020
- CVE-2020-15643High 8.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64.marvell · qconvergeconsoleEPSS59%·Published Aug 25, 2020
- CVE-2020-24186Critical 10.0A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action.gvectors · wpdiscuzEPSS95%6 exploitsPublished Aug 24, 2020
- CVE-2020-17456Critical 9.8SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page.seowonintech · slc-130 firmwareEPSS74%1 exploitPublished Aug 19, 2020
- CVE-2020-16205High 7.2Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5).geutebrueck · g-cam ebc-2110 firmwareEPSS61%2 exploitsPublished Aug 14, 2020
- CVE-2020-16139High 7.5A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely through sending specially crafted packets.cisco · unified ip conference station 7937g firmwareEPSS80%1 exploitPublished Aug 12, 2020
- CVE-2020-17506Critical 9.8Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php.articatech · web proxyEPSS94%4 exploitsPublished Aug 12, 2020
- CVE-2020-17505High 8.8Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php.articatech · web proxyEPSS82%2 exploitsPublished Aug 12, 2020
- CVE-2020-7357Critical 9.9Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials.cayintech · cmsEPSS32%1 exploitPublished Aug 6, 2020
- CVE-2020-13151Critical 9.8Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query.aerospike · aerospike serverEPSS87%4 exploitsPublished Aug 5, 2020
- CVE-2020-15419High 7.5This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415.veeam · one firmwareEPSS60%·Published Jul 28, 2020
- CVE-2020-10924High 8.8This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers.netgear · r6700 firmwareEPSS87%·Published Jul 28, 2020
- CVE-2020-10923High 8.8This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers.netgear · r6700 firmwareEPSS85%·Published Jul 28, 2020
- CVE-2020-15922Critical 9.8There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges.midasolutions · eframeworkEPSS57%2 exploitsPublished Jul 23, 2020
- CVE-2020-15920Critical 9.8There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges.midasolutions · eframeworkEPSS98%4 exploitsPublished Jul 23, 2020
- CVE-2020-15893Critical 9.8An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02.dlink · dir-816l firmwareEPSS21%1 exploitPublished Jul 22, 2020
- CVE-2020-12028High 8.1In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions.rockwellautomation · factorytalk viewEPSS53%2 exploitsPublished Jul 20, 2020
- CVE-2020-12027Medium 4.3All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system.rockwellautomation · factorytalk viewEPSS53%1 exploitPublished Jul 20, 2020
- CVE-2020-12029High 7.8All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory.rockwellautomation · factorytalk viewEPSS47%2 exploitsPublished Jul 20, 2020
- CVE-2020-9496Medium 6.1XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03apache · ofbizEPSS99%5 exploitsPublished Jul 15, 2020
- CVE-2020-1421High 8.8A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution…microsoft · windows 10EPSS75%·Published Jul 14, 2020
- CVE-2020-15050High 7.5Remote attackers can read arbitrary files from the server via Directory Traversal.supremainc · biostar 2EPSS51%2 exploitsPublished Jul 13, 2020
- CVE-2020-7457High 8.1In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious…freebsd · freebsdEPSS33%2 exploitsPublished Jul 9, 2020
- CVE-2020-8163High 8.8Remote code execution via user-provided local names in ActionViewrubyonrails · railsEPSS82%1 exploitPublished Jul 7, 2020
- CVE-2020-14092Critical 9.8The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection.ithemes · paypal proEPSS95%·Published Jul 2, 2020
- CVE-2020-13383High 7.5openSIS through 7.4 allows Directory Traversal.os4ed · opensisEPSS68%3 exploitsPublished Jul 1, 2020
- CVE-2020-13382Critical 9.1openSIS through 7.4 has Incorrect Access Control.os4ed · opensisEPSS53%3 exploitsPublished Jul 1, 2020
- CVE-2020-13381Critical 9.8openSIS through 7.4 allows SQL Injection.os4ed · opensisEPSS59%2 exploitsPublished Jul 1, 2020
- CVE-2020-13158High 7.5Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter.articatech · artica proxyEPSS54%1 exploitPublished Jun 22, 2020
- CVE-2020-14295High 7.2A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter.cacti · cactiEPSS86%5 exploitsPublished Jun 17, 2020
- CVE-2019-0199High 7.5Apache Tomcat Denial of Service vulnerabilityapache · tomcatEPSS73%·Published Jun 15, 2020
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2019-17444 | Jfrog Artifactory uses default passwords (such as "password") for administrative accounts and does not require users to change them. jfrog · artifactory | Critical 9.8 | 69% | · | |
| CVE-2020-8821 | An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. webmin · webmin | Medium 5.4 | 79% | · | |
| CVE-2020-26948 | Emby Server before 4.5.0 allows SSRF via the Items/RemoteSearch/Image ImageURL parameter. emby · emby | Critical 9.8 | 87% | · | |
| CVE-2020-13340 | An issue has been discovered in GitLab affecting all versions prior to 13.2.10, 13.3.7 and 13.4.2: Stored XSS in CI Job Log gitlab · gitlab | High 8.7 | 67% | · | |
| CVE-2020-4280 | IBM QRadar SIEM 7.3 and 7.4 could allow a remote attacker to execute arbitrary commands on the system, caused by insecure deserialization of user-supplied content by the Java deserialization function. ibm · qradar security information and event manager | High 8.8 | 73% | 1 exploit | |
| CVE-2020-15175 | In GLPI before version 9.5.2, the pluginimage.send.php endpoint allows a user to specify an image from a plugin. glpi-project · glpi | Critical 9.1 | 72% | · | |
| CVE-2020-26124 | openmediavault before 4.1.36 and 5.x before 5.5.12 allows authenticated PHP code injection attacks, via the sortfield POST parameter of rpc.php, because json_encode_safe is not used in config/databasebackend.inc. openmediavault · openmediavault | High 8.8 | 67% | 2 exploits | |
| CVE-2020-12124 | A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication. wavlink · wn530h4 firmware | Critical 9.8 | 75% | · | |
| CVE-2020-36708 | Epsilon Framework Themes (Various Versions) - Function Injection colorlib · activello | Critical 9.8 | 65% | · | |
| CVE-2020-14179 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. atlassian · jira server | Medium 5.3 | 76% | · | |
| CVE-2020-11698 | Improper input sanitization of the parameter community on the page snmp-x.php would allow a remote attacker to inject commands into the file snmpd.conf that would allow executing commands on the target server. titanhq · spamtitan | Critical 9.8 | 73% | 4 exploits | |
| CVE-2020-6113 | An exploitable vulnerability exists in the object stream parsing functionality of Nitro Software, Inc.’s Nitro Pro 13.13.2.242 when updating its cross-reference table. gonitro · nitro pro | High 7.8 | 64% | · | |
| CVE-2020-14181 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. atlassian · data center | Medium 5.3 | 100% | 2 exploits | |
| CVE-2020-6146 | An exploitable code execution vulnerability exists in the rendering functionality of Nitro Pro 13.13.2.242 and 13.16.2.300. gonitro · nitro pro | High 8.8 | 75% | · | |
| CVE-2020-15148 | Unsafe deserialization in Yii 2 yiiframework · yii | Critical 10.0 | 78% | · | |
| CVE-2020-16875 | A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments. microsoft · exchange server | High 7.2 | 46% | 2 exploits | |
| CVE-2020-11991 | When using the StreamGenerator, the code parse a user-provided XML. apache · cocoon | High 7.5 | 72% | · | |
| CVE-2020-17408 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster 4.1. nec · expresscluster x | High 7.5 | 69% | · | |
| CVE-2020-2038 | An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. paloaltonetworks · pan-os | High 7.2 | 86% | 4 exploits | |
| CVE-2020-24949 | Privilege escalation in PHP-Fusion 9.03.50 downloads/downloads.php allows an authenticated user (not admin) to send a crafted request to the server and perform remote command execution (RCE). php-fusion · php-fusion | High 8.8 | 68% | 3 exploits | |
| CVE-2020-15643 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. marvell · qconvergeconsole | High 8.8 | 59% | · | |
| CVE-2020-24186 | A Remote Code Execution vulnerability exists in the gVectors wpDiscuz plugin 7.0 through 7.0.4 for WordPress, which allows unauthenticated users to upload any type of file, including PHP files via the wmuUploadFiles AJAX action. gvectors · wpdiscuz | Critical 10.0 | 95% | 6 exploits | |
| CVE-2020-17456 | SEOWON INTECH SLC-130 And SLR-120S devices allow Remote Code Execution via the ipAddr parameter to the system_log.cgi page. seowonintech · slc-130 firmware | Critical 9.8 | 74% | 1 exploit | |
| CVE-2020-16205 | Using a specially crafted URL command, a remote authenticated user can execute commands as root on the G-Cam and G-Code (Firmware Versions 1.12.0.25 and prior as well as the limited Versions 1.12.13.2 and 1.12.14.5). geutebrueck · g-cam ebc-2110 firmware | High 7.2 | 61% | 2 exploits | |
| CVE-2020-16139 | A denial-of-service in Cisco Unified IP Conference Station 7937G 1-4-4-0 through 1-4-5-7 allows attackers restart the device remotely through sending specially crafted packets. cisco · unified ip conference station 7937g firmware | High 7.5 | 80% | 1 exploit | |
| CVE-2020-17506 | Artica Web Proxy 4.30.00000000 allows remote attacker to bypass privilege detection and gain web backend administrator privileges through SQL injection of the apikey parameter in fw.login.php. articatech · web proxy | Critical 9.8 | 94% | 4 exploits | |
| CVE-2020-17505 | Artica Web Proxy 4.30.000000 allows an authenticated remote attacker to inject commands via the service-cmds parameter in cyrus.php. articatech · web proxy | High 8.8 | 82% | 2 exploits | |
| CVE-2020-7357 | Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. cayintech · cms | Critical 9.9 | 32% | 1 exploit | |
| CVE-2020-13151 | Aerospike Community Edition 4.9.0.5 allows for unauthenticated submission and execution of user-defined functions (UDFs), written in Lua, as part of a database query. aerospike · aerospike server | Critical 9.8 | 87% | 4 exploits | |
| CVE-2020-15419 | This vulnerability allows remote attackers to disclose sensitive information on affected installations of Veeam ONE 10.0.0.750_20200415. veeam · one firmware | High 7.5 | 60% | · | |
| CVE-2020-10924 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. netgear · r6700 firmware | High 8.8 | 87% | · | |
| CVE-2020-10923 | This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of NETGEAR R6700 V1.0.4.84_10.0.58 routers. netgear · r6700 firmware | High 8.8 | 85% | · | |
| CVE-2020-15922 | There is an OS Command Injection in Mida eFramework 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. midasolutions · eframework | Critical 9.8 | 57% | 2 exploits | |
| CVE-2020-15920 | There is an OS Command Injection in Mida eFramework through 2.9.0 that allows an attacker to achieve Remote Code Execution (RCE) with administrative (root) privileges. midasolutions · eframework | Critical 9.8 | 98% | 4 exploits | |
| CVE-2020-15893 | An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. dlink · dir-816l firmware | Critical 9.8 | 21% | 1 exploit | |
| CVE-2020-12028 | In all versions of FactoryTalk View SEA remote, an authenticated attacker may be able to utilize certain handlers to interact with the data on the remote endpoint since those handlers do not enforce appropriate permissions. rockwellautomation · factorytalk view | High 8.1 | 53% | 2 exploits | |
| CVE-2020-12027 | All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. rockwellautomation · factorytalk view | Medium 4.3 | 53% | 1 exploit | |
| CVE-2020-12029 | All versions of FactoryTalk View SE do not properly validate input of filenames within a project directory. rockwellautomation · factorytalk view | High 7.8 | 47% | 2 exploits | |
| CVE-2020-9496 | XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 apache · ofbiz | Medium 6.1 | 99% | 5 exploits | |
| CVE-2020-1421 | A remote code execution vulnerability exists in Microsoft Windows that could allow remote code execution if a .LNK file is processed.An attacker who successfully exploited this vulnerability could gain the same user rights as the local user, aka 'LNK Remote Code Execution… microsoft · windows 10 | High 8.8 | 75% | · | |
| CVE-2020-15050 | Remote attackers can read arbitrary files from the server via Directory Traversal. supremainc · biostar 2 | High 7.5 | 51% | 2 exploits | |
| CVE-2020-7457 | In FreeBSD 12.1-STABLE before r359565, 12.1-RELEASE before p7, 11.4-STABLE before r362975, 11.4-RELEASE before p1, and 11.3-RELEASE before p11, missing synchronization in the IPV6_2292PKTOPTIONS socket option set handler contained a race condition allowing a malicious… freebsd · freebsd | High 8.1 | 33% | 2 exploits | |
| CVE-2020-8163 | Remote code execution via user-provided local names in ActionView rubyonrails · rails | High 8.8 | 82% | 1 exploit | |
| CVE-2020-14092 | The CodePeople Payment Form for PayPal Pro plugin before 1.1.65 for WordPress allows SQL Injection. ithemes · paypal pro | Critical 9.8 | 95% | · | |
| CVE-2020-13383 | openSIS through 7.4 allows Directory Traversal. os4ed · opensis | High 7.5 | 68% | 3 exploits | |
| CVE-2020-13382 | openSIS through 7.4 has Incorrect Access Control. os4ed · opensis | Critical 9.1 | 53% | 3 exploits | |
| CVE-2020-13381 | openSIS through 7.4 allows SQL Injection. os4ed · opensis | Critical 9.8 | 59% | 2 exploits | |
| CVE-2020-13158 | Artica Proxy before 4.30.000000 Community Edition allows Directory Traversal via the fw.progrss.details.php popup parameter. articatech · artica proxy | High 7.5 | 54% | 1 exploit | |
| CVE-2020-14295 | A SQL injection issue in color.php in Cacti 1.2.12 allows an admin to inject SQL via the filter parameter. cacti · cacti | High 7.2 | 86% | 5 exploits | |
| CVE-2019-0199 | Apache Tomcat Denial of Service vulnerability apache · tomcat | High 7.5 | 73% | · |
Showing 1,551–1,600 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.