Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2020-13851High 8.8Artica Pandora FMS 7.44 allows remote command execution via the events feature.pandorafms · pandora fmsEPSS91%2 exploitsPublished Jun 11, 2020
- CVE-2014-0114High 7.5Arbitrary code execution in Apache Commons BeanUtilsapache · commons beanutilsEPSS99%2 exploitsPublished Jun 10, 2020
- CVE-2020-1313High 7.8An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka 'Windows Update Orchestrator Service Elevation of Privilege Vulnerability'.microsoft · windows 10EPSS39%2 exploitsPublished Jun 9, 2020
- CVE-2020-1300High 8.8A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability, an attacker would have to convince a user to either open a specially crafted cabinet file or spoof a network printer and trick a user into…microsoft · windows 10EPSS59%·Published Jun 9, 2020
- CVE-2020-1181High 8.8A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'.microsoft · sharepoint serverEPSS69%·Published Jun 9, 2020
- CVE-2020-10644High 7.5The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information.inductiveautomation · ignition gatewayEPSS20%1 exploitPublished Jun 9, 2020
- CVE-2020-13160Critical 9.8AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution.anydesk · anydeskEPSS81%4 exploitsPublished Jun 9, 2020
- CVE-2020-12800Critical 9.8The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file.codedropz · drag and drop multiple file upload - contact form 7EPSS79%2 exploitsPublished Jun 8, 2020
- CVE-2020-5405Medium 6.5Directory traversal attack in Spring Cloud Configvmware · spring cloud configEPSS69%·Published Jun 5, 2020
- CVE-2020-10546Critical 9.8rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection.rconfig · rconfigEPSS87%1 exploitPublished Jun 4, 2020
- CVE-2020-7115Critical 9.8The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass.arubanetworks · clearpass policy managerEPSS65%2 exploitsPublished Jun 3, 2020
- CVE-2020-8606Critical 9.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance.trendmicro · interscan web security virtual applianceEPSS73%3 exploitsPublished May 27, 2020
- CVE-2020-8605High 8.8A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations.trendmicro · interscan web security virtual applianceEPSS88%4 exploitsPublished May 27, 2020
- CVE-2020-8604High 7.5A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations.trendmicro · interscan web security virtual applianceEPSS90%3 exploitsPublished May 27, 2020
- CVE-2020-9484High 7.0Potential remote code execution in Apache Tomcatapache · tomcatEPSS56%·Published May 21, 2020
- CVE-2020-13167Critical 9.8Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters.netsweeper · netsweeperEPSS95%1 exploitPublished May 19, 2020
- CVE-2020-13166Critical 9.8The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code.mylittletools · mylittleadminEPSS78%3 exploitsPublished May 19, 2020
- CVE-2020-8617Medium 5.9Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.isc · bindEPSS93%1 exploitPublished May 19, 2020
- CVE-2020-12256Medium 5.4rConfig 3.9.4 is vulnerable to reflected XSS.rconfig · rconfigEPSS96%1 exploitPublished May 18, 2020
- CVE-2020-12255High 8.8rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality.rconfig · rconfigEPSS53%·Published May 18, 2020
- CVE-2020-12259Medium 5.4rConfig 3.9.4 is vulnerable to reflected XSS.rconfig · rconfigEPSS96%·Published May 18, 2020
- CVE-2020-11108High 8.8The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files.pi-hole · pi-holeEPSS78%8 exploitsPublished May 11, 2020
- CVE-2020-9315High 7.5PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys.oracle · iplanet web serverEPSS82%·Published May 10, 2020
- CVE-2020-11532Critical 9.8Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server.zohocorp · manageengine datasecurity plusEPSS77%1 exploitPublished May 8, 2020
- CVE-2020-11530Critical 9.8A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin.idangero · chop sliderEPSS96%3 exploitsPublished May 8, 2020
- CVE-2020-12720Critical 9.8vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control.vbulletin · vbulletinEPSS89%1 exploitPublished May 7, 2020
- CVE-2020-4429Critical 9.8IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account.ibm · data risk managerEPSS72%2 exploitsPublished May 7, 2020
- CVE-2020-12116High 7.5Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request.zohocorp · manageengine opmanagerEPSS97%·Published May 7, 2020
- CVE-2020-3187Critical 9.1A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to…cisco · firepower threat defenseEPSS97%2 exploitsPublished May 6, 2020
- CVE-2020-12109High 8.8Certain TP-Link devices allow Command Injection.tp-link · nc200 firmwareEPSS74%3 exploitsPublished May 4, 2020
- CVE-2020-7351High 8.8An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user.netfortris · trixboxEPSS65%2 exploitsPublished May 1, 2020
- CVE-2020-7136Critical 9.8A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access.hpe · smart update managerEPSS81%·Published Apr 30, 2020
- CVE-2020-11022Medium 6.1Potential XSS vulnerability in jQueryjquery · jqueryEPSS99%2 exploitsPublished Apr 29, 2020
- CVE-2019-5620Critical 9.8ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function.hitachienergy · microscada pro sys600EPSS71%1 exploitPublished Apr 29, 2020
- CVE-2020-9294Critical 9.8An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface.fortinet · fortimailEPSS78%·Published Apr 27, 2020
- CVE-2020-10915Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.veeam · oneEPSS87%1 exploitPublished Apr 22, 2020
- CVE-2020-10914Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587.veeam · oneEPSS48%1 exploitPublished Apr 22, 2020
- CVE-2020-11946High 7.5Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call.zohocorp · manageengine opmanagerEPSS52%·Published Apr 20, 2020
- CVE-2020-3251High 8.8Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.cisco · ucs directorEPSS62%·Published Apr 15, 2020
- CVE-2020-3250Critical 9.8Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.cisco · ucs directorEPSS61%1 exploitPublished Apr 15, 2020
- CVE-2020-3248Critical 9.8Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.cisco · ucs directorEPSS74%·Published Apr 15, 2020
- CVE-2020-3247Critical 9.8Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.cisco · ucs directorEPSS76%·Published Apr 15, 2020
- CVE-2020-3243Critical 9.8Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.cisco · ucs directorEPSS88%1 exploitPublished Apr 15, 2020
- CVE-2020-3239High 8.8Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device.cisco · ucs directorEPSS74%·Published Apr 15, 2020
- CVE-2020-2950Critical 9.8Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition.oracle · business intelligenceEPSS71%·Published Apr 15, 2020
- CVE-2020-2871High 8.2Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony.oracle · advanced outbound telephonyEPSS66%·Published Apr 15, 2020
- CVE-2020-2854High 8.2Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony.oracle · advanced outbound telephonyEPSS66%·Published Apr 15, 2020
- CVE-2020-2852High 8.2Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony.oracle · advanced outbound telephonyEPSS66%·Published Apr 15, 2020
- CVE-2020-10977Medium 5.5GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.gitlab · gitlabEPSS43%2 exploitsPublished Apr 8, 2020
- CVE-2019-19699High 7.2There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at…centreon · centreonEPSS28%2 exploitsPublished Apr 6, 2020
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-13851 | Artica Pandora FMS 7.44 allows remote command execution via the events feature. pandorafms · pandora fms | High 8.8 | 91% | 2 exploits | |
| CVE-2014-0114 | Arbitrary code execution in Apache Commons BeanUtils apache · commons beanutils | High 7.5 | 99% | 2 exploits | |
| CVE-2020-1313 | An elevation of privilege vulnerability exists when the Windows Update Orchestrator Service improperly handles file operations, aka 'Windows Update Orchestrator Service Elevation of Privilege Vulnerability'. microsoft · windows 10 | High 7.8 | 39% | 2 exploits | |
| CVE-2020-1300 | A remote code execution vulnerability exists when Microsoft Windows fails to properly handle cabinet files.To exploit the vulnerability, an attacker would have to convince a user to either open a specially crafted cabinet file or spoof a network printer and trick a user into… microsoft · windows 10 | High 8.8 | 59% | · | |
| CVE-2020-1181 | A remote code execution vulnerability exists in Microsoft SharePoint Server when it fails to properly identify and filter unsafe ASP.Net web controls, aka 'Microsoft SharePoint Server Remote Code Execution Vulnerability'. microsoft · sharepoint server | High 8.8 | 69% | · | |
| CVE-2020-10644 | The affected product lacks proper validation of user-supplied data, which can result in deserialization of untrusted data on the Ignition 8 Gateway (versions prior to 8.0.10) and Ignition 7 Gateway (versions prior to 7.9.14), allowing an attacker to obtain sensitive information. inductiveautomation · ignition gateway | High 7.5 | 20% | 1 exploit | |
| CVE-2020-13160 | AnyDesk before 5.5.3 on Linux and FreeBSD has a format string vulnerability that can be exploited for remote code execution. anydesk · anydesk | Critical 9.8 | 81% | 4 exploits | |
| CVE-2020-12800 | The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supported_type to php% and uploading a .php% file. codedropz · drag and drop multiple file upload - contact form 7 | Critical 9.8 | 79% | 2 exploits | |
| CVE-2020-5405 | Directory traversal attack in Spring Cloud Config vmware · spring cloud config | Medium 6.5 | 69% | · | |
| CVE-2020-10546 | rConfig 3.9.4 and previous versions has unauthenticated compliancepolicies.inc.php SQL injection. rconfig · rconfig | Critical 9.8 | 87% | 1 exploit | |
| CVE-2020-7115 | The ClearPass Policy Manager web interface is affected by a vulnerability that leads to authentication bypass. arubanetworks · clearpass policy manager | Critical 9.8 | 65% | 2 exploits | |
| CVE-2020-8606 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to bypass authentication on affected installations of Trend Micro InterScan Web Security Virtual Appliance. trendmicro · interscan web security virtual appliance | Critical 9.8 | 73% | 3 exploits | |
| CVE-2020-8605 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to execute arbitrary code on affected installations. trendmicro · interscan web security virtual appliance | High 8.8 | 88% | 4 exploits | |
| CVE-2020-8604 | A vulnerability in Trend Micro InterScan Web Security Virtual Appliance 6.5 may allow remote attackers to disclose sensitive informatoin on affected installations. trendmicro · interscan web security virtual appliance | High 7.5 | 90% | 3 exploits | |
| CVE-2020-9484 | Potential remote code execution in Apache Tomcat apache · tomcat | High 7.0 | 56% | · | |
| CVE-2020-13167 | Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php (with certain Referer headers) launches a command line with client-supplied parameters, and allows injection of shell metacharacters. netsweeper · netsweeper | Critical 9.8 | 95% | 1 exploit | |
| CVE-2020-13166 | The management tool in MyLittleAdmin 3.8 allows remote attackers to execute arbitrary code because machineKey is hardcoded (the same for all customers' installations) in web.config, and can be used to send serialized ASP code. mylittletools · mylittleadmin | Critical 9.8 | 78% | 3 exploits | |
| CVE-2020-8617 | Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. isc · bind | Medium 5.9 | 93% | 1 exploit | |
| CVE-2020-12256 | rConfig 3.9.4 is vulnerable to reflected XSS. rconfig · rconfig | Medium 5.4 | 96% | 1 exploit | |
| CVE-2020-12255 | rConfig 3.9.4 is vulnerable to remote code execution due to improper validation in the file upload functionality. rconfig · rconfig | High 8.8 | 53% | · | |
| CVE-2020-12259 | rConfig 3.9.4 is vulnerable to reflected XSS. rconfig · rconfig | Medium 5.4 | 96% | · | |
| CVE-2020-11108 | The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. pi-hole · pi-hole | High 8.8 | 78% | 8 exploits | |
| CVE-2020-9315 | PRODUCT NOT SUPPORTED WHEN ASSIGNED Oracle iPlanet Web Server 7.0.x has Incorrect Access Control for admingui/version URIs in the Administration console, as demonstrated by unauthenticated read access to encryption keys. oracle · iplanet web server | High 7.5 | 82% | · | |
| CVE-2020-11532 | Zoho ManageEngine DataSecurity Plus prior to 6.0.1 uses default admin credentials to communicate with a DataEngine Xnode server. zohocorp · manageengine datasecurity plus | Critical 9.8 | 77% | 1 exploit | |
| CVE-2020-11530 | A blind SQL injection vulnerability is present in Chop Slider 3, a WordPress plugin. idangero · chop slider | Critical 9.8 | 96% | 3 exploits | |
| CVE-2020-12720 | vBulletin before 5.5.6pl1, 5.6.0 before 5.6.0pl1, and 5.6.1 before 5.6.1pl1 has incorrect access control. vbulletin · vbulletin | Critical 9.8 | 89% | 1 exploit | |
| CVE-2020-4429 | IBM Data Risk Manager 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, and 2.0.6 contains a default password for an IDRM administrative account. ibm · data risk manager | Critical 9.8 | 72% | 2 exploits | |
| CVE-2020-12116 | Zoho ManageEngine OpManager Stable build before 124196 and Released build before 125125 allows an unauthenticated attacker to read arbitrary files on the server by sending a crafted request. zohocorp · manageengine opmanager | High 7.5 | 97% | · | |
| CVE-2020-3187 | A vulnerability in the web services interface of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to conduct directory traversal attacks and obtain read and delete access to… cisco · firepower threat defense | Critical 9.1 | 97% | 2 exploits | |
| CVE-2020-12109 | Certain TP-Link devices allow Command Injection. tp-link · nc200 firmware | High 8.8 | 74% | 3 exploits | |
| CVE-2020-7351 | An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the "asterisk" user. netfortris · trixbox | High 8.8 | 65% | 2 exploits | |
| CVE-2020-7136 | A security vulnerability in HPE Smart Update Manager (SUM) prior to version 8.5.6 could allow remote unauthorized access. hpe · smart update manager | Critical 9.8 | 81% | · | |
| CVE-2020-11022 | Potential XSS vulnerability in jQuery jquery · jquery | Medium 6.1 | 99% | 2 exploits | |
| CVE-2019-5620 | ABB MicroSCADA Pro SYS600 version 9.3 suffers from an instance of CWE-306: Missing Authentication for Critical Function. hitachienergy · microscada pro sys600 | Critical 9.8 | 71% | 1 exploit | |
| CVE-2020-9294 | An improper authentication vulnerability in FortiMail 5.4.10, 6.0.7, 6.2.2 and earlier and FortiVoiceEntreprise 6.0.0 and 6.0.1 may allow a remote unauthenticated attacker to access the system as a legitimate user by requesting a password change via the user interface. fortinet · fortimail | Critical 9.8 | 78% | · | |
| CVE-2020-10915 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. veeam · one | Critical 9.8 | 87% | 1 exploit | |
| CVE-2020-10914 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of VEEAM One Agent 9.5.4.4587. veeam · one | Critical 9.8 | 48% | 1 exploit | |
| CVE-2020-11946 | Zoho ManageEngine OpManager before 125120 allows an unauthenticated user to retrieve an API key via a servlet call. zohocorp · manageengine opmanager | High 7.5 | 52% | · | |
| CVE-2020-3251 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. cisco · ucs director | High 8.8 | 62% | · | |
| CVE-2020-3250 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. cisco · ucs director | Critical 9.8 | 61% | 1 exploit | |
| CVE-2020-3248 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. cisco · ucs director | Critical 9.8 | 74% | · | |
| CVE-2020-3247 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. cisco · ucs director | Critical 9.8 | 76% | · | |
| CVE-2020-3243 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. cisco · ucs director | Critical 9.8 | 88% | 1 exploit | |
| CVE-2020-3239 | Multiple vulnerabilities in the REST API of Cisco UCS Director and Cisco UCS Director Express for Big Data may allow a remote attacker to bypass authentication or conduct directory traversal attacks on an affected device. cisco · ucs director | High 8.8 | 74% | · | |
| CVE-2020-2950 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Business Intelligence Enterprise Edition. oracle · business intelligence | Critical 9.8 | 71% | · | |
| CVE-2020-2871 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. oracle · advanced outbound telephony | High 8.2 | 66% | · | |
| CVE-2020-2854 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. oracle · advanced outbound telephony | High 8.2 | 66% | · | |
| CVE-2020-2852 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Advanced Outbound Telephony. oracle · advanced outbound telephony | High 8.2 | 66% | · | |
| CVE-2020-10977 | GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects. gitlab · gitlab | Medium 5.5 | 43% | 2 exploits | |
| CVE-2019-19699 | There is Authenticated remote code execution in Centreon Infrastructure Monitoring Software through 19.10 via Pollers misconfiguration, leading to system compromise via apache crontab misconfiguration, This allows the apache user to modify an executable file executed by root at… centreon · centreon | High 7.2 | 28% | 2 exploits |
Showing 1,601–1,650 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.