Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2024-49112Critical 9.8Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS72%·Published Dec 12, 2024
- CVE-2024-53677Critical 9.5Apache Struts file upload logic is flawedapache · strutsEPSS70%·Published Dec 11, 2024
- CVE-2024-49113High 7.5Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerabilitymicrosoft · windows 10 1507EPSS84%·Published Dec 10, 2024
- CVE-2024-11320Medium 6.9Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.pandorafms · pandora fmsEPSS91%1 exploitPublished Nov 29, 2024
- CVE-2024-54003High 8.6Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerabilityjenkins · simple queueEPSS80%·Published Nov 27, 2024
- CVE-2024-42327Critical 9.9A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability.zabbix · zabbixEPSS79%1 exploitPublished Nov 27, 2024
- CVE-2024-53676Critical 9.8A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution.hpe · insight remote supportEPSS56%·Published Nov 26, 2024
- CVE-2024-53675High 7.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.hpe · insight remote supportEPSS84%·Published Nov 26, 2024
- CVE-2024-33610Critical 9.1"sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication.EPSS50%·Published Nov 26, 2024
- CVE-2024-47407Critical 10.0A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.EPSS64%1 exploitPublished Nov 22, 2024
- CVE-2024-10400High 7.5The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.themeum · tutor lmsEPSS83%·Published Nov 21, 2024
- CVE-2024-48990High 7.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.needrestart project · needrestartEPSS21%1 exploitPublished Nov 19, 2024
- CVE-2024-8856Critical 9.8Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Uploadrevmakx · backup and staging by wp time capsuleEPSS94%2 exploitsPublished Nov 18, 2024
- CVE-2024-49754Medium 5.4LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.phplibrenms · librenmsEPSS72%1 exploitPublished Nov 15, 2024
- CVE-2024-10924Critical 9.8Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypassreally-simple-plugins · really simple securityEPSS82%2 exploitsPublished Nov 13, 2024
- CVE-2024-34781High 7.2SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.ivanti · endpoint managerEPSS68%·Published Nov 12, 2024
- CVE-2024-43642High 7.5Windows SMB Denial of Service Vulnerabilitymicrosoft · windows 11 22h2EPSS63%·Published Nov 12, 2024
- CVE-2024-50599Medium 6.1A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints.synacor · zimbra collaboration suiteEPSS64%·Published Nov 7, 2024
- CVE-2024-43425High 9.2Moodle Remote Code Execution vulnerabilitymoodle · moodleEPSS88%2 exploitsPublished Nov 7, 2024
- CVE-2024-10914Critical 9.2It has been declared as critical.dlink · dns-320 firmwareEPSS96%1 exploitPublished Nov 7, 2024
- CVE-2024-10915Critical 9.2It has been rated as critical.dlink · dns-320 firmwareEPSS80%·Published Nov 7, 2024
- CVE-2024-50340Medium 6.9Symfony allows changing the environment through a queryEPSS64%·Published Nov 6, 2024
- CVE-2024-48307High 9.3JeecgBoot SQL Injection vulnerabilityjeecg · jeecg bootEPSS50%1 exploitPublished Oct 31, 2024
- CVE-2024-10525High 7.2In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback.eclipse · mosquittoEPSS59%·Published Oct 30, 2024
- CVE-2024-51568Critical 9.8CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink.cyberpanel · cyberpanelEPSS48%2 exploitsPublished Oct 30, 2024
- CVE-2024-50498Critical 9.8WP Query Console <= 1.0 - Unauthenticated Remote Code Executionlubus · wp query consoleEPSS53%·Published Oct 30, 2024
- CVE-2024-46538Critical 9.3A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php.netgate · pfsenseEPSS80%1 exploitPublished Oct 22, 2024
- CVE-2024-35286Critical 9.8A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input.mitel · micollabEPSS66%·Published Oct 22, 2024
- CVE-2024-37404High 8.8Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution.ivanti · connect secureEPSS71%1 exploitPublished Oct 21, 2024
- CVE-2024-9264Critical 9.4Grafana Command Injection And Local File Inclusion Via Sql Expressionsgrafana · grafanaEPSS97%1 exploitPublished Oct 18, 2024
- CVE-2024-45216Critical 9.3Improper Authentication vulnerability in Apache Solrapache · solrEPSS93%·Published Oct 17, 2024
- CVE-2024-9061Critical 9.8WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Addthemehunk · wp popup builderEPSS52%·Published Oct 17, 2024
- CVE-2024-32651Critical 10.0changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command ExecutionEPSS84%·Published Oct 15, 2024
- CVE-2024-48914Critical 9.1Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategyEPSS60%·Published Oct 15, 2024
- CVE-2024-9047Critical 9.8WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.phpiptanus · wordpress file uploadEPSS93%·Published Oct 14, 2024
- CVE-2024-9916Medium 6.9A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9.usualtool · usualtoolcmsEPSS74%1 exploitPublished Oct 13, 2024
- CVE-2024-9464Critical 9.3An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.paloaltonetworks · expeditionEPSS83%1 exploitPublished Oct 10, 2024
- CVE-2024-47011High 7.5Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive informationivanti · avalancheEPSS56%·Published Oct 9, 2024
- CVE-2024-41163High 7.5A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0.veertu · anka build cloudEPSS52%·Published Oct 3, 2024
- CVE-2024-9441Critical 9.8The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability.EPSS53%·Published Oct 2, 2024
- CVE-2024-5932Critical 9.8GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Executiongivewp · givewpEPSS77%1 exploitPublished Sep 30, 2024
- CVE-2024-8353Critical 9.8GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injectiongivewp · givewpEPSS29%1 exploitPublished Sep 30, 2024
- CVE-2024-47176Medium 5.3cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.openprinting · cups-browsedEPSS51%2 exploitsPublished Sep 26, 2024
- CVE-2024-47175Critical 9.8The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer.openprinting · libppdEPSS64%2 exploitsPublished Sep 26, 2024
- CVE-2024-47076High 8.6The cfGetPrinterAttributes5 function in libcupsfilters does not sanitize IPP attributes returned from an IPP server.openprinting · libcupsfiltersEPSS80%2 exploitsPublished Sep 26, 2024
- CVE-2024-8877Medium 6.9Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204.riello-ups · netman 204 firmwareEPSS77%·Published Sep 25, 2024
- CVE-2024-46982High 8.7Next.js Cache Poisoningvercel · next.jsEPSS59%·Published Sep 17, 2024
- CVE-2024-8522High 7.5LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields'thimpress · learnpressEPSS63%1 exploitPublished Sep 13, 2024
- CVE-2024-37397High 8.2An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets.ivanti · endpoint managerEPSS59%·Published Sep 12, 2024
- CVE-2024-29847Critical 9.8Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.ivanti · endpoint managerEPSS53%·Published Sep 12, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-49112 | Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability microsoft · windows 10 1507 | Critical 9.8 | 72% | · | |
| CVE-2024-53677 | Apache Struts file upload logic is flawed apache · struts | Critical 9.5 | 70% | · | |
| CVE-2024-49113 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability microsoft · windows 10 1507 | High 7.5 | 84% | · | |
| CVE-2024-11320 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. pandorafms · pandora fms | Medium 6.9 | 91% | 1 exploit | |
| CVE-2024-54003 | Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability jenkins · simple queue | High 8.6 | 80% | · | |
| CVE-2024-42327 | A non-admin user account on the Zabbix frontend with the default User role, or with any other role that gives API access can exploit this vulnerability. zabbix · zabbix | Critical 9.9 | 79% | 1 exploit | |
| CVE-2024-53676 | A directory traversal vulnerability in Hewlett Packard Enterprise Insight Remote Support may allow remote code execution. hpe · insight remote support | Critical 9.8 | 56% | · | |
| CVE-2024-53675 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. hpe · insight remote support | High 7.5 | 84% | · | |
| CVE-2024-33610 | "sessionlist.html" and "sys_trayentryreboot.html" are accessible with no authentication. | Critical 9.1 | 50% | · | |
| CVE-2024-47407 | A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands. | Critical 10.0 | 64% | 1 exploit | |
| CVE-2024-10400 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. themeum · tutor lms | High 7.5 | 83% | · | |
| CVE-2024-48990 | Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. needrestart project · needrestart | High 7.8 | 21% | 1 exploit | |
| CVE-2024-8856 | Backup and Staging by WP Time Capsule <= 1.22.21 - Unauthenticated Arbitrary File Upload revmakx · backup and staging by wp time capsule | Critical 9.8 | 94% | 2 exploits | |
| CVE-2024-49754 | LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php librenms · librenms | Medium 5.4 | 72% | 1 exploit | |
| CVE-2024-10924 | Really Simple Security (Free, Pro, and Pro Multisite) 9.0.0 - 9.1.1.1 - Authentication Bypass really-simple-plugins · really simple security | Critical 9.8 | 82% | 2 exploits | |
| CVE-2024-34781 | SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. ivanti · endpoint manager | High 7.2 | 68% | · | |
| CVE-2024-43642 | Windows SMB Denial of Service Vulnerability microsoft · windows 11 22h2 | High 7.5 | 63% | · | |
| CVE-2024-50599 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. synacor · zimbra collaboration suite | Medium 6.1 | 64% | · | |
| CVE-2024-43425 | Moodle Remote Code Execution vulnerability moodle · moodle | High 9.2 | 88% | 2 exploits | |
| CVE-2024-10914 | It has been declared as critical. dlink · dns-320 firmware | Critical 9.2 | 96% | 1 exploit | |
| CVE-2024-10915 | It has been rated as critical. dlink · dns-320 firmware | Critical 9.2 | 80% | · | |
| CVE-2024-50340 | Symfony allows changing the environment through a query | Medium 6.9 | 64% | · | |
| CVE-2024-48307 | JeecgBoot SQL Injection vulnerability jeecg · jeecg boot | High 9.3 | 50% | 1 exploit | |
| CVE-2024-10525 | In Eclipse Mosquitto, from version 1.3.2 through 2.0.18, if a malicious broker sends a crafted SUBACK packet with no reason codes, a client using libmosquitto may make out of bounds memory access when acting in its on_subscribe callback. eclipse · mosquitto | High 7.2 | 59% | · | |
| CVE-2024-51568 | CyberPanel (aka Cyber Panel) before 2.3.5 allows Command Injection via completePath in the ProcessUtilities.outputExecutioner() sink. cyberpanel · cyberpanel | Critical 9.8 | 48% | 2 exploits | |
| CVE-2024-50498 | WP Query Console <= 1.0 - Unauthenticated Remote Code Execution lubus · wp query console | Critical 9.8 | 53% | · | |
| CVE-2024-46538 | A cross-site scripting (XSS) vulnerability in pfsense v2.5.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the $pconfig variable at interfaces_groups_edit.php. netgate · pfsense | Critical 9.3 | 80% | 1 exploit | |
| CVE-2024-35286 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insufficient sanitization of user input. mitel · micollab | Critical 9.8 | 66% | · | |
| CVE-2024-37404 | Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution. ivanti · connect secure | High 8.8 | 71% | 1 exploit | |
| CVE-2024-9264 | Grafana Command Injection And Local File Inclusion Via Sql Expressions grafana · grafana | Critical 9.4 | 97% | 1 exploit | |
| CVE-2024-45216 | Improper Authentication vulnerability in Apache Solr apache · solr | Critical 9.3 | 93% | · | |
| CVE-2024-9061 | WP Popup Builder – Popup Forms and Marketing Lead Generation <= 1.3.5 - Unauthenticated Arbitrary Shortcode Execution via wp_ajax_nopriv_shortcode_Api_Add themehunk · wp popup builder | Critical 9.8 | 52% | · | |
| CVE-2024-32651 | changedetection.io has a Server Side Template Injection using Jinja2 which allows Remote Command Execution | Critical 10.0 | 84% | · | |
| CVE-2024-48914 | Vendure asset server plugin has local file read vulnerability with AssetServerPlugin & LocalAssetStorageStrategy | Critical 9.1 | 60% | · | |
| CVE-2024-9047 | WordPress File Upload <= 4.24.11 - Unauthenticated Path Traversal to Arbitrary File Read and Deletion in wfu_file_downloader.php iptanus · wordpress file upload | Critical 9.8 | 93% | · | |
| CVE-2024-9916 | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. usualtool · usualtoolcms | Medium 6.9 | 74% | 1 exploit | |
| CVE-2024-9464 | An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls. paloaltonetworks · expedition | Critical 9.3 | 83% | 1 exploit | |
| CVE-2024-47011 | Path Traversal in Ivanti Avalanche before version 6.4.5 allows a remote unauthenticated attacker to leak sensitive information ivanti · avalanche | High 7.5 | 56% | · | |
| CVE-2024-41163 | A directory traversal vulnerability exists in the archive functionality of Veertu Anka Build 1.42.0. veertu · anka build cloud | High 7.5 | 52% | · | |
| CVE-2024-9441 | The Linear eMerge e3-Series through version 1.00-07 is vulnerable to an OS command injection vulnerability. | Critical 9.8 | 53% | · | |
| CVE-2024-5932 | GiveWP – Donation Plugin and Fundraising Platform <= 3.14.1 - Unauthenticated PHP Object Injection to Remote Code Execution givewp · givewp | Critical 9.8 | 77% | 1 exploit | |
| CVE-2024-8353 | GiveWP – Donation Plugin and Fundraising Platform <= 3.16.1 - Unauthenticated PHP Object Injection givewp · givewp | Critical 9.8 | 29% | 1 exploit | |
| CVE-2024-47176 | cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL. openprinting · cups-browsed | Medium 5.3 | 51% | 2 exploits | |
| CVE-2024-47175 | The libppd function ppdCreatePPDFromIPP2 does not sanitize IPP attributes when creating the PPD buffer. openprinting · libppd | Critical 9.8 | 64% | 2 exploits | |
| CVE-2024-47076 | The cfGetPrinterAttributes5 function in libcupsfilters does not sanitize IPP attributes returned from an IPP server. openprinting · libcupsfilters | High 8.6 | 80% | 2 exploits | |
| CVE-2024-8877 | Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204. riello-ups · netman 204 firmware | Medium 6.9 | 77% | · | |
| CVE-2024-46982 | Next.js Cache Poisoning vercel · next.js | High 8.7 | 59% | · | |
| CVE-2024-8522 | LearnPress – WordPress LMS Plugin <= 4.2.7 - Unauthenticated SQL Injection via 'c_only_fields' thimpress · learnpress | High 7.5 | 63% | 1 exploit | |
| CVE-2024-37397 | An External XML Entity (XXE) vulnerability in the provisioning web service of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to leak API secrets. ivanti · endpoint manager | High 8.2 | 59% | · | |
| CVE-2024-29847 | Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution. ivanti · endpoint manager | Critical 9.8 | 53% | · |
Showing 151–200 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.