Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2024-3116Critical 9.8pgAdmin Remote Code Execution (RCE) vulnerabilitypgadmin · pgadmin 4EPSS66%1 exploitPublished Apr 4, 2024
- CVE-2024-2389Critical 9.8In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.progress · flowmonEPSS93%2 exploitsPublished Apr 2, 2024
- CVE-2024-3094Critical 10.0Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.enterprise linux · 10EPSS91%·Published Mar 29, 2024
- CVE-2024-25735Critical 9.1An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.wyrestorm · apollo vx20 firmwareEPSS51%2 exploitsPublished Mar 27, 2024
- CVE-2024-2863Critical 9.8This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.lg · lg led assistantEPSS64%·Published Mar 25, 2024
- CVE-2024-2862Critical 9.8This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.lg · lg led assistantEPSS51%·Published Mar 25, 2024
- CVE-2024-2054Critical 9.8The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.articatech · artica proxyEPSS81%2 exploitsPublished Mar 20, 2024
- CVE-2024-28255Critical 9.8The JwtFilter handles the API authentication by requiring and verifying JWT tokens.open-metadata · openmetadataEPSS73%2 exploitsPublished Mar 15, 2024
- CVE-2024-27317Critical 9.9Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modificationapache · pulsarEPSS57%·Published Mar 14, 2024
- CVE-2024-1222Critical 9.8This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges.papercut · papercut ngEPSS64%·Published Mar 14, 2024
- CVE-2024-1071Critical 9.8The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied…ultimatemember · ultimate memberEPSS89%·Published Mar 13, 2024
- CVE-2024-27956Critical 9.8Automatic <= 3.92.0 - Unauthenticated SQL Injectionvalvepress · automaticEPSS94%1 exploitPublished Mar 12, 2024
- CVE-2024-2044Critical 9.4pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated userpgadmin · pgadmin 4EPSS79%1 exploitPublished Mar 7, 2024
- CVE-2024-1698Critical 9.8NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injectionwpdeveloper · notificationxEPSS78%·Published Feb 25, 2024
- CVE-2024-1512Critical 9.8MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injectionstylemixthemes · masterstudy lmsEPSS78%·Published Feb 19, 2024
- CVE-2024-23759Critical 9.8Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.gambio · gambioEPSS48%1 exploitPublished Feb 12, 2024
- CVE-2024-23108Critical 9.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.fortinet · fortisiemEPSS80%Ransomware1 actorPublished Feb 8, 2024
- CVE-2023-6933Critical 9.8Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injectionwpengine · better search replaceEPSS68%·Published Feb 8, 2024
- CVE-2023-6989Critical 9.8Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusiongetshieldsecurity · shield securityEPSS57%·Published Feb 8, 2024
- CVE-2024-23917Critical 9.8In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possiblejetbrains · teamcityEPSS54%·Published Feb 6, 2024
- CVE-2023-46359Critical 9.8An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.hardy-barth · cph2 echarge firmwareEPSS88%·Published Feb 5, 2024
- CVE-2024-22319Critical 9.8IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API.ibm · operational decision managerEPSS76%·Published Feb 5, 2024
- CVE-2024-0986Critical 9.8It has been rated as critical.issabel · pbxEPSS58%·Published Jan 28, 2024
- CVE-2024-22729Critical 9.8NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.netis-systems · mw5360 firmwareEPSS71%2 exploitsPublished Jan 25, 2024
- CVE-2024-0204Critical 9.8Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.fortra · goanywhere managed file transferEPSS95%2 exploitsPublished Jan 22, 2024
- CVE-2024-0200Critical 9.8An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection.github · enterprise serverEPSS72%·Published Jan 16, 2024
- CVE-2022-1609Critical 9.8The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.weblizar · school managementEPSS64%·Published Jan 16, 2024
- CVE-2023-6623Critical 9.8Essential Blocks <= 4.4.2 - Unauthenticated Local File Inclusionwpdeveloper · essential blocksEPSS51%·Published Jan 16, 2024
- CVE-2023-6875Critical 9.8POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app APIwpexperts · post smtpEPSS90%Ransomware1 actorPublished Jan 12, 2024
- CVE-2023-50919Critical 9.8An issue was discovered on GL.iNet devices before version 4.5.0.gl-inet · gl-a1300 firmwareEPSS48%2 exploitsPublished Jan 12, 2024
- CVE-2023-31446Critical 9.8In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.cassianetworks · xc1000 firmwareEPSS61%1 exploitPublished Jan 10, 2024
- CVE-2024-0352Critical 9.8A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311.likeshop · likeshopEPSS73%·Published Jan 9, 2024
- CVE-2023-51409Critical 9.8AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_uploadmeowapps · ai engineEPSS63%·Published Jan 8, 2024
- CVE-2024-21650Critical 9.8XWiki Remote Code Execution Vulnerability via User Registrationxwiki · xwikiEPSS93%·Published Jan 8, 2024
- CVE-2023-7102Critical 9.8Use of a Third Party library produced a vulnerability in Barracuda Networks Inc.barracuda · email security gateway 300 firmwareEPSS45%1 exploitPublished Dec 28, 2023
- CVE-2023-51467Critical 9.8The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary codeapache · ofbizEPSS96%1 exploitPublished Dec 27, 2023
- CVE-2023-46264Critical 9.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.ivanti · avalancheEPSS90%·Published Dec 20, 2023
- CVE-2023-46263Critical 9.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution.ivanti · avalancheEPSS82%·Published Dec 20, 2023
- CVE-2021-22962Critical 9.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.ivanti · avalancheEPSS91%·Published Dec 19, 2023
- CVE-2023-6895Critical 9.8It has been declared as critical.hikvision · intercom broadcast systemEPSS89%Ransomware1 exploit1 actorPublished Dec 17, 2023
- CVE-2023-50917Critical 9.8MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters.mjdm · majordomoEPSS38%1 exploitPublished Dec 15, 2023
- CVE-2023-48085Critical 9.8Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.nagios · nagios xiEPSS76%·Published Dec 15, 2023
- CVE-2023-46727Critical 9.8Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack.glpi-project · glpiEPSS68%·Published Dec 13, 2023
- CVE-2023-25690Critical 9.8Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.apache · http serverEPSS85%·Published Dec 13, 2023
- CVE-2023-6553Critical 9.8Backup Migration <= 1.3.7 - Unauthenticated Remote Code Executionbackupbliss · backup migrationEPSS98%2 exploitsPublished Dec 10, 2023
- CVE-2023-50164Critical 9.8Apache Struts vulnerable to path traversalapache · strutsEPSS81%·Published Dec 7, 2023
- CVE-2023-49070Critical 9.8Pre-auth RCE in Apache Ofbiz 18.12.09.apache · ofbizEPSS95%1 exploitPublished Dec 6, 2023
- CVE-2022-1471Critical 9.8SnakeYaml Constructor Deserialization Remote Code Executionsnakeyaml project · snakeyamlEPSS100%3 exploitsPublished Dec 6, 2023
- CVE-2023-6360Critical 9.8The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.joedolson · my calendarEPSS63%·Published Nov 30, 2023
- CVE-2023-48022Critical 9.8Ray has arbitrary code execution via jobs submission APIanyscale · rayEPSS84%1 exploitPublished Nov 28, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-3116 | pgAdmin Remote Code Execution (RCE) vulnerability pgadmin · pgadmin 4 | Critical 9.8 | 66% | 1 exploit | |
| CVE-2024-2389 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. progress · flowmon | Critical 9.8 | 93% | 2 exploits | |
| CVE-2024-3094 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. enterprise linux · 10 | Critical 10.0 | 91% | · | |
| CVE-2024-25735 | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. wyrestorm · apollo vx20 firmware | Critical 9.1 | 51% | 2 exploits | |
| CVE-2024-2863 | This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. lg · lg led assistant | Critical 9.8 | 64% | · | |
| CVE-2024-2862 | This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. lg · lg led assistant | Critical 9.8 | 51% | · | |
| CVE-2024-2054 | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. articatech · artica proxy | Critical 9.8 | 81% | 2 exploits | |
| CVE-2024-28255 | The JwtFilter handles the API authentication by requiring and verifying JWT tokens. open-metadata · openmetadata | Critical 9.8 | 73% | 2 exploits | |
| CVE-2024-27317 | Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification apache · pulsar | Critical 9.9 | 57% | · | |
| CVE-2024-1222 | This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. papercut · papercut ng | Critical 9.8 | 64% | · | |
| CVE-2024-1071 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied… ultimatemember · ultimate member | Critical 9.8 | 89% | · | |
| CVE-2024-27956 | Automatic <= 3.92.0 - Unauthenticated SQL Injection valvepress · automatic | Critical 9.8 | 94% | 1 exploit | |
| CVE-2024-2044 | pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user pgadmin · pgadmin 4 | Critical 9.4 | 79% | 1 exploit | |
| CVE-2024-1698 | NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection wpdeveloper · notificationx | Critical 9.8 | 78% | · | |
| CVE-2024-1512 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection stylemixthemes · masterstudy lms | Critical 9.8 | 78% | · | |
| CVE-2024-23759 | Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function. gambio · gambio | Critical 9.8 | 48% | 1 exploit | |
| CVE-2024-23108 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests. fortinet · fortisiem | Critical 9.8 | 80% | Ransomware1 actor | |
| CVE-2023-6933 | Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection wpengine · better search replace | Critical 9.8 | 68% | · | |
| CVE-2023-6989 | Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion getshieldsecurity · shield security | Critical 9.8 | 57% | · | |
| CVE-2024-23917 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible jetbrains · teamcity | Critical 9.8 | 54% | · | |
| CVE-2023-46359 | An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature. hardy-barth · cph2 echarge firmware | Critical 9.8 | 88% | · | |
| CVE-2024-22319 | IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. ibm · operational decision manager | Critical 9.8 | 76% | · | |
| CVE-2024-0986 | It has been rated as critical. issabel · pbx | Critical 9.8 | 58% | · | |
| CVE-2024-22729 | NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. netis-systems · mw5360 firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2024-0204 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. fortra · goanywhere managed file transfer | Critical 9.8 | 95% | 2 exploits | |
| CVE-2024-0200 | An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. github · enterprise server | Critical 9.8 | 72% | · | |
| CVE-2022-1609 | The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site. weblizar · school management | Critical 9.8 | 64% | · | |
| CVE-2023-6623 | Essential Blocks <= 4.4.2 - Unauthenticated Local File Inclusion wpdeveloper · essential blocks | Critical 9.8 | 51% | · | |
| CVE-2023-6875 | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API wpexperts · post smtp | Critical 9.8 | 90% | Ransomware1 actor | |
| CVE-2023-50919 | An issue was discovered on GL.iNet devices before version 4.5.0. gl-inet · gl-a1300 firmware | Critical 9.8 | 48% | 2 exploits | |
| CVE-2023-31446 | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. cassianetworks · xc1000 firmware | Critical 9.8 | 61% | 1 exploit | |
| CVE-2024-0352 | A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. likeshop · likeshop | Critical 9.8 | 73% | · | |
| CVE-2023-51409 | AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload meowapps · ai engine | Critical 9.8 | 63% | · | |
| CVE-2024-21650 | XWiki Remote Code Execution Vulnerability via User Registration xwiki · xwiki | Critical 9.8 | 93% | · | |
| CVE-2023-7102 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. barracuda · email security gateway 300 firmware | Critical 9.8 | 45% | 1 exploit | |
| CVE-2023-51467 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code apache · ofbiz | Critical 9.8 | 96% | 1 exploit | |
| CVE-2023-46264 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. ivanti · avalanche | Critical 9.8 | 90% | · | |
| CVE-2023-46263 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution. ivanti · avalanche | Critical 9.8 | 82% | · | |
| CVE-2021-22962 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. ivanti · avalanche | Critical 9.1 | 91% | · | |
| CVE-2023-6895 | It has been declared as critical. hikvision · intercom broadcast system | Critical 9.8 | 89% | Ransomware1 exploit1 actor | |
| CVE-2023-50917 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. mjdm · majordomo | Critical 9.8 | 38% | 1 exploit | |
| CVE-2023-48085 | Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. nagios · nagios xi | Critical 9.8 | 76% | · | |
| CVE-2023-46727 | Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. glpi-project · glpi | Critical 9.8 | 68% | · | |
| CVE-2023-25690 | Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. apache · http server | Critical 9.8 | 85% | · | |
| CVE-2023-6553 | Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution backupbliss · backup migration | Critical 9.8 | 98% | 2 exploits | |
| CVE-2023-50164 | Apache Struts vulnerable to path traversal apache · struts | Critical 9.8 | 81% | · | |
| CVE-2023-49070 | Pre-auth RCE in Apache Ofbiz 18.12.09. apache · ofbiz | Critical 9.8 | 95% | 1 exploit | |
| CVE-2022-1471 | SnakeYaml Constructor Deserialization Remote Code Execution snakeyaml project · snakeyaml | Critical 9.8 | 100% | 3 exploits | |
| CVE-2023-6360 | The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route. joedolson · my calendar | Critical 9.8 | 63% | · | |
| CVE-2023-48022 | Ray has arbitrary code execution via jobs submission API anyscale · ray | Critical 9.8 | 84% | 1 exploit |
Showing 151–200 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.