Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2024-38018High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS51%·Published Sep 11, 2024
- CVE-2024-8504High 8.8An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user.EPSS76%1 exploitPublished Sep 10, 2024
- CVE-2024-8503Critical 9.8An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records.EPSS79%1 exploitPublished Sep 10, 2024
- CVE-2024-8517Critical 9.8SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue.spip · spipEPSS95%1 exploitPublished Sep 6, 2024
- CVE-2024-20440High 7.5A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information.cisco · smart license utilityEPSS52%·Published Sep 5, 2024
- CVE-2024-45507High 8.8Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz.apache · ofbizEPSS93%·Published Sep 4, 2024
- CVE-2024-45388High 8.7Hoverfly allows an arbitrary file read in the /api/v2/simulation endpoint (GHSL-2023-274)hoverfly · hoverflyEPSS56%·Published Sep 3, 2024
- CVE-2024-6119High 7.5Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process.openssl · opensslEPSS67%·Published Sep 3, 2024
- CVE-2024-45488Critical 9.8One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies.EPSS51%·Published Aug 29, 2024
- CVE-2024-7954Critical 9.8The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability.EPSS90%1 exploitPublished Aug 23, 2024
- CVE-2024-5762High 8.1Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability.zen-cart · zen cartEPSS72%·Published Aug 21, 2024
- CVE-2024-38653High 7.5XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server.ivanti · avalancheEPSS92%·Published Aug 15, 2024
- CVE-2024-38063Critical 9.8Windows TCP/IP Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS71%·Published Aug 14, 2024
- CVE-2024-41730Critical 9.8In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint.sap · business objects business intelligence platformEPSS76%·Published Aug 13, 2024
- CVE-2024-6782Critical 9.8Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution.EPSS84%1 exploitPublished Aug 6, 2024
- CVE-2024-6781High 7.5Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read.calibre-ebook · calibreEPSS62%·Published Aug 6, 2024
- CVE-2023-30625Critical 9.3rudder-server is vulnerable to SQL injectionrudderstack · rudder-serverEPSS86%1 exploitPublished Aug 5, 2024
- CVE-2023-49785Critical 9.3NextChat has full-read SSRF and XSS vulnerability in /api/cors endpointnextchat · nextchatEPSS83%1 exploitPublished Aug 5, 2024
- CVE-2024-42010High 7.5mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information.EPSS67%·Published Aug 5, 2024
- CVE-2024-7314Critical 9.8anji-plus AJ-Report is affected by an authentication bypass vulnerability.anji-plus · reportEPSS52%2 exploitsPublished Aug 2, 2024
- CVE-2024-7120Medium 5.3A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90.raisecom · msg1200 firmwareEPSS93%·Published Jul 26, 2024
- CVE-2024-20419Critical 10.0A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users.cisco · smart software manager on-premEPSS81%1 exploitPublished Jul 18, 2024
- CVE-2024-6396Critical 9.8A vulnerability in the _backup_run function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data.aimstack · aimEPSS53%·Published Jul 11, 2024
- CVE-2024-38077Critical 9.8Windows Remote Desktop Licensing Service Remote Code Execution Vulnerabilitymicrosoft · windows server 2008EPSS84%·Published Jul 10, 2024
- CVE-2024-38030Medium 6.5Windows Themes Spoofing Vulnerabilitymicrosoft · windows 10 1507EPSS51%·Published Jul 10, 2024
- CVE-2024-38023High 7.2Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS53%·Published Jul 10, 2024
- CVE-2024-29510Medium 6.3Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.artifex · ghostscriptEPSS28%1 exploitPublished Jul 4, 2024
- CVE-2024-38472High 7.5SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue.apache · http serverEPSS69%·Published Jul 2, 2024
- CVE-2024-6387High 8.1openssh: regreSSHion - race condition in SSH allows RCE/DoSopenbsd · opensshEPSS100%1 exploitPublished Jul 2, 2024
- CVE-2024-5806Critical 9.8Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2.progress · moveit transferEPSS81%·Published Jun 26, 2024
- CVE-2024-37843Critical 9.3Craft CMS SQL injection vulnerability via the GraphQL API endpointcraftcms · craft cmsEPSS53%·Published Jun 25, 2024
- CVE-2024-5276Critical 9.1A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data.fortra · filecatalyst workflowEPSS90%·Published Jun 25, 2024
- CVE-2024-5010High 7.5In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality.progress · whatsup goldEPSS70%·Published Jun 25, 2024
- CVE-2024-4883Critical 9.8In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold.progress · whatsup goldEPSS65%·Published Jun 25, 2024
- CVE-2024-27136Medium 5.3Cross site scripting in Apache JSPWikiapache · jspwikiEPSS61%·Published Jun 24, 2024
- CVE-2022-0435Critical 9.2A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed.linux · linux kernelEPSS68%·Published Jun 24, 2024
- CVE-2024-32030High 8.1Kafka UI API allows users to connect to different Kafka brokers by specifying their network address and port.EPSS51%·Published Jun 24, 2024
- CVE-2012-6664Critical 9.1Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a ..EPSS30%1 exploitPublished Jun 21, 2024
- CVE-2024-3552Critical 9.8Web Directory Free <= 1.6.9 - Unauthenticated SQL Injectionsalephpscripts · web directory freeEPSS67%·Published Jun 14, 2024
- CVE-2024-3922Critical 9.8Dokan Pro <= 3.10.3 - Unauthenticated SQL Injectiondokan · dokanEPSS53%·Published Jun 14, 2024
- CVE-2024-37014High 8.8Langflow remote code execution vulnerabilitylangflow · langflowEPSS64%·Published Jun 10, 2024
- CVE-2024-36104Critical 9.1Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz.apache · ofbizEPSS88%·Published Jun 7, 2024
- CVE-2024-29972Critical 9.8UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating…zyxel · nas326 firmwareEPSS89%·Published Jun 7, 2024
- CVE-2024-29973Critical 9.8UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS)…zyxel · nas326 firmwareEPSS86%·Published Jun 7, 2024
- CVE-2024-25600Critical 10.0Bricks <= 1.9.6 - Unauthenticated Remote Code ExecutionEPSS88%Ransomware3 exploits1 actorPublished Jun 7, 2024
- CVE-2024-3408High 9.3Authentication bypass in dtaleman · d-taleEPSS78%1 exploitPublished Jun 6, 2024
- CVE-2024-4990Critical 9.1Unsafe Reflection in base Component class in yiisoft/yii2yiiframework · yiiEPSS80%·Published Jun 2, 2024
- CVE-2024-29848High 7.2An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM.ivanti · avalancheEPSS64%·Published May 31, 2024
- CVE-2024-29827High 8.8An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.ivanti · endpoint managerEPSS72%·Published May 31, 2024
- CVE-2024-29826High 8.8An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.ivanti · endpoint managerEPSS100%·Published May 31, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-38018 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 51% | · | |
| CVE-2024-8504 | An attacker with authenticated access to VICIdial as an "agent" can execute arbitrary shell commands as the "root" user. | High 8.8 | 76% | 1 exploit | |
| CVE-2024-8503 | An unauthenticated attacker can leverage a time-based SQL injection vulnerability in VICIdial to enumerate database records. | Critical 9.8 | 79% | 1 exploit | |
| CVE-2024-8517 | SPIP before 4.3.2, 4.2.16, and 4.1.18 is vulnerable to a command injection issue. spip · spip | Critical 9.8 | 95% | 1 exploit | |
| CVE-2024-20440 | A vulnerability in Cisco Smart Licensing Utility could allow an unauthenticated, remote attacker to access sensitive information. cisco · smart license utility | High 7.5 | 52% | · | |
| CVE-2024-45507 | Server-Side Request Forgery (SSRF), Improper Control of Generation of Code ('Code Injection') vulnerability in Apache OFBiz. apache · ofbiz | High 8.8 | 93% | · | |
| CVE-2024-45388 | Hoverfly allows an arbitrary file read in the /api/v2/simulation endpoint (GHSL-2023-274) hoverfly · hoverfly | High 8.7 | 56% | · | |
| CVE-2024-6119 | Issue summary: Applications performing certificate name checks (e.g., TLS clients checking server certificates) may attempt to read an invalid memory address resulting in abnormal termination of the application process. openssl · openssl | High 7.5 | 67% | · | |
| CVE-2024-45488 | One Identity Safeguard for Privileged Passwords before 7.5.2 allows unauthorized access because of an issue related to cookies. | Critical 9.8 | 51% | · | |
| CVE-2024-7954 | The porte_plume plugin used by SPIP before 4.30-alpha2, 4.2.13, and 4.1.16 is vulnerable to an arbitrary code execution vulnerability. | Critical 9.8 | 90% | 1 exploit | |
| CVE-2024-5762 | Zen Cart findPluginAdminPage Local File Inclusion Remote Code Execution Vulnerability. zen-cart · zen cart | High 8.1 | 72% | · | |
| CVE-2024-38653 | XXE in SmartDeviceServer in Ivanti Avalanche 6.3.1 allows a remote unauthenticated attacker to read arbitrary files on the server. ivanti · avalanche | High 7.5 | 92% | · | |
| CVE-2024-38063 | Windows TCP/IP Remote Code Execution Vulnerability microsoft · windows 10 1507 | Critical 9.8 | 71% | · | |
| CVE-2024-41730 | In SAP BusinessObjects Business Intelligence Platform, if Single Signed On is enabled on Enterprise authentication, an unauthorized user can get a logon token using a REST endpoint. sap · business objects business intelligence platform | Critical 9.8 | 76% | · | |
| CVE-2024-6782 | Improper access control in Calibre 6.9.0 ~ 7.14.0 allow unauthenticated attackers to achieve remote code execution. | Critical 9.8 | 84% | 1 exploit | |
| CVE-2024-6781 | Path traversal in Calibre <= 7.14.0 allow unauthenticated attackers to achieve arbitrary file read. calibre-ebook · calibre | High 7.5 | 62% | · | |
| CVE-2023-30625 | rudder-server is vulnerable to SQL injection rudderstack · rudder-server | Critical 9.3 | 86% | 1 exploit | |
| CVE-2023-49785 | NextChat has full-read SSRF and XSS vulnerability in /api/cors endpoint nextchat · nextchat | Critical 9.3 | 83% | 1 exploit | |
| CVE-2024-42010 | mod_css_styles in Roundcube through 1.5.7 and 1.6.x through 1.6.7 insufficiently filters Cascading Style Sheets (CSS) token sequences in rendered e-mail messages, allowing a remote attacker to obtain sensitive information. | High 7.5 | 67% | · | |
| CVE-2024-7314 | anji-plus AJ-Report is affected by an authentication bypass vulnerability. anji-plus · report | Critical 9.8 | 52% | 2 exploits | |
| CVE-2024-7120 | A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. raisecom · msg1200 firmware | Medium 5.3 | 93% | · | |
| CVE-2024-20419 | A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauthenticated, remote attacker to change the password of any user, including administrative users. cisco · smart software manager on-prem | Critical 10.0 | 81% | 1 exploit | |
| CVE-2024-6396 | A vulnerability in the _backup_run function in aimhubio/aim version 3.19.3 allows remote attackers to overwrite any file on the host server and exfiltrate arbitrary data. aimstack · aim | Critical 9.8 | 53% | · | |
| CVE-2024-38077 | Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability microsoft · windows server 2008 | Critical 9.8 | 84% | · | |
| CVE-2024-38030 | Windows Themes Spoofing Vulnerability microsoft · windows 10 1507 | Medium 6.5 | 51% | · | |
| CVE-2024-38023 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 7.2 | 53% | · | |
| CVE-2024-29510 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. artifex · ghostscript | Medium 6.3 | 28% | 1 exploit | |
| CVE-2024-38472 | SSRF in Apache HTTP Server on Windows allows to potentially leak NTLM hashes to a malicious server via SSRF and malicious requests or content Users are recommended to upgrade to version 2.4.60 which fixes this issue. apache · http server | High 7.5 | 69% | · | |
| CVE-2024-6387 | openssh: regreSSHion - race condition in SSH allows RCE/DoS openbsd · openssh | High 8.1 | 100% | 1 exploit | |
| CVE-2024-5806 | Improper Authentication vulnerability in Progress MOVEit Transfer (SFTP module) can lead to Authentication Bypass.This issue affects MOVEit Transfer: from 2023.0.0 before 2023.0.11, from 2023.1.0 before 2023.1.6, from 2024.0.0 before 2024.0.2. progress · moveit transfer | Critical 9.8 | 81% | · | |
| CVE-2024-37843 | Craft CMS SQL injection vulnerability via the GraphQL API endpoint craftcms · craft cms | Critical 9.3 | 53% | · | |
| CVE-2024-5276 | A SQL Injection vulnerability in Fortra FileCatalyst Workflow allows an attacker to modify application data. fortra · filecatalyst workflow | Critical 9.1 | 90% | · | |
| CVE-2024-5010 | In WhatsUp Gold versions released before 2023.1.3, a vulnerability exists in the TestController functionality. progress · whatsup gold | High 7.5 | 70% | · | |
| CVE-2024-4883 | In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. progress · whatsup gold | Critical 9.8 | 65% | · | |
| CVE-2024-27136 | Cross site scripting in Apache JSPWiki apache · jspwiki | Medium 5.3 | 61% | · | |
| CVE-2022-0435 | A stack overflow flaw was found in the Linux kernel's TIPC protocol functionality in the way a user sends a packet with malicious content where the number of domain member nodes is higher than the 64 allowed. linux · linux kernel | Critical 9.2 | 68% | · | |
| CVE-2024-32030 | Kafka UI API allows users to connect to different Kafka brokers by specifying their network address and port. | High 8.1 | 51% | · | |
| CVE-2012-6664 | Multiple directory traversal vulnerabilities in the TFTP Server in Distinct Intranet Servers 3.10 and earlier allow remote attackers to read or write arbitrary files via a .. | Critical 9.1 | 30% | 1 exploit | |
| CVE-2024-3552 | Web Directory Free <= 1.6.9 - Unauthenticated SQL Injection salephpscripts · web directory free | Critical 9.8 | 67% | · | |
| CVE-2024-3922 | Dokan Pro <= 3.10.3 - Unauthenticated SQL Injection dokan · dokan | Critical 9.8 | 53% | · | |
| CVE-2024-37014 | Langflow remote code execution vulnerability langflow · langflow | High 8.8 | 64% | · | |
| CVE-2024-36104 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache OFBiz. apache · ofbiz | Critical 9.1 | 88% | · | |
| CVE-2024-29972 | UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the CGI program "remote_help-cgi" in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating… zyxel · nas326 firmware | Critical 9.8 | 89% | · | |
| CVE-2024-29973 | UNSUPPORTED WHEN ASSIGNED The command injection vulnerability in the “setCookie” parameter in Zyxel NAS326 firmware versions before V5.21(AAZF.17)C0 and NAS542 firmware versions before V5.21(ABAG.14)C0 could allow an unauthenticated attacker to execute some operating system (OS)… zyxel · nas326 firmware | Critical 9.8 | 86% | · | |
| CVE-2024-25600 | Bricks <= 1.9.6 - Unauthenticated Remote Code Execution | Critical 10.0 | 88% | Ransomware3 exploits1 actor | |
| CVE-2024-3408 | Authentication bypass in dtale man · d-tale | High 9.3 | 78% | 1 exploit | |
| CVE-2024-4990 | Unsafe Reflection in base Component class in yiisoft/yii2 yiiframework · yii | Critical 9.1 | 80% | · | |
| CVE-2024-29848 | An unrestricted file upload vulnerability in web component of Ivanti Avalanche before 6.4.x allows an authenticated, privileged user to execute arbitrary commands as SYSTEM. ivanti · avalanche | High 7.2 | 64% | · | |
| CVE-2024-29827 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. ivanti · endpoint manager | High 8.8 | 72% | · | |
| CVE-2024-29826 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. ivanti · endpoint manager | High 8.8 | 100% | · |
Showing 201–250 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.