Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2023-31419High 7.5elasticsearch: StackOverflow vulnerabilityelastic · elasticsearchEPSS62%·Published Oct 27, 2023
- CVE-2023-39456High 7.5Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2.apache · traffic serverEPSS58%·Published Oct 17, 2023
- CVE-2023-43661High 8.8Cachet vulnerable to Authenticated Remote Code Executionall-three · cachetEPSS51%1 exploitPublished Oct 16, 2023
- CVE-2023-38171High 7.5Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannelmicrosoft · .netEPSS71%·Published Oct 10, 2023
- CVE-2023-36606High 7.5Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10EPSS69%·Published Oct 10, 2023
- CVE-2023-43261High 7.5An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components.milesight · ur32 firmwareEPSS64%1 exploitPublished Oct 4, 2023
- CVE-2023-30591High 7.5Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking eventName.startsWith() or eventName.toString(), while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name…nodebb · nodebbEPSS59%·Published Sep 29, 2023
- CVE-2023-5151High 8.8UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231.dlink · dar-8000 firmwareEPSS81%1 exploitPublished Sep 25, 2023
- CVE-2023-38146High 8.8Windows Themes Remote Code Execution Vulnerabilitymicrosoft · windows 11 21h2EPSS37%1 exploitPublished Sep 19, 2023
- CVE-2023-38039High 7.5When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API.haxx · curlEPSS58%·Published Sep 15, 2023
- CVE-2023-36745High 8.0Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS80%Ransomware1 actorPublished Sep 13, 2023
- CVE-2023-36744High 8.0Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS57%·Published Sep 13, 2023
- CVE-2023-39362High 7.2In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server.cacti · cactiEPSS85%3 exploitsPublished Sep 6, 2023
- CVE-2023-38836High 8.8File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks.boidcms · boidcmsEPSS76%3 exploitsPublished Aug 21, 2023
- CVE-2023-4415High 8.8It has been rated as critical.ruijienetworks · rg-ew1200g firmwareEPSS58%1 exploitPublished Aug 18, 2023
- CVE-2022-21661High 7.5wordpress - security updatewordpress · wordpressEPSS98%2 exploitsPublished Aug 14, 2023
- CVE-2023-32782High 7.2A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor.paessler · prtg network monitorEPSS56%·Published Aug 10, 2023
- CVE-2023-36899High 8.8ASP.NET Elevation of Privilege Vulnerabilitymicrosoft · .net frameworkEPSS77%·Published Aug 8, 2023
- CVE-2023-36255High 8.8An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL.eramba · erambaEPSS53%1 exploitPublished Aug 2, 2023
- CVE-2023-34966High 7.5samba: infinite loop in mdssvc RPC service for spotlightsamba · sambaEPSS62%·Published Aug 1, 2023
- CVE-2023-3486High 7.5An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage.papercut · papercut ngEPSS79%·Published Jul 25, 2023
- CVE-2023-22047High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools.oracle · peoplesoft enterpriseEPSS77%·Published Jul 18, 2023
- CVE-2023-37462High 8.8org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerabilityxwiki · xwikiEPSS92%·Published Jul 14, 2023
- CVE-2023-34127High 8.8Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges.sonicwall · analyticsEPSS86%1 exploitPublished Jul 13, 2023
- CVE-2023-34133High 7.5Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database.sonicwall · analyticsEPSS73%1 exploitPublished Jul 13, 2023
- CVE-2023-36824High 8.8In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution.redis · redisEPSS77%·Published Jul 11, 2023
- CVE-2023-36969High 8.8CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function.cmsmadesimple · cms made simpleEPSS49%1 exploitPublished Jul 6, 2023
- CVE-2023-36932High 8.1In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an…progress · moveit transferEPSS81%·Published Jul 6, 2023
- CVE-2023-36933High 7.5In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception.progress · moveit transferEPSS72%·Published Jul 6, 2023
- CVE-2023-36469High 8.8XWiki Platform vulnerable to Code injection through NotificationRSSServicexwiki · xwikiEPSS82%·Published Jun 30, 2023
- CVE-2023-3450High 7.2The manipulation leads to os command injection.ruijie · rg-bcr860 firmwareEPSS51%1 exploitPublished Jun 28, 2023
- CVE-2023-3420High 8.8Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.google · chromeEPSS56%·Published Jun 26, 2023
- CVE-2023-35166High 8.8XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanelxwiki · xwikiEPSS62%·Published Jun 20, 2023
- CVE-2023-35150High 8.0XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation applicationxwiki · xwikiEPSS78%·Published Jun 20, 2023
- CVE-2023-32031High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS81%·Published Jun 15, 2023
- CVE-2023-32029High 7.8Microsoft Excel Remote Code Execution Vulnerabilitymicrosoft · excelEPSS54%·Published Jun 14, 2023
- CVE-2023-34468High 8.8Apache NiFi vulnerable to Code Injectionapache · nifiEPSS62%1 exploitPublished Jun 12, 2023
- CVE-2023-34096High 8.8In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system.thruk · thrukEPSS63%6 exploitsPublished Jun 8, 2023
- CVE-2023-20888High 8.8Aria Operations for Networks contains an authenticated deserialization vulnerability.vmware · vrealize network insightEPSS82%·Published Jun 8, 2023
- CVE-2023-20889High 7.5Aria Operations for Networks contains an information disclosure vulnerability.vmware · vrealize network insightEPSS79%·Published Jun 8, 2023
- CVE-2023-32707High 8.8In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing…splunk · splunk cloud platformEPSS79%2 exploitsPublished Jun 1, 2023
- CVE-2023-2249High 8.8wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contentsgvectors · wpforo forumEPSS61%·Published May 31, 2023
- CVE-2023-30253High 8.8Dolibarr vulnerable to remote code execution via uppercase manipulationdolibarr · dolibarr erp\/crmEPSS82%1 exploitPublished May 30, 2023
- CVE-2023-2928High 8.8It has been declared as critical.dedecms · dedecmsEPSS51%·Published May 27, 2023
- CVE-2023-2825High 7.5An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups.gitlab · gitlabEPSS72%·Published May 24, 2023
- CVE-2023-2766High 7.5The manipulation leads to files or directories accessible.weaver · e-officeEPSS54%1 exploitPublished May 17, 2023
- CVE-2023-0210High 7.5A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems.linux · linux kernelEPSS72%·Published May 17, 2023
- CVE-2023-32986High 8.8Jenkins File Parameter Plugin arbitrary file write vulnerabilityjenkins · file parametersEPSS61%·Published May 16, 2023
- CVE-2023-28128High 7.2An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution.ivanti · avalancheEPSS85%1 exploitPublished May 9, 2023
- CVE-2023-28127High 7.5A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure.ivanti · avalancheEPSS59%·Published May 9, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-31419 | elasticsearch: StackOverflow vulnerability elastic · elasticsearch | High 7.5 | 62% | · | |
| CVE-2023-39456 | Improper Input Validation vulnerability in Apache Traffic Server with malformed HTTP/2 frames.This issue affects Apache Traffic Server: from 9.0.0 through 9.2.2. apache · traffic server | High 7.5 | 58% | · | |
| CVE-2023-43661 | Cachet vulnerable to Authenticated Remote Code Execution all-three · cachet | High 8.8 | 51% | 1 exploit | |
| CVE-2023-38171 | Remote Denial of Service Vulnerability in Microsoft.Native.Quic.MsQuic.Schannel microsoft · .net | High 7.5 | 71% | · | |
| CVE-2023-36606 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability microsoft · windows 10 | High 7.5 | 69% | · | |
| CVE-2023-43261 | An information disclosure in Milesight UR5X, UR32L, UR32, UR35, UR41 before v35.3.0.7 allows attackers to access sensitive router components. milesight · ur32 firmware | High 7.5 | 64% | 1 exploit | |
| CVE-2023-30591 | Denial-of-service in NodeBB <= v2.8.10 allows unauthenticated attackers to trigger a crash, when invoking eventName.startsWith() or eventName.toString(), while processing Socket.IO messages via crafted Socket.IO messages containing array or object type for the event name… nodebb · nodebb | High 7.5 | 59% | · | |
| CVE-2023-5151 | UNSUPPORTED WHEN ASSIGNED A vulnerability classified as critical was found in D-Link DAR-8000 up to 20151231. dlink · dar-8000 firmware | High 8.8 | 81% | 1 exploit | |
| CVE-2023-38146 | Windows Themes Remote Code Execution Vulnerability microsoft · windows 11 21h2 | High 8.8 | 37% | 1 exploit | |
| CVE-2023-38039 | When curl retrieves an HTTP response, it stores the incoming headers so that they can be accessed later via the libcurl headers API. haxx · curl | High 7.5 | 58% | · | |
| CVE-2023-36745 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.0 | 80% | Ransomware1 actor | |
| CVE-2023-36744 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.0 | 57% | · | |
| CVE-2023-39362 | In Cacti 1.2.24, under certain conditions, an authenticated privileged user, can use a malicious string in the SNMP options of a Device, performing command injection and obtaining remote code execution on the underlying server. cacti · cacti | High 7.2 | 85% | 3 exploits | |
| CVE-2023-38836 | File Upload vulnerability in BoidCMS v.2.0.0 allows a remote attacker to execute arbitrary code by adding a GIF header to bypass MIME type checks. boidcms · boidcms | High 8.8 | 76% | 3 exploits | |
| CVE-2023-4415 | It has been rated as critical. ruijienetworks · rg-ew1200g firmware | High 8.8 | 58% | 1 exploit | |
| CVE-2022-21661 | wordpress - security update wordpress · wordpress | High 7.5 | 98% | 2 exploits | |
| CVE-2023-32782 | A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. paessler · prtg network monitor | High 7.2 | 56% | · | |
| CVE-2023-36899 | ASP.NET Elevation of Privilege Vulnerability microsoft · .net framework | High 8.8 | 77% | · | |
| CVE-2023-36255 | An issue in Eramba Limited Eramba Enterprise and Community edition v.3.19.1 allows a remote attacker to execute arbitrary code via the path parameter in the URL. eramba · eramba | High 8.8 | 53% | 1 exploit | |
| CVE-2023-34966 | samba: infinite loop in mdssvc RPC service for spotlight samba · samba | High 7.5 | 62% | · | |
| CVE-2023-3486 | An authentication bypass exists in PaperCut NG versions 22.0.12 and prior that could allow a remote, unauthenticated attacker to upload arbitrary files to the PaperCut NG host’s file storage. papercut · papercut ng | High 7.5 | 79% | · | |
| CVE-2023-22047 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise PeopleSoft Enterprise PeopleTools. oracle · peoplesoft enterprise | High 7.5 | 77% | · | |
| CVE-2023-37462 | org.xwiki.platform:xwiki-platform-skin-ui Eval Injection vulnerability xwiki · xwiki | High 8.8 | 92% | · | |
| CVE-2023-34127 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in SonicWall GMS, SonicWall Analytics enables an authenticated attacker to execute arbitrary code with root privileges. sonicwall · analytics | High 8.8 | 86% | 1 exploit | |
| CVE-2023-34133 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in SonicWall GMS and Analytics allows an unauthenticated attacker to extract sensitive information from the application database. sonicwall · analytics | High 7.5 | 73% | 1 exploit | |
| CVE-2023-36824 | In Redit 7.0 prior to 7.0.12, extracting key names from a command and a list of arguments may, in some cases, trigger a heap overflow and result in reading random heap memory, heap corruption and potentially remote code execution. redis · redis | High 8.8 | 77% | · | |
| CVE-2023-36969 | CMS Made Simple v2.2.17 is vulnerable to Remote Command Execution via the File Upload Function. cmsmadesimple · cms made simple | High 8.8 | 49% | 1 exploit | |
| CVE-2023-36932 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), multiple SQL injection vulnerabilities have been identified in the MOVEit Transfer web application that could allow an… progress · moveit transfer | High 8.1 | 81% | · | |
| CVE-2023-36933 | In Progress MOVEit Transfer before 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), it is possible for an attacker to invoke a method that results in an unhandled exception. progress · moveit transfer | High 7.5 | 72% | · | |
| CVE-2023-36469 | XWiki Platform vulnerable to Code injection through NotificationRSSService xwiki · xwiki | High 8.8 | 82% | · | |
| CVE-2023-3450 | The manipulation leads to os command injection. ruijie · rg-bcr860 firmware | High 7.2 | 51% | 1 exploit | |
| CVE-2023-3420 | Type Confusion in V8 in Google Chrome prior to 114.0.5735.198 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. google · chrome | High 8.8 | 56% | · | |
| CVE-2023-35166 | XWiki Platform vulnerable to privilege escalation (PR) from account through TipsPanel xwiki · xwiki | High 8.8 | 62% | · | |
| CVE-2023-35150 | XWiki Platform vulnerable to privilege escalation (PR) from view right via Invitation application xwiki · xwiki | High 8.0 | 78% | · | |
| CVE-2023-32031 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 81% | · | |
| CVE-2023-32029 | Microsoft Excel Remote Code Execution Vulnerability microsoft · excel | High 7.8 | 54% | · | |
| CVE-2023-34468 | Apache NiFi vulnerable to Code Injection apache · nifi | High 8.8 | 62% | 1 exploit | |
| CVE-2023-34096 | In versions 3.06 and prior, the file panorama.pm is vulnerable to a Path Traversal vulnerability which allows an attacker to upload a file to any folder which has write permissions on the affected system. thruk · thruk | High 8.8 | 63% | 6 exploits | |
| CVE-2023-20888 | Aria Operations for Networks contains an authenticated deserialization vulnerability. vmware · vrealize network insight | High 8.8 | 82% | · | |
| CVE-2023-20889 | Aria Operations for Networks contains an information disclosure vulnerability. vmware · vrealize network insight | High 7.5 | 79% | · | |
| CVE-2023-32707 | In versions of Splunk Enterprise below 9.0.5, 8.2.11, and 8.1.14, and Splunk Cloud Platform below version 9.0.2303.100, a low-privileged user who holds a role that has the ‘edit_user’ capability assigned to it can escalate their privileges to that of the admin user by providing… splunk · splunk cloud platform | High 8.8 | 79% | 2 exploits | |
| CVE-2023-2249 | wpForo Forum <= 2.1.7 - Authenticated (Subscriber+) Local File Include, Server-Side Request Forgery, and PHAR Deserialization via file_get_contents gvectors · wpforo forum | High 8.8 | 61% | · | |
| CVE-2023-30253 | Dolibarr vulnerable to remote code execution via uppercase manipulation dolibarr · dolibarr erp\/crm | High 8.8 | 82% | 1 exploit | |
| CVE-2023-2928 | It has been declared as critical. dedecms · dedecms | High 8.8 | 51% | · | |
| CVE-2023-2825 | An unauthenticated malicious user can use a path traversal vulnerability to read arbitrary files on the server when an attachment exists in a public project nested within at least five groups. gitlab · gitlab | High 7.5 | 72% | · | |
| CVE-2023-2766 | The manipulation leads to files or directories accessible. weaver · e-office | High 7.5 | 54% | 1 exploit | |
| CVE-2023-0210 | A bug affects the Linux kernel’s ksmbd NTLMv2 authentication and is known to crash the OS immediately in Linux-based systems. linux · linux kernel | High 7.5 | 72% | · | |
| CVE-2023-32986 | Jenkins File Parameter Plugin arbitrary file write vulnerability jenkins · file parameters | High 8.8 | 61% | · | |
| CVE-2023-28128 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to achieve a remove code execution. ivanti · avalanche | High 7.2 | 85% | 1 exploit | |
| CVE-2023-28127 | A path traversal vulnerability exists in Avalanche version 6.3.x and below that when exploited could result in possible information disclosure. ivanti · avalanche | High 7.5 | 59% | · |
Showing 201–250 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.