Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
780 vulnerabilities · highest exploit probability first
- CVE-2022-21145Medium 4.8A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2.lansweeper · lansweeperEPSS78%·Published Apr 14, 2022
- CVE-2022-29036Medium 5.4Cross-site Scripting in Jenkins Credentials Pluginjenkins · credentialsEPSS72%·Published Apr 13, 2022
- CVE-2022-1190Medium 5.4Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc.gitlab · gitlabEPSS88%·Published Apr 4, 2022
- CVE-2022-28379Medium 4.8jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion.nginxproxymanager · nginx proxy managerEPSS71%1 exploitPublished Apr 3, 2022
- CVE-2022-1181Medium 5.4Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2.open-emr · openemrEPSS51%·Published Mar 30, 2022
- CVE-2022-1179Medium 5.4Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.open-emr · openemrEPSS77%·Published Mar 30, 2022
- CVE-2022-1178Medium 5.4Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4.open-emr · openemrEPSS52%·Published Mar 30, 2022
- CVE-2021-4191Medium 5.3Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API.gitlab · gitlabEPSS80%·Published Mar 28, 2022
- CVE-2022-1058Medium 6.1Gitea Open Redirectgitea · giteaEPSS53%·Published Mar 25, 2022
- CVE-2022-0364Medium 5.4Modern Events Calendar Lite <= 6.3.0 - Stored Cross-Site Scriptingwebnus · modern events calendar liteEPSS70%·Published Mar 22, 2022
- CVE-2022-23253Medium 6.5Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerabilitymicrosoft · windows 10EPSS56%·Published Mar 9, 2022
- CVE-2022-0832Medium 5.4Cross-site Scripting in Pimcorepimcore · pimcoreEPSS67%·Published Mar 7, 2022
- CVE-2022-25305Medium 6.1The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that…veronalabs · wp statisticsEPSS79%1 exploitPublished Feb 24, 2022
- CVE-2020-13937Medium 5.3Authentication bypass in Apache Kylinapache · kylinEPSS78%·Published Feb 10, 2022
- CVE-2020-35774Medium 5.4TwitterServer Cross-site Scripting via /histograms endpointtwitter · twitter-serverEPSS86%·Published Feb 9, 2022
- CVE-2022-0218Medium 6.1The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file,…codemiq · wordpress email template designerEPSS66%·Published Feb 4, 2022
- CVE-2021-23174Medium 4.8Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0].wpchill · download monitorEPSS84%·Published Jan 28, 2022
- CVE-2021-46065Medium 4.8A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code.zohocorp · manageengine servicedesk plusEPSS92%1 exploitPublished Jan 27, 2022
- CVE-2021-25080Medium 6.1Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scriptingcrmperks · contact form entriesEPSS84%·Published Jan 25, 2022
- CVE-2022-21280Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysqlEPSS77%·Published Jan 19, 2022
- CVE-2022-21279Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysqlEPSS79%·Published Jan 19, 2022
- CVE-2022-20615Medium 5.4jenkins-2-plugins/matrix-project: does not escape HTML metacharacters which could result in XSSjenkins · matrix projectEPSS82%·Published Jan 13, 2022
- CVE-2022-21662Medium 5.4Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users.wordpress · wordpressEPSS65%·Published Jan 6, 2022
- CVE-2021-21667Medium 5.4Stored XSS vulnerability in Jenkins Scriptler Pluginjenkins · scriptlerEPSS76%·Published Jan 6, 2022
- CVE-2021-21668Medium 5.4Stored XSS vulnerability in Jenkins Scriptler Pluginjenkins · scriptlerEPSS76%·Published Jan 6, 2022
- CVE-2021-44832Medium 6.6Improper Input Validation and Injection in Apache Log4j2apache · log4jEPSS98%·Published Jan 4, 2022
- CVE-2021-43942Medium 6.1Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint.atlassian · jira serverEPSS55%·Published Jan 4, 2022
- CVE-2021-45105Medium 5.9Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursionapache · log4jEPSS100%·Published Dec 18, 2021
- CVE-2021-36450Medium 6.1Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter.verint · workforce optimizationEPSS64%·Published Dec 15, 2021
- CVE-2020-26259Medium 6.8In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling.xstream · xstreamEPSS82%·Published Dec 13, 2021
- CVE-2021-41951Medium 6.1ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter.montala · resourcespaceEPSS78%·Published Nov 15, 2021
- CVE-2021-21699Medium 5.4Stored XSS vulnerability in Jenkins Active Choices Pluginjenkins · active choicesEPSS88%·Published Nov 15, 2021
- CVE-2021-41349Medium 6.5Microsoft Exchange Server Spoofing Vulnerabilitymicrosoft · exchange serverEPSS93%·Published Nov 9, 2021
- CVE-2021-41174Medium 6.1XSS vulnerability allowing arbitrary JavaScript executiongrafana · grafanaEPSS85%·Published Nov 8, 2021
- CVE-2021-39906Medium 6.1Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf.gitlab · gitlabEPSS61%·Published Nov 4, 2021
- CVE-2021-28169Medium 5.3For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory.eclipse · jettyEPSS78%·Published Oct 21, 2021
- CVE-2021-35590Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS88%·Published Oct 21, 2021
- CVE-2021-35592Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS52%·Published Oct 21, 2021
- CVE-2021-35598Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS51%·Published Oct 21, 2021
- CVE-2021-35594Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS51%·Published Oct 21, 2021
- CVE-2021-35593Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS51%·Published Oct 21, 2021
- CVE-2021-35621Medium 6.3Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster.oracle · mysql clusterEPSS50%·Published Oct 21, 2021
- CVE-2021-21745Medium 4.3ZTE MF971R product has a Referer authentication bypass vulnerability.zte · mf971r firmwareEPSS56%·Published Oct 20, 2021
- CVE-2013-3630Medium 4.6Moodle Authenticated Spelling Binary Remote Code Executionmoodle · moodleEPSS42%3 exploitsPublished Oct 13, 2021
- CVE-2021-28125Medium 6.1Open Redirect in Apache Supersetapache · supersetEPSS64%·Published Oct 6, 2021
- CVE-2021-36749Medium 6.5Druid ingestion system Authenticated users can read data from other sources than intendedapache · druidEPSS81%·Published Sep 27, 2021
- CVE-2021-39327Medium 5.3The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files.ait-pro · bulletproof securityEPSS72%3 exploitsPublished Sep 17, 2021
- CVE-2021-38156Medium 5.4In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard.nagios · nagios xiEPSS93%·Published Sep 15, 2021
- CVE-2021-30641Medium 5.3Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF'apache · http serverEPSS53%·Published Sep 3, 2021
- CVE-2021-22242Medium 5.4Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdowngitlab · gitlabEPSS64%·Published Aug 25, 2021
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-21145 | A stored cross-site scripting vulnerability exists in the WebUserActions.aspx functionality of Lansweeper lansweeper 9.1.20.2. lansweeper · lansweeper | Medium 4.8 | 78% | · | |
| CVE-2022-29036 | Cross-site Scripting in Jenkins Credentials Plugin jenkins · credentials | Medium 5.4 | 72% | · | |
| CVE-2022-1190 | Improper handling of user input in GitLab CE/EE versions 8.3 prior to 14.7.7, 14.8 prior to 14.8.5, and 14.9 prior to 14.9.2 allowed an attacker to exploit a stored XSS by abusing multi-word milestone references in issue descriptions, comments, etc. gitlab · gitlab | Medium 5.4 | 88% | · | |
| CVE-2022-28379 | jc21.com Nginx Proxy Manager before 2.9.17 allows XSS during item deletion. nginxproxymanager · nginx proxy manager | Medium 4.8 | 71% | 1 exploit | |
| CVE-2022-1181 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.2. open-emr · openemr | Medium 5.4 | 51% | · | |
| CVE-2022-1179 | Non-Privilege User Can Created New Rule and Lead to Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. open-emr · openemr | Medium 5.4 | 77% | · | |
| CVE-2022-1178 | Stored Cross Site Scripting in GitHub repository openemr/openemr prior to 6.0.0.4. open-emr · openemr | Medium 5.4 | 52% | · | |
| CVE-2021-4191 | Private GitLab instances with restricted sign-ups may be vulnerable to user enumeration to unauthenticated users through the GraphQL API. gitlab · gitlab | Medium 5.3 | 80% | · | |
| CVE-2022-1058 | Gitea Open Redirect gitea · gitea | Medium 6.1 | 53% | · | |
| CVE-2022-0364 | Modern Events Calendar Lite <= 6.3.0 - Stored Cross-Site Scripting webnus · modern events calendar lite | Medium 5.4 | 70% | · | |
| CVE-2022-23253 | Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability microsoft · windows 10 | Medium 6.5 | 56% | · | |
| CVE-2022-0832 | Cross-site Scripting in Pimcore pimcore · pimcore | Medium 5.4 | 67% | · | |
| CVE-2022-25305 | The WP Statistics WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the IP parameter found in the ~/includes/class-wp-statistics-ip.php file which allows attackers to inject arbitrary web scripts onto several pages that… veronalabs · wp statistics | Medium 6.1 | 79% | 1 exploit | |
| CVE-2020-13937 | Authentication bypass in Apache Kylin apache · kylin | Medium 5.3 | 78% | · | |
| CVE-2020-35774 | TwitterServer Cross-site Scripting via /histograms endpoint twitter · twitter-server | Medium 5.4 | 86% | · | |
| CVE-2022-0218 | The WP HTML Mail WordPress plugin is vulnerable to unauthorized access which allows unauthenticated attackers to retrieve and modify theme settings due to a missing capability check on the /themesettings REST-API endpoint found in the ~/includes/class-template-designer.php file,… codemiq · wordpress email template designer | Medium 6.1 | 66% | · | |
| CVE-2021-23174 | Authenticated (admin+) Persistent Cross-Site Scripting (XSS) vulnerability discovered in Download Monitor WordPress plugin (versions <= 4.4.6) Vulnerable parameters: &post_title, &downloadable_file_version[0]. wpchill · download monitor | Medium 4.8 | 84% | · | |
| CVE-2021-46065 | A Cross-site scripting (XSS) vulnerability in Secondary Email Field in Zoho ManageEngine ServiceDesk Plus 11.3 Build 11306 allows an attackers to inject arbitrary JavaScript code. zohocorp · manageengine servicedesk plus | Medium 4.8 | 92% | 1 exploit | |
| CVE-2021-25080 | Contact Form Entries <= 1.1.6 - Unauthenticated Stored Cross-Site Scripting crmperks · contact form entries | Medium 6.1 | 84% | · | |
| CVE-2022-21280 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql | Medium 6.3 | 77% | · | |
| CVE-2022-21279 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql | Medium 6.3 | 79% | · | |
| CVE-2022-20615 | jenkins-2-plugins/matrix-project: does not escape HTML metacharacters which could result in XSS jenkins · matrix project | Medium 5.4 | 82% | · | |
| CVE-2022-21662 | Low-privileged authenticated users (like author) in WordPress core are able to execute JavaScript/perform stored XSS attack, which can affect high-privileged users. wordpress · wordpress | Medium 5.4 | 65% | · | |
| CVE-2021-21667 | Stored XSS vulnerability in Jenkins Scriptler Plugin jenkins · scriptler | Medium 5.4 | 76% | · | |
| CVE-2021-21668 | Stored XSS vulnerability in Jenkins Scriptler Plugin jenkins · scriptler | Medium 5.4 | 76% | · | |
| CVE-2021-44832 | Improper Input Validation and Injection in Apache Log4j2 apache · log4j | Medium 6.6 | 98% | · | |
| CVE-2021-43942 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a Reflected Cross-Site Scripting (XSS) vulnerability in the /rest/collectors/1.0/template/custom endpoint. atlassian · jira server | Medium 6.1 | 55% | · | |
| CVE-2021-45105 | Apache Log4j2 vulnerable to Improper Input Validation and Uncontrolled Recursion apache · log4j | Medium 5.9 | 100% | · | |
| CVE-2021-36450 | Verint Workforce Optimization (WFO) 15.2.8.10048 allows XSS via the control/my_notifications NEWUINAV parameter. verint · workforce optimization | Medium 6.1 | 64% | · | |
| CVE-2020-26259 | In XStream before version 1.4.15, is vulnerable to an Arbitrary File Deletion on the local host when unmarshalling. xstream · xstream | Medium 6.8 | 82% | · | |
| CVE-2021-41951 | ResourceSpace before 9.6 rev 18290 is affected by a reflected Cross-Site Scripting vulnerability in plugins/wordpress_sso/pages/index.php via the wordpress_user parameter. montala · resourcespace | Medium 6.1 | 78% | · | |
| CVE-2021-21699 | Stored XSS vulnerability in Jenkins Active Choices Plugin jenkins · active choices | Medium 5.4 | 88% | · | |
| CVE-2021-41349 | Microsoft Exchange Server Spoofing Vulnerability microsoft · exchange server | Medium 6.5 | 93% | · | |
| CVE-2021-41174 | XSS vulnerability allowing arbitrary JavaScript execution grafana · grafana | Medium 6.1 | 85% | · | |
| CVE-2021-39906 | Improper validation of ipynb files in GitLab CE/EE version 13.5 and above allows an attacker to execute arbitrary JavaScript code on the victim's behalf. gitlab · gitlab | Medium 6.1 | 61% | · | |
| CVE-2021-28169 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. eclipse · jetty | Medium 5.3 | 78% | · | |
| CVE-2021-35590 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 88% | · | |
| CVE-2021-35592 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 52% | · | |
| CVE-2021-35598 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 51% | · | |
| CVE-2021-35594 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 51% | · | |
| CVE-2021-35593 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 51% | · | |
| CVE-2021-35621 | Difficult to exploit vulnerability allows high privileged attacker with access to the physical communication segment attached to the hardware where the MySQL Cluster executes to compromise MySQL Cluster. oracle · mysql cluster | Medium 6.3 | 50% | · | |
| CVE-2021-21745 | ZTE MF971R product has a Referer authentication bypass vulnerability. zte · mf971r firmware | Medium 4.3 | 56% | · | |
| CVE-2013-3630 | Moodle Authenticated Spelling Binary Remote Code Execution moodle · moodle | Medium 4.6 | 42% | 3 exploits | |
| CVE-2021-28125 | Open Redirect in Apache Superset apache · superset | Medium 6.1 | 64% | · | |
| CVE-2021-36749 | Druid ingestion system Authenticated users can read data from other sources than intended apache · druid | Medium 6.5 | 81% | · | |
| CVE-2021-39327 | The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. ait-pro · bulletproof security | Medium 5.3 | 72% | 3 exploits | |
| CVE-2021-38156 | In Nagios XI before 5.8.6, XSS exists in the dashboard page (/dashboards/#) when administrative users attempt to edit a dashboard. nagios · nagios xi | Medium 5.4 | 93% | · | |
| CVE-2021-30641 | Apache HTTP Server versions 2.4.39 to 2.4.46 Unexpected matching behavior with 'MergeSlashes OFF' apache · http server | Medium 5.3 | 53% | · | |
| CVE-2021-22242 | Insufficient input sanitization in Mermaid markdown in GitLab CE/EE version 11.4 and up allows an attacker to exploit a stored cross-site scripting vulnerability via a specially-crafted markdown gitlab · gitlab | Medium 5.4 | 64% | · |
Showing 201–250 of 780
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.