Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence · Emerging

Emerging Threats, Before They Hit KEV.

Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.

Synced hourly · figures as of Oct 20, 2026
AnyCriticalHighMediumLowAny signalExploit codeRansomwareOverdue
3,918 vulnerabilities · highest exploit probability first
  • CVE-2011-5124Critical 10.0
    Stack-based buffer overflow in the BCAAA component before build 60258, as used by Blue Coat ProxySG 4.2.3 through 6.1 and ProxyOne, allows remote attackers to execute arbitrary code via a large packet to the synchronization port (16102/tcp).
    bluecoat · proxyone
    EPSS55%
    2 exploits
    Published Aug 26, 2012
  • CVE-2012-4598Critical 9.3
    An unspecified ActiveX control in McAfee Virtual Technician (MVT) before 6.4, and ePO-MVT, allows remote attackers to execute arbitrary code or cause a denial of service (Internet Explorer crash) via a crafted web site.
    mcafee · mcafee virtual technician
    EPSS29%
    3 exploits
    Published Aug 22, 2012
  • CVE-2012-4361High 7.7
    lhn/public/network/ping in HP SAN/iQ before 9.5 on the HP Virtual SAN Appliance allows remote authenticated users to execute arbitrary commands via shell metacharacters in the second parameter.
    hp · san\/iq
    EPSS48%
    5 exploits
    Published Aug 20, 2012
  • CVE-2012-1851Critical 10.0
    Format string vulnerability in the Print Spooler service in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 allows remote attackers to execute arbitrary code via a crafted response,…
    microsoft · windows 7
    EPSS66%
    ·
    Published Aug 14, 2012
  • CVE-2012-4333Critical 10.0
    Multiple stack-based buffer overflows in the BackupToAvi method in the (1) UMS_Ctrl 1.5.1.1 and (2) UMS_Ctrl_STW 2.0.1.0 ActiveX controls in Samsung NET-i viewer 1.37.120316 allow remote attackers to execute arbitrary code via a long string in the fname parameter.
    samsung · net-i viewer
    EPSS60%
    4 exploits
    Published Aug 14, 2012
  • CVE-2012-4177Critical 10.0
    The web browser plugin for Ubisoft Uplay PC before 2.0.4 allows remote attackers to execute arbitrary programs via the -orbit_exe_path command line argument.
    ubi · uplay pc
    EPSS58%
    2 exploits
    Published Aug 7, 2012
  • CVE-2012-3951High 7.5
    The MySQL component in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) 9.0.1.19899 and earlier has a default password of admin for the (1) scrutinizer and (2) scrutremote accounts, which allows remote attackers to execute arbitrary SQL commands via a TCP session.
    sonicwall · scrutinizer
    EPSS52%
    2 exploits
    Published Jul 31, 2012
  • CVE-2012-2962Medium 6.5
    SQL injection vulnerability in d4d/statusFilter.php in Plixer Scrutinizer (aka Dell SonicWALL Scrutinizer) before 9.5.2 allows remote authenticated users to execute arbitrary SQL commands via the q parameter.
    sonicwall · scrutinizer
    EPSS67%
    4 exploits
    Published Jul 30, 2012
  • CVE-2011-2657Medium 6.8
    Directory traversal vulnerability in the LaunchProcess function in the LaunchHelp.HelpLauncher.1 ActiveX control in LaunchHelp.dll in AdminStudio in Novell ZENworks Configuration Management (ZCM) 10.2, 10.3, and 11 SP1 allows remote attackers to execute arbitrary commands via a…
    novell · zenworks configuration management
    EPSS48%
    3 exploits
    Published Jul 26, 2012
  • CVE-2012-2957High 7.2
    The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows local users to gain privileges by modifying files, related to a "file inclusion" issue.
    symantec · web gateway
    EPSS59%
    1 exploit
    Published Jul 23, 2012
  • CVE-2012-2953Critical 10.0
    The management console in Symantec Web Gateway 5.0.x before 5.0.3.18 allows remote attackers to execute arbitrary commands via crafted input to application scripts.
    symantec · web gateway
    EPSS67%
    3 exploits
    Published Jul 23, 2012
  • CVE-2012-0284Critical 9.3
    Stack-based buffer overflow in the SetSource method in the Cisco Linksys PlayerPT ActiveX control 1.0.0.15 in PlayerPT.ocx on the Cisco WVC200 Wireless-G PTZ Internet video camera allows remote attackers to execute arbitrary code via a long URL in the first argument (aka the…
    cisco · linksys playerpt activex control
    EPSS36%
    4 exploits
    Published Jul 19, 2012
  • CVE-2012-4031Medium 5.0
    Multiple directory traversal vulnerabilities in src/acloglogin.php in Wangkongbao CNS-1000 and 1100 allow remote attackers to read arbitrary files via a ..
    wangkongbao · cns-1000
    EPSS52%
    2 exploits
    Published Jul 17, 2012
  • CVE-2012-2763High 7.5
    Buffer overflow in the readstr_upto function in plug-ins/script-fu/tinyscheme/scheme.c in GIMP 2.6.12 and earlier, and possibly 2.6.13, allows remote attackers to execute arbitrary code via a long string in a command to the script-fu server.
    gimp · gimp
    EPSS82%
    3 exploits
    Published Jul 12, 2012
  • CVE-2012-3399High 7.5
    Config/diff.php in Basilic 1.5.14 allows remote attackers to execute arbitrary commands via shell metacharacters in the file parameter.
    artis.imag · basilic
    EPSS65%
    3 exploits
    Published Jul 12, 2012
  • CVE-2012-0911Critical 9.8
    TikiWiki CMS/Groupware before 6.7 LTS and before 8.4 allows remote attackers to execute arbitrary PHP code via a crafted serialized object in the (1) cookieName to lib/banners/bannerlib.php; (2) printpages or (3) printstructures parameter to (a) tiki-print_multi_pages.php or (b)…
    tiki · tikiwiki cms\/groupware
    EPSS63%
    5 exploits
    Published Jul 12, 2012
  • CVE-2012-2020Critical 10.0
    Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1326.
    hp · operations agent
    EPSS65%
    2 exploits
    Published Jul 11, 2012
  • CVE-2012-2019Critical 10.0
    Unspecified vulnerability in HP Operations Agent before 11.03.12 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1325.
    hp · operations agent
    EPSS64%
    2 exploits
    Published Jul 11, 2012
  • CVE-2012-1493High 7.8
    F5 BIG-IP appliances 9.x before 9.4.8-HF5, 10.x before 10.2.4, 11.0.x before 11.0.0-HF2, and 11.1.x before 11.1.0-HF3, and Enterprise Manager before 2.1.0-HF2, 2.2.x before 2.2.0-HF1, and 2.3.x before 2.3.0-HF3, use a single SSH private key across different customers'…
    f5 · enterprise manager
    EPSS63%
    3 exploits
    Published Jul 9, 2012
  • CVE-2012-2516Critical 9.3
    An ActiveX control in KeyHelp.ocx in KeyWorks KeyHelp Module (aka the HTML Help component), as used in GE Intelligent Platforms Proficy Historian 3.1, 3.5, 4.0, and 4.5; Proficy HMI/SCADA iFIX 5.0 and 5.1; Proficy Pulse 1.0; Proficy Batch Execution 5.6; SI7 I/O Driver 7.20…
    ge · intelligent platforms proficy historian
    EPSS40%
    2 exploits
    Published Jul 5, 2012
  • CVE-2012-2515Critical 9.3
    Multiple stack-based buffer overflows in the KeyHelp.KeyCtrl.1 ActiveX control in KeyHelp.ocx 1.2.312 in KeyWorks KeyHelp Module (aka the HTML Help component), as used in EMC Documentum ApplicationXtender Desktop 5.4; EMC Captiva Quickscan Pro 4.6 SP1; GE Intelligent Platforms…
    emc · captiva quickscan pro
    EPSS28%
    1 exploit
    Published Jul 5, 2012
  • CVE-2012-3811Critical 10.0
    Unrestricted file upload vulnerability in ImageUpload.ashx in the Wallboard application in Avaya IP Office Customer Call Reporter 7.0 before 7.0.5.8 Q1 2012 Maintenance Release and 8.0 before 8.0.9.13 Q1 2012 Maintenance Release allows remote attackers to execute arbitrary code…
    avaya · ip office customer call reporter
    EPSS63%
    2 exploits
    Published Jul 3, 2012
  • CVE-2012-3815Critical 9.3
    Buffer overflow in RunTime.exe in Sielco Sistemi Winlog Pro SCADA before 2.07.18 and Winlog Lite SCADA before 2.07.18 allows remote attackers to execute arbitrary code via a crafted packet to TCP port 46824.
    sielcosistemi · winlog lite
    EPSS44%
    3 exploits
    Published Jun 27, 2012
  • CVE-2012-2175Critical 9.3
    Buffer overflow in the Attachment_Times method in a certain ActiveX control in dwa85W.dll in IBM Lotus iNotes 8.5.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a long argument.
    ibm · lotus inotes
    EPSS29%
    2 exploits
    Published Jun 20, 2012
  • CVE-2012-2174Critical 9.3
    The URL handler in IBM Lotus Notes 8.x before 8.5.3 FP2 allows remote attackers to execute arbitrary code via a crafted notes:// URL.
    ibm · lotus notes
    EPSS38%
    2 exploits
    Published Jun 20, 2012
  • CVE-2009-0695High 7.5
    hagent.exe in Wyse Device Manager (WDM) 4.7.x does not require authentication for commands, which allows remote attackers to obtain management access via a crafted query, as demonstrated by a V52 query that triggers a power-off action.
    dell · wyse device manager
    EPSS69%
    4 exploits
    Published Jun 19, 2012
  • CVE-2012-0217High 7.2
    The x86-64 kernel system-call functionality in Xen 4.1.2 and earlier, as used in Citrix XenServer 6.0.2 and earlier and other products; Oracle Solaris 11 and earlier; illumos before r13724; Joyent SmartOS before 20120614T184600Z; FreeBSD before 9.0-RELEASE-p3; NetBSD 6.0 Beta…
    citrix · xenserver
    EPSS40%
    4 exploits
    Published Jun 12, 2012
  • CVE-2012-1876Critical 9.3
    Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by attempting to access a nonexistent object, leading to a heap-based buffer overflow, aka "Col Element Remote…
    microsoft · internet explorer
    EPSS65%
    6 exploits
    Published Jun 12, 2012
  • CVE-2012-1875Critical 9.3
    Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing a deleted object, aka "Same ID Property Remote Code Execution Vulnerability."
    microsoft · internet explorer
    EPSS62%
    2 exploits
    Published Jun 12, 2012
  • CVE-2012-2122Medium 5.1
    mysql: incorrect type cast in check_scramble() leading to authentication bypass
    mariadb · mariadb
    EPSS97%
    1 exploit
    Published Jun 9, 2012
  • CVE-2012-2176Critical 9.3
    Multiple stack-based buffer overflows in a certain ActiveX control in qp2.cab in IBM Lotus Quickr 8.2 before 8.2.0.27-002a for Domino allow remote attackers to execute arbitrary code via a long argument to the (1) Attachment_Times or (2) Import_Times method.
    ibm · lotus quickr
    EPSS32%
    2 exploits
    Published May 25, 2012
  • CVE-2012-2926Critical 9.1
    Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before 4.1.10; FishEye and Crucible before 2.5.8, 2.6 before 2.6.8, and 2.7 before 2.7.12; Bamboo before 3.3.4 and 3.4.x before 3.4.5; and Crowd before 2.0.9, 2.1 before 2.1.2, 2.2 before 2.2.9, 2.3…
    atlassian · bamboo
    EPSS66%
    1 exploit
    Published May 22, 2012
  • CVE-2012-0299Critical 10.0
    The file-management scripts in the management GUI in Symantec Web Gateway 5.0.x before 5.0.3 allow remote attackers to upload arbitrary code to a designated pathname, and possibly execute this code, via unspecified vectors.
    symantec · web gateway
    EPSS64%
    2 exploits
    Published May 21, 2012
  • CVE-2012-0297Critical 10.0
    The management GUI in Symantec Web Gateway 5.0.x before 5.0.3 does not properly restrict access to application scripts, which allows remote attackers to execute arbitrary code by (1) injecting crafted data or (2) including crafted data.
    symantec · web gateway
    EPSS73%
    6 exploits
    Published May 21, 2012
  • CVE-2012-2915Critical 9.3
    Stack-based buffer overflow in Lattice Semiconductor PAC-Designer 6.2.1344 allows remote attackers to execute arbitrary code via a long string in a Value tag in a SymbolicSchematicData definition tag in PAC Design (.pac) file.
    lattice semiconductor · pac-designer
    EPSS29%
    3 exploits
    Published May 21, 2012
  • CVE-2012-0663Critical 9.3
    Multiple stack-based buffer overflows in Apple QuickTime before 7.7.2 on Windows allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a crafted TeXML file.
    apple · quicktime
    EPSS28%
    2 exploits
    Published May 16, 2012
  • CVE-2012-2611Critical 9.3
    The DiagTraceR3Info function in the Dialog processor in disp+work.exe 7010.29.15.58313 and 7200.70.18.23869 in the Dispatcher in SAP NetWeaver 7.0 EHP1 and EHP2, when a certain Developer Trace configuration is enabled, allows remote attackers to execute arbitrary code via a…
    sap · netweaver
    EPSS44%
    4 exploits
    Published May 15, 2012
  • CVE-2012-1675High 7.5
    The TNS Listener, as used in Oracle Database 11g 11.1.0.7, 11.2.0.2, and 11.2.0.3, and 10g 10.2.0.3, 10.2.0.4, and 10.2.0.5, as used in Oracle Fusion Middleware, Enterprise Manager, E-Business Suite, and possibly other products, allows remote attackers to execute arbitrary…
    oracle · database server
    EPSS77%
    ·
    Published May 8, 2012
  • CVE-2012-2329Medium 5.0
    php: buffer overflow flaw in apache_request_headers() in PHP 5.4.x
    php · php
    EPSS62%
    2 exploits
    Published May 8, 2012
  • CVE-2012-0202Critical 10.0
    Multiple stack-based buffer overflows in tm1admsd.exe in the Admin Server in IBM Cognos TM1 9.4.x and 9.5.x before 9.5.2 FP2 allow remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via crafted data.
    ibm · cognos tm1
    EPSS54%
    2 exploits
    Published May 4, 2012
  • CVE-2012-0779Critical 9.3
    flash-plugin: arbitrary code execution via object confusion (APSB12-09)
    adobe · flash player
    EPSS87%
    2 exploits
    Published May 4, 2012
  • CVE-2012-0549High 7.5
    Unspecified vulnerability in the Oracle AutoVue Office component in Oracle Supply Chain Products Suite 20.1.1 allows remote attackers to affect confidentiality, integrity, and availability, related to Desktop API.
    oracle · supply chain products suite
    EPSS59%
    2 exploits
    Published May 3, 2012
  • CVE-2012-2311High 7.5
    php: incomplete CVE-2012-1823 fix - incorrect check for =
    php · php
    EPSS69%
    4 exploits
    Published May 3, 2012
  • CVE-2012-2336Medium 5.0
    php: incomplete CVE-2012-1823 fix - missing filtering of -T and -h
    php · php
    EPSS50%
    4 exploits
    Published May 3, 2012
  • CVE-2012-0708Critical 9.3
    Heap-based buffer overflow in the Ole API in the CQOle ActiveX control in cqole.dll in IBM Rational ClearQuest 7.1.1 before 7.1.1.9, 7.1.2 before 7.1.2.6, and 8.0.0 before 8.0.0.2 allows remote attackers to execute arbitrary code via a crafted web page that leverages a…
    ibm · rational clearquest
    EPSS31%
    2 exploits
    Published Apr 22, 2012
  • CVE-2012-1182Critical 10.0
    The RPC code generator in Samba 3.x before 3.4.16, 3.5.x before 3.5.14, and 3.6.x before 3.6.4 does not implement validation of an array length in a manner consistent with validation of array memory allocation, which allows remote attackers to execute arbitrary code via a…
    samba · samba
    EPSS74%
    2 exploits
    Published Apr 10, 2012
  • CVE-2012-2215Medium 5.0
    Directory traversal vulnerability in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to read arbitrary files via an opcode 0x21 request.
    novell · zenworks configuration management
    EPSS28%
    1 exploit
    Published Apr 9, 2012
  • CVE-2011-3176Critical 10.0
    Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x4c request.
    novell · zenworks configuration management
    EPSS70%
    3 exploits
    Published Apr 9, 2012
  • CVE-2011-3175Critical 10.0
    Stack-based buffer overflow in the Preboot Service in Novell ZENworks Configuration Management (ZCM) 11.1 and 11.1a allows remote attackers to execute arbitrary code via an opcode 0x6c request.
    novell · zenworks configuration management
    EPSS66%
    3 exploits
    Published Apr 9, 2012
  • CVE-2011-4535Medium 6.8
    Buffer overflow in TurboPower Abbrevia before 4.0, as used in ScadaTEC ScadaPhone 5.3.11.1230 and earlier, ScadaTEC ModbusTagServer 4.1.1.81 and earlier, and other products, allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary…
    craig peterson · turbopower abbrevia
    EPSS27%
    3 exploits
    Published Apr 3, 2012
Showing 2,801–2,850 of 3,918

Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.

FAQ

Common Questions.

Which Of These Are On Your Attack Surface?

Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.

How The Scoring WorksRequest A Demo

About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.

Figures as of Oct 20, 2026. Compiled by Brandefense technologies from public vulnerability catalogs; scoring as described in How it works.

To report an error, contact Brandefense.