Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2024-29825High 8.8An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.ivanti · endpoint managerEPSS100%·Published May 31, 2024
- CVE-2024-29823High 8.8An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.ivanti · endpoint managerEPSS100%·Published May 31, 2024
- CVE-2024-29822High 8.8An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code.ivanti · endpoint managerEPSS64%·Published May 31, 2024
- CVE-2024-37032High 8.8Ollama does not validate the format of the digest (sha256 with 64 hex digits)ollama · ollamaEPSS90%1 exploitPublished May 31, 2024
- CVE-2024-5084Critical 9.8Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Executionhashthemes · hash formEPSS51%1 exploitPublished May 24, 2024
- CVE-2024-21683High 8.8This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server.atlassian · confluence data centerEPSS88%Ransomware1 exploit1 actorPublished May 22, 2024
- CVE-2024-27954Critical 9.3Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request ForgeryEPSS73%·Published May 20, 2024
- CVE-2024-22120High 8.8Zabbix server can perform command execution for configured scripts.zabbix · zabbixEPSS77%·Published May 17, 2024
- CVE-2024-26594High 7.1Linux kernel: ksmbd: validate mech token in session setuplinux · linux kernelEPSS51%·Published May 16, 2024
- CVE-2024-4367Medium 5.6PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFmozilla · firefoxEPSS71%·Published May 15, 2024
- CVE-2024-34716Medium 6.1PrestaShop cross-site scripting via customer contact form in FO, through file uploadprestashop · prestashopEPSS56%·Published May 15, 2024
- CVE-2024-30044High 7.2Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS84%·Published May 15, 2024
- CVE-2024-30043High 7.5Microsoft SharePoint Server Information Disclosure Vulnerabilitymicrosoft · sharepoint serverEPSS56%·Published May 15, 2024
- CVE-2022-31097Medium 6.3Grafana Stored Cross-site Scripting in Unified Alertinggrafana · grafanaEPSS70%·Published May 14, 2024
- CVE-2024-25641High 7.2Cacti provides an operational monitoring and fault management framework.cacti · cactiEPSS86%3 exploitsPublished May 14, 2024
- CVE-2024-28075High 8.0The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability.solarwinds · access rights managerEPSS78%·Published May 14, 2024
- CVE-2024-29895Critical 10.0Cacti provides an operational monitoring and fault management framework.EPSS99%·Published May 13, 2024
- CVE-2024-32964Critical 9.0lobe-chat /api/proxy endpoint Server-Side Request Forgery vulnerabilitylobehub · lobe chatEPSS53%·Published May 10, 2024
- CVE-2024-31456Medium 6.5Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search.glpi-project · glpiEPSS59%·Published May 7, 2024
- CVE-2024-29889High 8.1Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it.glpi-project · glpiEPSS65%·Published May 7, 2024
- CVE-2024-4548Critical 9.8An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator.deltaww · diaenergieEPSS29%1 exploitPublished May 6, 2024
- CVE-2024-4439Medium 6.1WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Blockwordpress · wordpressEPSS71%·Published May 6, 2024
- CVE-2023-40504Critical 9.8LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability.lg · simple editorEPSS89%1 exploitPublished May 3, 2024
- CVE-2023-40498Critical 9.8LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability.lg · simple editorEPSS85%1 exploitPublished May 3, 2024
- CVE-2023-40502Critical 9.1LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability.lg · simple editorEPSS83%·Published May 3, 2024
- CVE-2023-40494Critical 9.1LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability.lg · simple editorEPSS83%·Published May 3, 2024
- CVE-2023-40492Critical 9.1LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability.lg · simple editorEPSS83%·Published May 3, 2024
- CVE-2023-40496High 7.5LG Simple Editor copyStickerContent Directory Traversal Information Disclosure Vulnerability.lg · simple editorEPSS76%·Published May 3, 2024
- CVE-2023-40495High 7.5LG Simple Editor copyTemplateAll Directory Traversal Information Disclosure Vulnerability.lg · simple editorEPSS76%·Published May 3, 2024
- CVE-2023-40497Critical 9.8LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability.lg · simple editorEPSS69%·Published May 3, 2024
- CVE-2023-38096Critical 9.8NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability.netgear · prosafe network management systemEPSS82%1 exploitPublished May 3, 2024
- CVE-2023-38095High 8.8NETGEAR ProSAFE Network Management System MFileUploadController Unrestricted File Upload Remote Code Execution Vulnerability.netgear · prosafe network management systemEPSS66%·Published May 3, 2024
- CVE-2023-41182High 8.8NETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution Vulnerability.netgear · prosafe network management systemEPSS62%·Published May 3, 2024
- CVE-2023-38099High 8.8NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability.netgear · prosafe network management systemEPSS57%·Published May 3, 2024
- CVE-2023-44450High 8.8NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability.netgear · prosafe network management systemEPSS54%·Published May 3, 2024
- CVE-2023-50231Critical 9.6NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability.netgear · prosafe network management systemEPSS53%·Published May 3, 2024
- CVE-2023-44449High 8.8NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability.netgear · prosafe network management systemEPSS53%·Published May 3, 2024
- CVE-2023-39475Critical 9.8Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS64%·Published May 3, 2024
- CVE-2023-39473High 8.8Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS62%·Published May 3, 2024
- CVE-2023-38124High 8.8Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS60%·Published May 3, 2024
- CVE-2023-50218High 8.8Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS55%·Published May 3, 2024
- CVE-2023-50223High 8.8Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability.inductiveautomation · ignitionEPSS55%·Published May 3, 2024
- CVE-2023-32164High 7.5D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability.dlink · d-view 8EPSS85%·Published May 3, 2024
- CVE-2023-44412High 8.2D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability.dlink · d-view 8EPSS82%·Published May 3, 2024
- CVE-2023-32167Medium 6.5D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability.dlink · d-view 8EPSS77%·Published May 3, 2024
- CVE-2023-32166High 8.1D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability.dlink · d-view 8EPSS74%·Published May 3, 2024
- CVE-2023-32165Critical 9.8D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability.dlink · d-view 8EPSS73%·Published May 3, 2024
- CVE-2023-32169Critical 9.8D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability.dlink · d-view 8EPSS56%·Published May 3, 2024
- CVE-2024-2876Critical 9.8Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL InjectionEPSS81%·Published May 3, 2024
- CVE-2023-44444High 7.8GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability.gimp · gimpEPSS56%·Published May 3, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-29825 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. ivanti · endpoint manager | High 8.8 | 100% | · | |
| CVE-2024-29823 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. ivanti · endpoint manager | High 8.8 | 100% | · | |
| CVE-2024-29822 | An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated attacker within the same network to execute arbitrary code. ivanti · endpoint manager | High 8.8 | 64% | · | |
| CVE-2024-37032 | Ollama does not validate the format of the digest (sha256 with 64 hex digits) ollama · ollama | High 8.8 | 90% | 1 exploit | |
| CVE-2024-5084 | Hash Form – Drag & Drop Form Builder <= 1.1.0 - Unauthenticated Arbitrary File Upload to Remote Code Execution hashthemes · hash form | Critical 9.8 | 51% | 1 exploit | |
| CVE-2024-21683 | This High severity RCE (Remote Code Execution) vulnerability was introduced in version 5.2 of Confluence Data Center and Server. atlassian · confluence data center | High 8.8 | 88% | Ransomware1 exploit1 actor | |
| CVE-2024-27954 | Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery | Critical 9.3 | 73% | · | |
| CVE-2024-22120 | Zabbix server can perform command execution for configured scripts. zabbix · zabbix | High 8.8 | 77% | · | |
| CVE-2024-26594 | Linux kernel: ksmbd: validate mech token in session setup linux · linux kernel | High 7.1 | 51% | · | |
| CVE-2024-4367 | PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF mozilla · firefox | Medium 5.6 | 71% | · | |
| CVE-2024-34716 | PrestaShop cross-site scripting via customer contact form in FO, through file upload prestashop · prestashop | Medium 6.1 | 56% | · | |
| CVE-2024-30044 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 7.2 | 84% | · | |
| CVE-2024-30043 | Microsoft SharePoint Server Information Disclosure Vulnerability microsoft · sharepoint server | High 7.5 | 56% | · | |
| CVE-2022-31097 | Grafana Stored Cross-site Scripting in Unified Alerting grafana · grafana | Medium 6.3 | 70% | · | |
| CVE-2024-25641 | Cacti provides an operational monitoring and fault management framework. cacti · cacti | High 7.2 | 86% | 3 exploits | |
| CVE-2024-28075 | The SolarWinds Access Rights Manager was susceptible to Remote Code Execution Vulnerability. solarwinds · access rights manager | High 8.0 | 78% | · | |
| CVE-2024-29895 | Cacti provides an operational monitoring and fault management framework. | Critical 10.0 | 99% | · | |
| CVE-2024-32964 | lobe-chat /api/proxy endpoint Server-Side Request Forgery vulnerability lobehub · lobe chat | Critical 9.0 | 53% | · | |
| CVE-2024-31456 | Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. glpi-project · glpi | Medium 6.5 | 59% | · | |
| CVE-2024-29889 | Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability in the saved searches feature to alter another user account data take control of it. glpi-project · glpi | High 8.1 | 65% | · | |
| CVE-2024-4548 | An SQLi vulnerability exists in Delta Electronics DIAEnergie v1.10.1.8610 and prior when CEBC.exe processes a 'RecalculateHDMWYC' message, which is split into 4 fields using the '~' character as the separator. deltaww · diaenergie | Critical 9.8 | 29% | 1 exploit | |
| CVE-2024-4439 | WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block wordpress · wordpress | Medium 6.1 | 71% | · | |
| CVE-2023-40504 | LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 89% | 1 exploit | |
| CVE-2023-40498 | LG Simple Editor cp Command Directory Traversal Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 85% | 1 exploit | |
| CVE-2023-40502 | LG Simple Editor cropImage Directory Traversal Arbitrary File Deletion Vulnerability. lg · simple editor | Critical 9.1 | 83% | · | |
| CVE-2023-40494 | LG Simple Editor deleteFolder Directory Traversal Arbitrary File Deletion Vulnerability. lg · simple editor | Critical 9.1 | 83% | · | |
| CVE-2023-40492 | LG Simple Editor deleteCheckSession Directory Traversal Arbitrary File Deletion Vulnerability. lg · simple editor | Critical 9.1 | 83% | · | |
| CVE-2023-40496 | LG Simple Editor copyStickerContent Directory Traversal Information Disclosure Vulnerability. lg · simple editor | High 7.5 | 76% | · | |
| CVE-2023-40495 | LG Simple Editor copyTemplateAll Directory Traversal Information Disclosure Vulnerability. lg · simple editor | High 7.5 | 76% | · | |
| CVE-2023-40497 | LG Simple Editor saveXml Directory Traversal Remote Code Execution Vulnerability. lg · simple editor | Critical 9.8 | 69% | · | |
| CVE-2023-38096 | NETGEAR ProSAFE Network Management System MyHandlerInterceptor Authentication Bypass Vulnerability. netgear · prosafe network management system | Critical 9.8 | 82% | 1 exploit | |
| CVE-2023-38095 | NETGEAR ProSAFE Network Management System MFileUploadController Unrestricted File Upload Remote Code Execution Vulnerability. netgear · prosafe network management system | High 8.8 | 66% | · | |
| CVE-2023-41182 | NETGEAR ProSAFE Network Management System ZipUtils Directory Traversal Remote Code Execution Vulnerability. netgear · prosafe network management system | High 8.8 | 62% | · | |
| CVE-2023-38099 | NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. netgear · prosafe network management system | High 8.8 | 57% | · | |
| CVE-2023-44450 | NETGEAR ProSAFE Network Management System getNodesByTopologyMapSearch SQL Injection Remote Code Execution Vulnerability. netgear · prosafe network management system | High 8.8 | 54% | · | |
| CVE-2023-50231 | NETGEAR ProSAFE Network Management System saveNodeLabel Cross-Site Scripting Privilege Escalation Vulnerability. netgear · prosafe network management system | Critical 9.6 | 53% | · | |
| CVE-2023-44449 | NETGEAR ProSAFE Network Management System clearAlertByIds SQL Injection Privilege Escalation Vulnerability. netgear · prosafe network management system | High 8.8 | 53% | · | |
| CVE-2023-39475 | Inductive Automation Ignition ParameterVersionJavaSerializationCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. inductiveautomation · ignition | Critical 9.8 | 64% | · | |
| CVE-2023-39473 | Inductive Automation Ignition AbstractGatewayFunction Deserialization of Untrusted Data Remote Code Execution Vulnerability. inductiveautomation · ignition | High 8.8 | 62% | · | |
| CVE-2023-38124 | Inductive Automation Ignition OPC UA Quick Client Task Scheduling Exposed Dangerous Function Remote Code Execution Vulnerability. inductiveautomation · ignition | High 8.8 | 60% | · | |
| CVE-2023-50218 | Inductive Automation Ignition ModuleInvoke Deserialization of Untrusted Data Remote Code Execution Vulnerability. inductiveautomation · ignition | High 8.8 | 55% | · | |
| CVE-2023-50223 | Inductive Automation Ignition ExtendedDocumentCodec Deserialization of Untrusted Data Remote Code Execution Vulnerability. inductiveautomation · ignition | High 8.8 | 55% | · | |
| CVE-2023-32164 | D-Link D-View TftpSendFileThread Directory Traversal Information Disclosure Vulnerability. dlink · d-view 8 | High 7.5 | 85% | · | |
| CVE-2023-44412 | D-Link D-View addDv7Probe XML External Entity Processing Information Disclosure Vulnerability. dlink · d-view 8 | High 8.2 | 82% | · | |
| CVE-2023-32167 | D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability. dlink · d-view 8 | Medium 6.5 | 77% | · | |
| CVE-2023-32166 | D-Link D-View uploadFile Directory Traversal Arbitrary File Creation Vulnerability. dlink · d-view 8 | High 8.1 | 74% | · | |
| CVE-2023-32165 | D-Link D-View TftpReceiveFileHandler Directory Traversal Remote Code Execution Vulnerability. dlink · d-view 8 | Critical 9.8 | 73% | · | |
| CVE-2023-32169 | D-Link D-View Use of Hard-coded Cryptographic Key Authentication Bypass Vulnerability. dlink · d-view 8 | Critical 9.8 | 56% | · | |
| CVE-2024-2876 | Icegram Express - Email Subscribers, Newsletters and Marketing Automation Plugin <= 5.7.14 - Unauthenticated SQL Injection | Critical 9.8 | 81% | · | |
| CVE-2023-44444 | GIMP PSP File Parsing Off-By-One Remote Code Execution Vulnerability. gimp · gimp | High 7.8 | 56% | · |
Showing 251–300 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.