Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2023-37582Critical 9.8RocketMQ NameServer component Code Injection vulnerabilityapache · rocketmqEPSS90%·Published Jul 12, 2023
- CVE-2022-24697Critical 9.8Apache Kylin vulnerable to remote code executionapache · kylinEPSS85%·Published Jul 6, 2023
- CVE-2023-36934Critical 9.1In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated…progress · moveit transferEPSS95%·Published Jul 6, 2023
- CVE-2023-36808Critical 9.8Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack.glpi-project · glpiEPSS52%·Published Jul 5, 2023
- CVE-2023-35924Critical 9.8Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack.glpi-project · glpiEPSS52%·Published Jul 5, 2023
- CVE-2023-3460Critical 9.8The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will.ultimatemember · ultimate memberEPSS72%1 exploitPublished Jul 4, 2023
- CVE-2023-2068Critical 9.8The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode.advancedfilemanager · file manager advanced shortcodeEPSS40%3 exploitsPublished Jun 27, 2023
- CVE-2023-32521Critical 9.1A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files.trendmicro · mobile securityEPSS67%·Published Jun 26, 2023
- CVE-2023-30258Critical 9.8Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.magnussolution · magnusbillingEPSS94%2 exploitsPublished Jun 23, 2023
- CVE-2023-29711Critical 9.8An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request.interlink · psg-5124 firmwareEPSS70%1 exploitPublished Jun 22, 2023
- CVE-2023-35885Critical 9.8CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication.mgt-commerce · cloudpanelEPSS75%1 exploitPublished Jun 20, 2023
- CVE-2018-1160Critical 9.8Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c.netatalk · netatalkEPSS87%7 exploitsPublished Jun 20, 2023
- CVE-2023-35813Critical 9.8Multiple Sitecore products allow remote code execution.sitecore · experience commerceEPSS87%·Published Jun 17, 2023
- CVE-2023-35708Critical 9.8In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain…progress · moveit transferEPSS97%·Published Jun 16, 2023
- CVE-2023-3224Critical 9.2nuxt Code Injection vulnerabilitynuxt · nuxtEPSS59%·Published Jun 13, 2023
- CVE-2023-33625Critical 9.8D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function.dlink · dir-600 firmwareEPSS33%3 exploitsPublished Jun 12, 2023
- CVE-2023-2732Critical 9.8MStore API <= 3.9.2 - Authentication Bypassinspireui · mstore apiEPSS67%·Published May 23, 2023
- CVE-2023-29919Critical 9.8SolarView Compact <= 6.0 is vulnerable to Insecure Permissions.contec · solarview compact firmwareEPSS60%1 exploitPublished May 22, 2023
- CVE-2022-42889Critical 9.8Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded.apache · commons textEPSS100%2 exploitsPublished May 18, 2023
- CVE-2023-32243Critical 9.8Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalationwpdeveloper · essential addons for elementorEPSS76%1 exploitPublished May 15, 2023
- CVE-2023-1698Critical 9.8In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise.wago · compact controller 100 firmwareEPSS82%·Published May 15, 2023
- CVE-2023-27823Critical 9.8An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials.optoma · 1080pstxEPSS54%1 exploitPublished May 12, 2023
- CVE-2023-32071Critical 9.0XWiki Platform vulnerable to RXSS via editor parameter - importinline templatexwiki · xwikiEPSS70%·Published May 9, 2023
- CVE-2023-24941Critical 9.8Windows Network File System Remote Code Execution Vulnerabilitymicrosoft · windows server 2012EPSS95%·Published May 9, 2023
- CVE-2023-30013Critical 9.8TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg.totolink · x5000r firmwareEPSS26%2 exploitsPublished May 5, 2023
- CVE-2023-25826Critical 9.8Command injection in OpenTSDBopentsdb · opentsdbEPSS43%1 exploitPublished May 3, 2023
- CVE-2023-20864Critical 9.8VMware Aria Operations for Logs contains a deserialization vulnerability.vmware · aria operations for logsEPSS70%·Published Apr 20, 2023
- CVE-2023-30547Critical 10.0vm2 Sandbox Escape vulnerabilityvm2 project · vm2EPSS73%·Published Apr 20, 2023
- CVE-2023-22621Critical 10.0Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Pluginstrapi · strapiEPSS71%·Published Apr 19, 2023
- CVE-2023-21554Critical 9.8Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerabilitymicrosoft · windows 10 1607EPSS95%·Published Apr 14, 2023
- CVE-2023-28121Critical 9.8An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator.automattic · woocommerce paymentsEPSS87%·Published Apr 12, 2023
- CVE-2023-29017Critical 9.8vm2 vulnerable to sandbox escapevm2 project · vm2EPSS63%·Published Apr 7, 2023
- CVE-2023-25076Critical 9.8A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba).sniproxy project · sniproxyEPSS66%·Published Mar 30, 2023
- CVE-2023-28503Critical 9.8Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication…rocketsoftware · unidataEPSS62%1 exploitPublished Mar 29, 2023
- CVE-2023-28502Critical 9.8Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user.rocketsoftware · unidataEPSS61%1 exploitPublished Mar 29, 2023
- CVE-2022-36981Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101.ivanti · avalancheEPSS83%·Published Mar 29, 2023
- CVE-2022-36974Critical 9.8This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490.ivanti · avalancheEPSS84%·Published Mar 29, 2023
- CVE-2022-2560Critical 9.1This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server.enterprisedt · completeftp serverEPSS78%·Published Mar 29, 2023
- CVE-2023-1133Critical 9.8Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default.deltaww · infrasuite device masterEPSS50%1 exploitPublished Mar 27, 2023
- CVE-2023-26801Critical 9.8LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg.lb-link · bl-ac1900 firmwareEPSS70%1 exploitPublished Mar 26, 2023
- CVE-2023-1177Critical 9.3mlflow is vulnerable to remote file access in mlflow server and mlflow ui CLIslfprojects · mlflowEPSS70%·Published Mar 24, 2023
- CVE-2023-27034Critical 9.8PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability.joommasters · jms blogEPSS59%·Published Mar 23, 2023
- CVE-2022-43781Critical 9.8There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center.atlassian · bitbucketEPSS98%1 exploitPublished Mar 20, 2023
- CVE-2023-28343Critical 9.8OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php.apsystems · energy communication unit firmwareEPSS85%2 exploitsPublished Mar 14, 2023
- CVE-2023-27482Critical 10.0A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered.home-assistant · home-assistantEPSS72%·Published Mar 8, 2023
- CVE-2021-36393Critical 9.8Moodle SQL Injection vulnerabilitymoodle · moodleEPSS52%·Published Mar 6, 2023
- CVE-2023-26477Critical 9.8org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwikiEPSS75%1 exploitPublished Mar 3, 2023
- CVE-2023-27372Critical 9.8SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled.spip · spipEPSS100%2 exploitsPublished Feb 28, 2023
- CVE-2022-2024Critical 9.8Gogs OS Command Injection vulnerabilitygogs · gogsEPSS98%·Published Feb 28, 2023
- CVE-2023-26035Critical 9.8Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization.zoneminder · zoneminderEPSS80%1 exploitPublished Feb 25, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-37582 | RocketMQ NameServer component Code Injection vulnerability apache · rocketmq | Critical 9.8 | 90% | · | |
| CVE-2022-24697 | Apache Kylin vulnerable to remote code execution apache · kylin | Critical 9.8 | 85% | · | |
| CVE-2023-36934 | In Progress MOVEit Transfer before 2020.1.11 (12.1.11), 2021.0.9 (13.0.9), 2021.1.7 (13.1.7), 2022.0.7 (14.0.7), 2022.1.8 (14.1.8), and 2023.0.4 (15.0.4), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated… progress · moveit transfer | Critical 9.1 | 95% | · | |
| CVE-2023-36808 | Starting in version 0.80 and prior to version 10.0.8, Computer Virtual Machine form and GLPI inventory request can be used to perform a SQL injection attack. glpi-project · glpi | Critical 9.8 | 52% | · | |
| CVE-2023-35924 | Starting in version 10.0.0 and prior to version 10.0.8, GLPI inventory endpoint can be used to drive a SQL injection attack. glpi-project · glpi | Critical 9.8 | 52% | · | |
| CVE-2023-3460 | The Ultimate Member WordPress plugin before 2.6.7 does not prevent visitors from creating user accounts with arbitrary capabilities, effectively allowing attackers to create administrator accounts at will. ultimatemember · ultimate member | Critical 9.8 | 72% | 1 exploit | |
| CVE-2023-2068 | The File Manager Advanced Shortcode WordPress plugin through 2.3.2 does not adequately prevent uploading files with disallowed MIME types when using the shortcode. advancedfilemanager · file manager advanced shortcode | Critical 9.8 | 40% | 3 exploits | |
| CVE-2023-32521 | A path traversal exists in a specific service dll of Trend Micro Mobile Security (Enterprise) 9.8 SP5 which could allow an unauthenticated remote attacker to delete arbitrary files. trendmicro · mobile security | Critical 9.1 | 67% | · | |
| CVE-2023-30258 | Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request. magnussolution · magnusbilling | Critical 9.8 | 94% | 2 exploits | |
| CVE-2023-29711 | An incorrect access control issue was discovered in Interlink PSG-5124 version 1.0.4, allows attackers to execute arbitrary code via crafted GET request. interlink · psg-5124 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2023-35885 | CloudPanel 2 before 2.3.1 has insecure file-manager cookie authentication. mgt-commerce · cloudpanel | Critical 9.8 | 75% | 1 exploit | |
| CVE-2018-1160 | Netatalk before 3.1.12 is vulnerable to an out of bounds write in dsi_opensess.c. netatalk · netatalk | Critical 9.8 | 87% | 7 exploits | |
| CVE-2023-35813 | Multiple Sitecore products allow remote code execution. sitecore · experience commerce | Critical 9.8 | 87% | · | |
| CVE-2023-35708 | In Progress MOVEit Transfer before 2021.0.8 (13.0.8), 2021.1.6 (13.1.6), 2022.0.6 (14.0.6), 2022.1.7 (14.1.7), and 2023.0.3 (15.0.3), a SQL injection vulnerability has been identified in the MOVEit Transfer web application that could allow an unauthenticated attacker to gain… progress · moveit transfer | Critical 9.8 | 97% | · | |
| CVE-2023-3224 | nuxt Code Injection vulnerability nuxt · nuxt | Critical 9.2 | 59% | · | |
| CVE-2023-33625 | D-Link DIR-600 Hardware Version B5, Firmware Version 2.18 was discovered to contain a command injection vulnerability via the ST parameter in the lxmldbc_system() function. dlink · dir-600 firmware | Critical 9.8 | 33% | 3 exploits | |
| CVE-2023-2732 | MStore API <= 3.9.2 - Authentication Bypass inspireui · mstore api | Critical 9.8 | 67% | · | |
| CVE-2023-29919 | SolarView Compact <= 6.0 is vulnerable to Insecure Permissions. contec · solarview compact firmware | Critical 9.8 | 60% | 1 exploit | |
| CVE-2022-42889 | Apache Commons Text performs variable interpolation, allowing properties to be dynamically evaluated and expanded. apache · commons text | Critical 9.8 | 100% | 2 exploits | |
| CVE-2023-32243 | Essential Addons for Elementor <= 5.7.1 - Unauthenticated Arbitrary Password Reset to Privilege Escalation wpdeveloper · essential addons for elementor | Critical 9.8 | 76% | 1 exploit | |
| CVE-2023-1698 | In multiple products of WAGO a vulnerability allows an unauthenticated, remote attacker to create new users and change the device configuration which can result in unintended behaviour, Denial of Service and full system compromise. wago · compact controller 100 firmware | Critical 9.8 | 82% | · | |
| CVE-2023-27823 | An authentication bypass in Optoma 1080PSTX C02 allows an attacker to access the administration console without valid credentials. optoma · 1080pstx | Critical 9.8 | 54% | 1 exploit | |
| CVE-2023-32071 | XWiki Platform vulnerable to RXSS via editor parameter - importinline template xwiki · xwiki | Critical 9.0 | 70% | · | |
| CVE-2023-24941 | Windows Network File System Remote Code Execution Vulnerability microsoft · windows server 2012 | Critical 9.8 | 95% | · | |
| CVE-2023-30013 | TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. totolink · x5000r firmware | Critical 9.8 | 26% | 2 exploits | |
| CVE-2023-25826 | Command injection in OpenTSDB opentsdb · opentsdb | Critical 9.8 | 43% | 1 exploit | |
| CVE-2023-20864 | VMware Aria Operations for Logs contains a deserialization vulnerability. vmware · aria operations for logs | Critical 9.8 | 70% | · | |
| CVE-2023-30547 | vm2 Sandbox Escape vulnerability vm2 project · vm2 | Critical 10.0 | 73% | · | |
| CVE-2023-22621 | Strapi plugins vulnerable to Server-Side Template Injection and Remote Code Execution in the Users-Permissions Plugin strapi · strapi | Critical 10.0 | 71% | · | |
| CVE-2023-21554 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability microsoft · windows 10 1607 | Critical 9.8 | 95% | · | |
| CVE-2023-28121 | An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. automattic · woocommerce payments | Critical 9.8 | 87% | · | |
| CVE-2023-29017 | vm2 vulnerable to sandbox escape vm2 project · vm2 | Critical 9.8 | 63% | · | |
| CVE-2023-25076 | A buffer overflow vulnerability exists in the handling of wildcard backend hosts of SNIProxy 0.6.0-2 and the master branch (commit: 822bb80df9b7b345cc9eba55df74a07b498819ba). sniproxy project · sniproxy | Critical 9.8 | 66% | · | |
| CVE-2023-28503 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication… rocketsoftware · unidata | Critical 9.8 | 62% | 1 exploit | |
| CVE-2023-28502 | Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from a stack-based buffer overflow in the "udadmin" service that can lead to remote code execution as the root user. rocketsoftware · unidata | Critical 9.8 | 61% | 1 exploit | |
| CVE-2022-36981 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.3.101. ivanti · avalanche | Critical 9.8 | 83% | · | |
| CVE-2022-36974 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Avalanche 6.3.2.3490. ivanti · avalanche | Critical 9.8 | 84% | · | |
| CVE-2022-2560 | This vulnerability allows remote attackers to delete arbitrary files on affected installations of EnterpriseDT CompleteFTP 22.1.0 Server. enterprisedt · completeftp server | Critical 9.1 | 78% | · | |
| CVE-2023-1133 | Delta Electronics InfraSuite Device Master versions prior to 1.0.5 contain a vulnerability in which the Device-status service listens on port 10100/ UDP by default. deltaww · infrasuite device master | Critical 9.8 | 50% | 1 exploit | |
| CVE-2023-26801 | LB-LINK BL-AC1900_2.0 v1.0.1, LB-LINK BL-WR9000 v2.4.9, LB-LINK BL-X26 v1.2.5, and LB-LINK BL-LTE300 v1.0.8 were discovered to contain a command injection vulnerability via the mac, time1, and time2 parameters at /goform/set_LimitClient_cfg. lb-link · bl-ac1900 firmware | Critical 9.8 | 70% | 1 exploit | |
| CVE-2023-1177 | mlflow is vulnerable to remote file access in mlflow server and mlflow ui CLIs lfprojects · mlflow | Critical 9.3 | 70% | · | |
| CVE-2023-27034 | PrestaShop jmsblog 2.5.5 was discovered to contain a SQL injection vulnerability. joommasters · jms blog | Critical 9.8 | 59% | · | |
| CVE-2022-43781 | There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. atlassian · bitbucket | Critical 9.8 | 98% | 1 exploit | |
| CVE-2023-28343 | OS command injection affects Altenergy Power Control Software C1.2.5 via shell metacharacters in the index.php/management/set_timezone timezone parameter, because of set_timezone in models/management_model.php. apsystems · energy communication unit firmware | Critical 9.8 | 85% | 2 exploits | |
| CVE-2023-27482 | A remotely exploitable vulnerability bypassing authentication for accessing the Supervisor API through Home Assistant has been discovered. home-assistant · home-assistant | Critical 10.0 | 72% | · | |
| CVE-2021-36393 | Moodle SQL Injection vulnerability moodle · moodle | Critical 9.8 | 52% | · | |
| CVE-2023-26477 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability xwiki · xwiki | Critical 9.8 | 75% | 1 exploit | |
| CVE-2023-27372 | SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. spip · spip | Critical 9.8 | 100% | 2 exploits | |
| CVE-2022-2024 | Gogs OS Command Injection vulnerability gogs · gogs | Critical 9.8 | 98% | · | |
| CVE-2023-26035 | Versions prior to 1.36.33 and 1.37.33 are vulnerable to Unauthenticated Remote Code Execution via Missing Authorization. zoneminder · zoneminder | Critical 9.8 | 80% | 1 exploit |
Showing 251–300 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.