Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2023-29325High 7.5Windows OLE Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS84%·Published May 9, 2023
- CVE-2023-31099High 8.8Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers.zohocorp · manageengine opmanagerEPSS82%·Published May 4, 2023
- CVE-2023-25652High 7.5Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the…git-scm · gitEPSS52%·Published May 2, 2023
- CVE-2023-32007High 8.7Apache Spark UI vulnerable to Command Injectionapache · sparkEPSS76%·Published May 2, 2023
- CVE-2023-28384High 8.8mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands.myscada · myproEPSS45%1 exploitPublished Apr 27, 2023
- CVE-2023-28770High 7.5The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from…zyxel · dx5401-b0 firmwareEPSS58%1 exploitPublished Apr 27, 2023
- CVE-2023-29525High 8.8XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministrationxwiki · xwikiEPSS78%·Published Apr 20, 2023
- CVE-2023-29524High 8.8XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheetxwiki · xwikiEPSS76%1 exploitPublished Apr 20, 2023
- CVE-2023-29516High 8.8XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelectorxwiki · xwikiEPSS66%·Published Apr 20, 2023
- CVE-2023-21931High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS82%1 exploitPublished Apr 19, 2023
- CVE-2023-29084High 7.2Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings.zohocorp · manageengine admanager plusEPSS98%1 exploitPublished Apr 14, 2023
- CVE-2023-2034High 8.8froxlor/froxlor vulnerable to unrestricted upload of file with dangerous typefroxlor · froxlorEPSS71%·Published Apr 14, 2023
- CVE-2023-29509High 8.8org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerabilityxwiki · xwikiEPSS76%·Published Apr 12, 2023
- CVE-2023-28302High 7.5Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 1607EPSS93%·Published Apr 11, 2023
- CVE-2023-21769High 7.5Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 1607EPSS89%·Published Apr 11, 2023
- CVE-2023-27179High 7.5GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php.gdidees · gdidees cmsEPSS61%1 exploitPublished Apr 11, 2023
- CVE-2023-26067High 8.1Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4).lexmark · cslbl firmwareEPSS38%1 exploitPublished Apr 10, 2023
- CVE-2023-28342High 7.5Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API.zohocorp · manageengine adselfservice plusEPSS78%·Published Apr 6, 2023
- CVE-2022-42429High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS76%·Published Mar 29, 2023
- CVE-2022-42427High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS76%·Published Mar 29, 2023
- CVE-2022-42425High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS76%·Published Mar 29, 2023
- CVE-2022-42424High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS76%·Published Mar 29, 2023
- CVE-2022-36982High 7.5This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101.ivanti · avalancheEPSS74%·Published Mar 29, 2023
- CVE-2022-36980High 8.1This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490.ivanti · avalancheEPSS82%·Published Mar 29, 2023
- CVE-2023-1578High 8.8Pimcore Remote Code Execution vulnerability in Search functionpimcore · pimcoreEPSS63%·Published Mar 22, 2023
- CVE-2023-27856High 7.5In affected versions, path traversal exists when processing a message of type 8rockwellautomation · thinmanagerEPSS77%·Published Mar 21, 2023
- CVE-2023-0631High 8.8Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodesstrangerstudios · paid memberships proEPSS60%·Published Mar 21, 2023
- CVE-2023-27253High 8.8A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml.netgate · pfsenseEPSS90%2 exploitsPublished Mar 17, 2023
- CVE-2022-44574High 7.5An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port.ivanti · avalancheEPSS62%·Published Mar 10, 2023
- CVE-2023-25573High 7.5In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication.metersphere · metersphereEPSS52%1 exploitPublished Mar 9, 2023
- CVE-2023-26475High 8.8xwiki-platform vulnerable to Remote Code Execution in Annotationsxwiki · xwikiEPSS64%1 exploitPublished Mar 2, 2023
- CVE-2022-47075High 7.5An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx.smartofficepayroll · smartofficeEPSS59%1 exploitPublished Feb 28, 2023
- CVE-2023-21707High 8.8Microsoft Exchange Server Remote Code Execution Vulnerabilitymicrosoft · exchange serverEPSS82%·Published Feb 23, 2023
- CVE-2023-24078High 8.8Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/.realtimelogic · fuguhubEPSS53%2 exploitsPublished Feb 17, 2023
- CVE-2023-23836High 7.2SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data.solarwinds · orion platformEPSS80%·Published Feb 15, 2023
- CVE-2022-38111High 7.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.solarwinds · orion platformEPSS85%·Published Feb 15, 2023
- CVE-2023-24580High 8.7Resource exhaustion in Djangodjangoproject · djangoEPSS63%·Published Feb 15, 2023
- CVE-2023-0159High 7.5Extensive VC Addons for WPBakery page builder <= 1.9 - Unauthenticated Local File Inclusionwprealize · extensive vc addons for wpbakery page builderEPSS55%1 exploitPublished Feb 14, 2023
- CVE-2023-0286High 7.4Vulnerable OpenSSL included in cryptography wheelsopenssl · opensslEPSS71%·Published Feb 8, 2023
- CVE-2023-25194High 8.8Apache Kafka Connect vulnerable to Deserialization of Untrusted Dataapache · kafka connectEPSS96%1 exploitPublished Feb 7, 2023
- CVE-2022-40224High 7.5A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1.moxa · sds-3008 firmwareEPSS65%·Published Feb 7, 2023
- CVE-2023-22374High 8.5A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code.f5 · big-ip access policy managerEPSS73%·Published Feb 7, 2023
- CVE-2022-41142High 8.8This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon.centreon · centreonEPSS85%·Published Jan 26, 2023
- CVE-2023-23492High 8.8The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action.idehweb · login with phone numberEPSS57%·Published Jan 20, 2023
- CVE-2023-0126High 7.5Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory.sonicwall · sma1000 firmwareEPSS73%·Published Jan 19, 2023
- CVE-2023-22809High 7.8In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process.sudo project · sudoEPSS55%2 exploitsPublished Jan 18, 2023
- CVE-2023-0315High 8.8Froxlor vulnerable to Command Injectionfroxlor · froxlorEPSS98%2 exploitsPublished Jan 16, 2023
- CVE-2023-21742High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS56%·Published Jan 11, 2023
- CVE-2023-21768High 7.8Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerabilitymicrosoft · windows 11EPSS65%1 exploitPublished Jan 10, 2023
- CVE-2023-21758High 7.5Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerabilitymicrosoft · windows 10EPSS93%·Published Jan 10, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-29325 | Windows OLE Remote Code Execution Vulnerability microsoft · windows 10 1507 | High 7.5 | 84% | · | |
| CVE-2023-31099 | Zoho ManageEngine OPManager through 126323 allows an authenticated user to achieve remote code execution via probe servers. zohocorp · manageengine opmanager | High 8.8 | 82% | · | |
| CVE-2023-25652 | Prior to versions 2.30.9, 2.31.8, 2.32.7, 2.33.8, 2.34.8, 2.35.8, 2.36.6, 2.37.7, 2.38.5, 2.39.3, and 2.40.1, by feeding specially crafted input to git apply --reject, a path outside the working tree can be overwritten with partially controlled contents (corresponding to the… git-scm · git | High 7.5 | 52% | · | |
| CVE-2023-32007 | Apache Spark UI vulnerable to Command Injection apache · spark | High 8.7 | 76% | · | |
| CVE-2023-28384 | mySCADA myPRO versions 8.26.0 and prior has parameters which an authenticated user could exploit to inject arbitrary operating system commands. myscada · mypro | High 8.8 | 45% | 1 exploit | |
| CVE-2023-28770 | The sensitive information exposure vulnerability in the CGI “Export_Log” and the binary “zcmd” in Zyxel DX5401-B0 firmware versions prior to V5.17(ABYO.1)C0 could allow a remote unauthenticated attacker to read the system files and to retrieve the password of the supervisor from… zyxel · dx5401-b0 firmware | High 7.5 | 58% | 1 exploit | |
| CVE-2023-29525 | XWiki Platform vulnerable to privilege escalation from view right on XWiki.Notifications.Code.LegacyNotificationAdministration xwiki · xwiki | High 8.8 | 78% | · | |
| CVE-2023-29524 | XWiki Platform vulnerable to code injection from account through XWiki.SchedulerJobSheet xwiki · xwiki | High 8.8 | 76% | 1 exploit | |
| CVE-2023-29516 | XWiki Platform vulnerable to privilege escalation from view right on XWiki.AttachmentSelector xwiki · xwiki | High 8.8 | 66% | · | |
| CVE-2023-21931 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3 to compromise Oracle WebLogic Server. oracle · weblogic server | High 7.5 | 82% | 1 exploit | |
| CVE-2023-29084 | Zoho ManageEngine ADManager Plus before 7181 allows for authenticated users to exploit command injection via Proxy settings. zohocorp · manageengine admanager plus | High 7.2 | 98% | 1 exploit | |
| CVE-2023-2034 | froxlor/froxlor vulnerable to unrestricted upload of file with dangerous type froxlor · froxlor | High 8.8 | 71% | · | |
| CVE-2023-29509 | org.xwiki.platform:xwiki-platform-flamingo-theme-ui Eval Injection vulnerability xwiki · xwiki | High 8.8 | 76% | · | |
| CVE-2023-28302 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability microsoft · windows 10 1607 | High 7.5 | 93% | · | |
| CVE-2023-21769 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability microsoft · windows 10 1607 | High 7.5 | 89% | · | |
| CVE-2023-27179 | GDidees CMS v3.9.1 and lower was discovered to contain an arbitrary file download vulenrability via the filename parameter at /_admin/imgdownload.php. gdidees · gdidees cms | High 7.5 | 61% | 1 exploit | |
| CVE-2023-26067 | Certain Lexmark devices through 2023-02-19 mishandle Input Validation (issue 1 of 4). lexmark · cslbl firmware | High 8.1 | 38% | 1 exploit | |
| CVE-2023-28342 | Zoho ManageEngine ADSelfService Plus before 6218 allows anyone to conduct a Denial-of-Service attack via the Mobile App Authentication API. zohocorp · manageengine adselfservice plus | High 7.5 | 78% | · | |
| CVE-2022-42429 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 76% | · | |
| CVE-2022-42427 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 76% | · | |
| CVE-2022-42425 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 76% | · | |
| CVE-2022-42424 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 76% | · | |
| CVE-2022-36982 | This vulnerability allows remote attackers to read arbitrary files on affected installations of Ivanti Avalanche 6.3.3.101. ivanti · avalanche | High 7.5 | 74% | · | |
| CVE-2022-36980 | This vulnerability allows remote attackers to bypass authentication on affected installations of Ivanti Avalanche 6.3.2.3490. ivanti · avalanche | High 8.1 | 82% | · | |
| CVE-2023-1578 | Pimcore Remote Code Execution vulnerability in Search function pimcore · pimcore | High 8.8 | 63% | · | |
| CVE-2023-27856 | In affected versions, path traversal exists when processing a message of type 8 rockwellautomation · thinmanager | High 7.5 | 77% | · | |
| CVE-2023-0631 | Paid Memberships Pro <= 2.9.11 - Authenticated (Subscriber+) SQL Injection via Shortcodes strangerstudios · paid memberships pro | High 8.8 | 60% | · | |
| CVE-2023-27253 | A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the contents of an XML file supplied to the component config.xml. netgate · pfsense | High 8.8 | 90% | 2 exploits | |
| CVE-2022-44574 | An improper authentication vulnerability exists in Avalanche version 6.3.x and below allows unauthenticated attacker to modify properties on specific port. ivanti · avalanche | High 7.5 | 62% | · | |
| CVE-2023-25573 | In affected versions an improper access control vulnerability exists in /api/jmeter/download/files, which allows any user to download any file without authentication. metersphere · metersphere | High 7.5 | 52% | 1 exploit | |
| CVE-2023-26475 | xwiki-platform vulnerable to Remote Code Execution in Annotations xwiki · xwiki | High 8.8 | 64% | 1 exploit | |
| CVE-2022-47075 | An issue was discovered in Smart Office Web 20.28 and earlier allows attackers to download sensitive information via the action name parameter to ExportEmployeeDetails.aspx, and to ExportReportingManager.aspx. smartofficepayroll · smartoffice | High 7.5 | 59% | 1 exploit | |
| CVE-2023-21707 | Microsoft Exchange Server Remote Code Execution Vulnerability microsoft · exchange server | High 8.8 | 82% | · | |
| CVE-2023-24078 | Real Time Logic FuguHub v8.1 and earlier was discovered to contain a remote code execution (RCE) vulnerability via the component /FuguHub/cmsdocs/. realtimelogic · fuguhub | High 8.8 | 53% | 2 exploits | |
| CVE-2023-23836 | SolarWinds Platform version 2022.4.1 was found to be susceptible to the Deserialization of Untrusted Data. solarwinds · orion platform | High 7.2 | 80% | · | |
| CVE-2022-38111 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. solarwinds · orion platform | High 7.2 | 85% | · | |
| CVE-2023-24580 | Resource exhaustion in Django djangoproject · django | High 8.7 | 63% | · | |
| CVE-2023-0159 | Extensive VC Addons for WPBakery page builder <= 1.9 - Unauthenticated Local File Inclusion wprealize · extensive vc addons for wpbakery page builder | High 7.5 | 55% | 1 exploit | |
| CVE-2023-0286 | Vulnerable OpenSSL included in cryptography wheels openssl · openssl | High 7.4 | 71% | · | |
| CVE-2023-25194 | Apache Kafka Connect vulnerable to Deserialization of Untrusted Data apache · kafka connect | High 8.8 | 96% | 1 exploit | |
| CVE-2022-40224 | A denial of service vulnerability exists in the web server functionality of Moxa SDS-3008 Series Industrial Ethernet Switch 2.1. moxa · sds-3008 firmware | High 7.5 | 65% | · | |
| CVE-2023-22374 | A format string vulnerability exists in iControl SOAP that allows an authenticated attacker to crash the iControl SOAP CGI process or, potentially execute arbitrary code. f5 · big-ip access policy manager | High 8.5 | 73% | · | |
| CVE-2022-41142 | This vulnerability allows remote attackers to escalate privileges on affected installations of Centreon. centreon · centreon | High 8.8 | 85% | · | |
| CVE-2023-23492 | The Login with Phone Number WordPress Plugin, version < 1.4.2, is affected by an authenticated SQL injection vulnerability in the 'ID' parameter of its 'lwp_forgot_password' action. idehweb · login with phone number | High 8.8 | 57% | · | |
| CVE-2023-0126 | Pre-authentication path traversal vulnerability in SMA1000 firmware version 12.4.2, which allows an unauthenticated attacker to access arbitrary files and directories stored outside the web root directory. sonicwall · sma1000 firmware | High 7.5 | 73% | · | |
| CVE-2023-22809 | In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. sudo project · sudo | High 7.8 | 55% | 2 exploits | |
| CVE-2023-0315 | Froxlor vulnerable to Command Injection froxlor · froxlor | High 8.8 | 98% | 2 exploits | |
| CVE-2023-21742 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 56% | · | |
| CVE-2023-21768 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability microsoft · windows 11 | High 7.8 | 65% | 1 exploit | |
| CVE-2023-21758 | Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability microsoft · windows 10 | High 7.5 | 93% | · |
Showing 251–300 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.