Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
780 vulnerabilities · highest exploit probability first
- CVE-2021-22238Medium 5.4GitLab was vulnerable to a stored XSS by using the design feature in issues.gitlab · gitlabEPSS72%·Published Aug 20, 2021
- CVE-2020-27223Medium 5.3In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e.eclipse · jettyEPSS78%·Published Aug 19, 2021
- CVE-2021-33037Medium 5.3HTTP Request Smuggling in Apache Tomcatapache · tomcatEPSS75%·Published Aug 13, 2021
- CVE-2021-35478Medium 5.4Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function.nagios · log serverEPSS77%·Published Jul 30, 2021
- CVE-2020-7387Medium 5.3Sage X3 Installation Pathname Disclosure.sage · adxadminEPSS34%1 exploitPublished Jul 22, 2021
- CVE-2021-2401Medium 5.3Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher.oracle · bi publisherEPSS85%·Published Jul 21, 2021
- CVE-2021-28114Medium 5.4Cross-site Scripting in Froala WYSIWYG Editorfroala · froala editorEPSS52%·Published Jul 19, 2021
- CVE-2021-21801Medium 6.1This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications.advantech · r-seenetEPSS63%·Published Jul 16, 2021
- CVE-2018-11784Medium 4.3tomcat7 - security updateapache · tomcatEPSS98%1 exploitPublished Jul 14, 2021
- CVE-2021-30119Medium 5.4Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request:…kaseya · vsaEPSS53%Ransomware1 actorPublished Jul 9, 2021
- CVE-2021-31813Medium 5.4Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD.zohocorp · manageengine applications managerEPSS78%·Published Jul 1, 2021
- CVE-2021-28164Medium 5.3In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory.eclipse · jettyEPSS82%2 exploitsPublished Jun 30, 2021
- CVE-2021-1499Medium 5.3A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device.cisco · hyperflex hx data platformEPSS80%2 exploitsPublished Jun 24, 2021
- CVE-2021-21649Medium 5.4Cross-site Scripting in Jenkins Dashboard View Pluginjenkins · dashboard viewEPSS73%·Published Jun 16, 2021
- CVE-2020-13947Medium 6.1An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0.apache · activemqEPSS79%·Published Jun 14, 2021
- CVE-2019-17567Medium 5.3Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP…apache · http serverEPSS60%·Published Jun 11, 2021
- CVE-2021-31250Medium 5.4Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi.chiyu-tech · bf-430 firmwareEPSS80%·Published Jun 4, 2021
- CVE-2021-31806Medium 6.5squid3 - security updatesquid-cache · squidEPSS95%·Published Jun 3, 2021
- CVE-2021-28662Medium 6.5squid: denial of service in HTTP response processingsquid-cache · squidEPSS72%·Published Jun 3, 2021
- CVE-2021-31643Medium 5.4An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter.chiyu-tech · bf-630 firmwareEPSS88%1 exploitPublished Jun 1, 2021
- CVE-2021-33620Medium 6.5Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response.squid-cache · squidEPSS80%·Published May 28, 2021
- CVE-2020-36289Medium 5.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint.atlassian · data centerEPSS99%·Published May 12, 2021
- CVE-2021-29490Medium 5.8Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter.jellyfin · jellyfinEPSS70%·Published May 6, 2021
- CVE-2020-13943Medium 4.3tomcat8 - security updateapache · tomcatEPSS55%·Published May 5, 2021
- CVE-2021-21983Medium 6.5Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating…vmware · vrealize operations managerEPSS69%2 exploitsPublished May 4, 2021
- CVE-2019-10098Medium 6.1In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL.apache · http serverEPSS74%1 exploitPublished Apr 21, 2021
- CVE-2020-1927Medium 6.1In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.apache · http serverEPSS57%·Published Apr 21, 2021
- CVE-2021-29447Medium 6.5A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks.wordpress · wordpressEPSS86%2 exploitsPublished Apr 15, 2021
- CVE-2021-26030Medium 6.13.0.0 through 3.9.25.joomla · joomla\!EPSS82%·Published Apr 14, 2021
- CVE-2021-27250Medium 6.5This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points.dlink · dap-2020 firmwareEPSS67%·Published Apr 14, 2021
- CVE-2021-26812Medium 6.1Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module.jitsi · meetEPSS97%1 exploitPublished Apr 14, 2021
- CVE-2021-28325Medium 6.5Windows SMB Information Disclosure Vulnerabilitymicrosoft · windows 10EPSS62%·Published Apr 13, 2021
- CVE-2021-20080Medium 6.1Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file.zohocorp · manageengine servicedesk plusEPSS93%·Published Apr 9, 2021
- CVE-2020-8264Medium 6.1Cross-site scripting in actionpackrubyonrails · railsEPSS67%·Published Apr 7, 2021
- CVE-2021-21402Medium 6.5In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system.jellyfin · jellyfinEPSS79%·Published Mar 23, 2021
- CVE-2021-25921Medium 5.4In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the Allergies section.open-emr · openemrEPSS91%·Published Mar 22, 2021
- CVE-2021-25919Medium 4.8In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly.open-emr · openemrEPSS70%·Published Mar 22, 2021
- CVE-2021-22881Medium 6.1Actionpack Open Redirect Vulnerabilityrubyonrails · railsEPSS87%·Published Mar 2, 2021
- CVE-2021-25299Medium 6.1Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS).nagios · nagios xiEPSS98%2 exploitsPublished Feb 15, 2021
- CVE-2021-21029Medium 4.8Magento Reflected Cross-site Scripting vulnerability via 'file' parametermagento · magentoEPSS85%·Published Feb 12, 2021
- CVE-2020-13564Medium 6.1A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.phpgacl project · phpgaclEPSS76%·Published Feb 1, 2021
- CVE-2020-13563Medium 6.1A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.phpgacl project · phpgaclEPSS76%·Published Feb 1, 2021
- CVE-2020-13562Medium 6.1A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7.phpgacl project · phpgaclEPSS78%·Published Feb 1, 2021
- CVE-2021-22873Medium 6.1Revive Adserver before 5.1.0 is vulnerable to open redirects via the dest, oadest, and/or ct0 parameters of the lg.php and ck.php delivery scripts.revive-adserver · revive adserverEPSS70%·Published Jan 26, 2021
- CVE-2020-25687Medium 5.9A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries.thekelleys · dnsmasqEPSS87%·Published Jan 21, 2021
- CVE-2020-25683Medium 5.9A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries.thekelleys · dnsmasqEPSS86%·Published Jan 21, 2021
- CVE-2021-23124Medium 6.13.9.0 through 3.9.23.joomla · joomla\!EPSS79%·Published Jan 12, 2021
- CVE-2020-16040Medium 6.5Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.google · chromeEPSS100%4 exploitsPublished Jan 8, 2021
- CVE-2020-5810Medium 5.4A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current.umbraco · umbraco cmsEPSS62%·Published Dec 30, 2020
- CVE-2020-13945Medium 6.5In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules.apache · apisixEPSS73%2 exploitsPublished Dec 7, 2020
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2021-22238 | GitLab was vulnerable to a stored XSS by using the design feature in issues. gitlab · gitlab | Medium 5.4 | 72% | · | |
| CVE-2020-27223 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. eclipse · jetty | Medium 5.3 | 78% | · | |
| CVE-2021-33037 | HTTP Request Smuggling in Apache Tomcat apache · tomcat | Medium 5.3 | 75% | · | |
| CVE-2021-35478 | Nagios Log Server before 2.1.9 contains Reflected XSS in the dropdown box for the alert history and audit log function. nagios · log server | Medium 5.4 | 77% | · | |
| CVE-2020-7387 | Sage X3 Installation Pathname Disclosure. sage · adxadmin | Medium 5.3 | 34% | 1 exploit | |
| CVE-2021-2401 | Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle BI Publisher. oracle · bi publisher | Medium 5.3 | 85% | · | |
| CVE-2021-28114 | Cross-site Scripting in Froala WYSIWYG Editor froala · froala editor | Medium 5.4 | 52% | · | |
| CVE-2021-21801 | This vulnerability is present in device_graph_page.php script, which is a part of the Advantech R-SeeNet web applications. advantech · r-seenet | Medium 6.1 | 63% | · | |
| CVE-2018-11784 | tomcat7 - security update apache · tomcat | Medium 4.3 | 98% | 1 exploit | |
| CVE-2021-30119 | Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request:… kaseya · vsa | Medium 5.4 | 53% | Ransomware1 actor | |
| CVE-2021-31813 | Zoho ManageEngine Applications Manager before 15130 is vulnerable to Stored XSS while importing malicious user details (e.g., a crafted user name) from AD. zohocorp · manageengine applications manager | Medium 5.4 | 78% | · | |
| CVE-2021-28164 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. eclipse · jetty | Medium 5.3 | 82% | 2 exploits | |
| CVE-2021-1499 | A vulnerability in the web-based management interface of Cisco HyperFlex HX Data Platform could allow an unauthenticated, remote attacker to upload files to an affected device. cisco · hyperflex hx data platform | Medium 5.3 | 80% | 2 exploits | |
| CVE-2021-21649 | Cross-site Scripting in Jenkins Dashboard View Plugin jenkins · dashboard view | Medium 5.4 | 73% | · | |
| CVE-2020-13947 | An instance of a cross-site scripting vulnerability was identified to be present in the web based administration console on the message.jsp page of Apache ActiveMQ versions 5.15.12 through 5.16.0. apache · activemq | Medium 6.1 | 79% | · | |
| CVE-2019-17567 | Apache HTTP Server versions 2.4.6 to 2.4.46 mod_proxy_wstunnel configured on an URL that is not necessarily Upgraded by the origin server was tunneling the whole connection regardless, thus allowing for subsequent requests on the same connection to pass through with no HTTP… apache · http server | Medium 5.3 | 60% | · | |
| CVE-2021-31250 | Multiple storage XSS vulnerabilities were discovered on BF-430, BF-431 and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of sanitization of the input on the components man.cgi, if.cgi, dhcpc.cgi, ppp.cgi. chiyu-tech · bf-430 firmware | Medium 5.4 | 80% | · | |
| CVE-2021-31806 | squid3 - security update squid-cache · squid | Medium 6.5 | 95% | · | |
| CVE-2021-28662 | squid: denial of service in HTTP response processing squid-cache · squid | Medium 6.5 | 72% | · | |
| CVE-2021-31643 | An XSS vulnerability exists in several IoT devices from CHIYU Technology, including SEMAC, Biosense, BF-630, BF-631, and Webpass due to a lack of sanitization on the component if.cgi - username parameter. chiyu-tech · bf-630 firmware | Medium 5.4 | 88% | 1 exploit | |
| CVE-2021-33620 | Squid before 4.15 and 5.x before 5.0.6 allows remote servers to cause a denial of service (affecting availability to all clients) via an HTTP response. squid-cache · squid | Medium 6.5 | 80% | · | |
| CVE-2020-36289 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the QueryComponentRendererValue!Default.jspa endpoint. atlassian · data center | Medium 5.3 | 99% | · | |
| CVE-2021-29490 | Verions prior to 10.7.3 vulnerable to unauthenticated Server-Side Request Forgery (SSRF) attacks via the imageUrl parameter. jellyfin · jellyfin | Medium 5.8 | 70% | · | |
| CVE-2020-13943 | tomcat8 - security update apache · tomcat | Medium 4.3 | 55% | · | |
| CVE-2021-21983 | Arbitrary file write vulnerability in vRealize Operations Manager API (CVE-2021-21983) prior to 8.4 may allow an authenticated malicious actor with network access to the vRealize Operations Manager API can write files to arbitrary locations on the underlying photon operating… vmware · vrealize operations manager | Medium 6.5 | 69% | 2 exploits | |
| CVE-2019-10098 | In Apache HTTP server 2.4.0 to 2.4.39, Redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an unexpected URL within the request URL. apache · http server | Medium 6.1 | 74% | 1 exploit | |
| CVE-2020-1927 | In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL. apache · http server | Medium 6.1 | 57% | · | |
| CVE-2021-29447 | A user with the ability to upload files (like an Author) can exploit an XML parsing issue in the Media Library leading to XXE attacks. wordpress · wordpress | Medium 6.5 | 86% | 2 exploits | |
| CVE-2021-26030 | 3.0.0 through 3.9.25. joomla · joomla\! | Medium 6.1 | 82% | · | |
| CVE-2021-27250 | This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of D-Link DAP-2020 v1.01rc001 Wi-Fi access points. dlink · dap-2020 firmware | Medium 6.5 | 67% | · | |
| CVE-2021-26812 | Cross Site Scripting (XSS) in the Jitsi Meet 2.7 through 2.8.3 plugin for Moodle via the "sessionpriv.php" module. jitsi · meet | Medium 6.1 | 97% | 1 exploit | |
| CVE-2021-28325 | Windows SMB Information Disclosure Vulnerability microsoft · windows 10 | Medium 6.5 | 62% | · | |
| CVE-2021-20080 | Insufficient output sanitization in ManageEngine ServiceDesk Plus before version 11200 and ManageEngine AssetExplorer before version 6800 allows a remote, unauthenticated attacker to conduct persistent cross-site scripting (XSS) attacks by uploading a crafted XML asset file. zohocorp · manageengine servicedesk plus | Medium 6.1 | 93% | · | |
| CVE-2020-8264 | Cross-site scripting in actionpack rubyonrails · rails | Medium 6.1 | 67% | · | |
| CVE-2021-21402 | In Jellyfin before version 10.7.1, with certain endpoints, well crafted requests will allow arbitrary file read from a Jellyfin server's file system. jellyfin · jellyfin | Medium 6.5 | 79% | · | |
| CVE-2021-25921 | In OpenEMR, versions 2.7.3-rc1 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly in the Allergies section. open-emr · openemr | Medium 5.4 | 91% | · | |
| CVE-2021-25919 | In OpenEMR, versions 5.0.2 to 6.0.0 are vulnerable to Stored Cross-Site-Scripting (XSS) due to user input not being validated properly. open-emr · openemr | Medium 4.8 | 70% | · | |
| CVE-2021-22881 | Actionpack Open Redirect Vulnerability rubyonrails · rails | Medium 6.1 | 87% | · | |
| CVE-2021-25299 | Nagios XI version xi-5.7.5 is affected by cross-site scripting (XSS). nagios · nagios xi | Medium 6.1 | 98% | 2 exploits | |
| CVE-2021-21029 | Magento Reflected Cross-site Scripting vulnerability via 'file' parameter magento · magento | Medium 4.8 | 85% | · | |
| CVE-2020-13564 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. phpgacl project · phpgacl | Medium 6.1 | 76% | · | |
| CVE-2020-13563 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. phpgacl project · phpgacl | Medium 6.1 | 76% | · | |
| CVE-2020-13562 | A cross-site scripting vulnerability exists in the template functionality of phpGACL 3.3.7. phpgacl project · phpgacl | Medium 6.1 | 78% | · | |
| CVE-2021-22873 | Revive Adserver before 5.1.0 is vulnerable to open redirects via the dest, oadest, and/or ct0 parameters of the lg.php and ck.php delivery scripts. revive-adserver · revive adserver | Medium 6.1 | 70% | · | |
| CVE-2020-25687 | A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. thekelleys · dnsmasq | Medium 5.9 | 87% | · | |
| CVE-2020-25683 | A heap-based buffer overflow was discovered in dnsmasq when DNSSEC is enabled and before it validates the received DNS entries. thekelleys · dnsmasq | Medium 5.9 | 86% | · | |
| CVE-2021-23124 | 3.9.0 through 3.9.23. joomla · joomla\! | Medium 6.1 | 79% | · | |
| CVE-2020-16040 | Insufficient data validation in V8 in Google Chrome prior to 87.0.4280.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. google · chrome | Medium 6.5 | 100% | 4 exploits | |
| CVE-2020-5810 | A stored XSS vulnerability exists in Umbraco CMS <= 8.9.1 or current. umbraco · umbraco cms | Medium 5.4 | 62% | · | |
| CVE-2020-13945 | In Apache APISIX, the user enabled the Admin API and deleted the Admin API access IP restriction rules. apache · apisix | Medium 6.5 | 73% | 2 exploits |
Showing 251–300 of 780
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.