Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2023-44443High 7.8GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability.gimp · gimpEPSS94%·Published May 3, 2024
- CVE-2023-44442High 7.8GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability.gimp · gimpEPSS61%·Published May 3, 2024
- CVE-2023-39469High 7.2PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability.papercut · papercut ngEPSS61%·Published May 3, 2024
- CVE-2023-49606Critical 9.8A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0.tinyproxy project · tinyproxyEPSS63%·Published May 1, 2024
- CVE-2024-26331High 7.5ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID.EPSS51%·Published Apr 30, 2024
- CVE-2024-31621High 7.2Flowise vulnerable to code injection via api/v1flowiseai · flowiseEPSS61%·Published Apr 29, 2024
- CVE-2020-14144High 7.2Arbitrary Code Execution in Giteagitea · giteaEPSS95%2 exploitsPublished Apr 22, 2024
- CVE-2024-32238Critical 9.8H3C ER8300G2-X is vulnerable to Incorrect Access Control.EPSS53%·Published Apr 22, 2024
- CVE-2024-24992High 8.8A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.ivanti · avalancheEPSS71%·Published Apr 19, 2024
- CVE-2024-24994High 8.8A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.ivanti · avalancheEPSS68%·Published Apr 19, 2024
- CVE-2024-23535High 8.8A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM.ivanti · avalancheEPSS68%·Published Apr 19, 2024
- CVE-2024-2961High 7.3The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable.gnu · glibcEPSS88%1 exploitPublished Apr 17, 2024
- CVE-2024-31817High 7.5In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg.totolink · ex200 firmwareEPSS55%·Published Apr 15, 2024
- CVE-2024-3721Medium 6.3The manipulation of the argument mdb/mdc leads to os command injection.EPSS86%·Published Apr 13, 2024
- CVE-2024-1728Critical 9.2Duplicate Advisory: Gradio Local File Inclusion vulnerabilitygradio project · gradioEPSS85%·Published Apr 10, 2024
- CVE-2024-31997High 8.8XWiki Platform remote code execution from account through UIExtension parametersxwiki · xwikiEPSS74%1 exploitPublished Apr 10, 2024
- CVE-2024-31984High 8.8XWiki Platform: Remote code execution through space title and Solr space facetxwiki · xwikiEPSS83%1 exploitPublished Apr 10, 2024
- CVE-2024-31465High 8.8XWiki Platform: Remote code execution from account via SearchSuggestSourceSheetxwiki · xwikiEPSS76%·Published Apr 10, 2024
- CVE-2024-24809High 8.5Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type.EPSS54%2 exploitsPublished Apr 10, 2024
- CVE-2024-31309High 7.5HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server.apache · traffic serverEPSS95%·Published Apr 10, 2024
- CVE-2024-26256High 7.8Libarchive Remote Code Execution Vulnerabilitylibarchive · libarchiveEPSS88%·Published Apr 9, 2024
- CVE-2024-26212High 7.5DHCP Server Service Denial of Service Vulnerabilitymicrosoft · windows server 2008EPSS63%·Published Apr 9, 2024
- CVE-2024-27983High 8.2An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside.EPSS87%·Published Apr 9, 2024
- CVE-2024-2511Medium 5.9Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that…EPSS52%·Published Apr 8, 2024
- CVE-2024-28741High 8.8Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component.EPSS78%1 exploitPublished Apr 6, 2024
- CVE-2023-45288High 7.5net/http, x/net/http2: close connections when receiving too many headersEPSS92%·Published Apr 4, 2024
- CVE-2024-27316High 7.5HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response.fedoraproject · fedoraEPSS91%·Published Apr 4, 2024
- CVE-2024-30255High 7.5The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames.envoyproxy · envoyEPSS88%·Published Apr 4, 2024
- CVE-2024-3116Critical 9.8pgAdmin Remote Code Execution (RCE) vulnerabilitypgadmin · pgadmin 4EPSS66%1 exploitPublished Apr 4, 2024
- CVE-2024-28182Medium 5.3The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.nghttp2 · nghttp2EPSS85%·Published Apr 4, 2024
- CVE-2024-27919High 7.5In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames.envoyproxy · envoyEPSS87%·Published Apr 4, 2024
- CVE-2024-2653High 8.2AMPHP Denial of Service via HTTP/2 CONTINUATION FramesEPSS83%·Published Apr 3, 2024
- CVE-2024-2758Medium 6.3FW: HTTP/2 CONTINUATION frames can be utilized for DoS attacksEPSS73%·Published Apr 3, 2024
- CVE-2024-2389Critical 9.8In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified.progress · flowmonEPSS93%2 exploitsPublished Apr 2, 2024
- CVE-2024-0637High 8.8Centreon updateDirectory SQL Injection Remote Code Execution Vulnerabilitycentreon · centreon webEPSS72%·Published Apr 2, 2024
- CVE-2024-23115High 7.2Centreon updateGroups SQL Injection Remote Code Execution Vulnerabilitycentreon · centreonEPSS67%·Published Apr 2, 2024
- CVE-2024-23118High 7.2Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerabilitycentreon · centreon webEPSS53%·Published Apr 2, 2024
- CVE-2024-23117High 7.2Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerabilitycentreon · centreon webEPSS53%·Published Apr 2, 2024
- CVE-2024-23116High 7.2Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerabilitycentreon · centreon webEPSS53%·Published Apr 2, 2024
- CVE-2024-3094Critical 10.0Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0.enterprise linux · 10EPSS91%·Published Mar 29, 2024
- CVE-2024-31138Medium 5.4In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settingsjetbrains · teamcityEPSS75%·Published Mar 29, 2024
- CVE-2024-25735Critical 9.1An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58.wyrestorm · apollo vx20 firmwareEPSS51%2 exploitsPublished Mar 27, 2024
- CVE-2024-2863Critical 9.8This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant.lg · lg led assistantEPSS64%·Published Mar 25, 2024
- CVE-2024-2862Critical 9.8This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant.lg · lg led assistantEPSS51%·Published Mar 25, 2024
- CVE-2024-24725High 8.8Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI.gibbonedu · gibbonEPSS51%2 exploitsPublished Mar 23, 2024
- CVE-2024-27921High 8.8Grav File Upload Path Traversalgetgrav · gravEPSS61%1 exploitPublished Mar 22, 2024
- CVE-2024-2448High 8.8An OS command injection vulnerability has been identified in LoadMaster.progress · loadmasterEPSS55%·Published Mar 22, 2024
- CVE-2024-2054Critical 9.8The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user.articatech · artica proxyEPSS81%2 exploitsPublished Mar 20, 2024
- CVE-2024-1800High 8.8In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability.progress · telerik report serverEPSS40%1 exploitPublished Mar 20, 2024
- CVE-2024-27096Medium 6.5An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database.glpi-project · glpiEPSS59%·Published Mar 18, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-44443 | GIMP PSP File Parsing Integer Overflow Remote Code Execution Vulnerability. gimp · gimp | High 7.8 | 94% | · | |
| CVE-2023-44442 | GIMP PSD File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. gimp · gimp | High 7.8 | 61% | · | |
| CVE-2023-39469 | PaperCut NG External User Lookup Code Injection Remote Code Execution Vulnerability. papercut · papercut ng | High 7.2 | 61% | · | |
| CVE-2023-49606 | A use-after-free vulnerability exists in the HTTP Connection Headers parsing in Tinyproxy 1.11.1 and Tinyproxy 1.10.0. tinyproxy project · tinyproxy | Critical 9.8 | 63% | · | |
| CVE-2024-26331 | ReCrystallize Server 5.10.0.0 uses a authorization mechanism that relies on the value of a cookie, but it does not bind the cookie value to a session ID. | High 7.5 | 51% | · | |
| CVE-2024-31621 | Flowise vulnerable to code injection via api/v1 flowiseai · flowise | High 7.2 | 61% | · | |
| CVE-2020-14144 | Arbitrary Code Execution in Gitea gitea · gitea | High 7.2 | 95% | 2 exploits | |
| CVE-2024-32238 | H3C ER8300G2-X is vulnerable to Incorrect Access Control. | Critical 9.8 | 53% | · | |
| CVE-2024-24992 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ivanti · avalanche | High 8.8 | 71% | · | |
| CVE-2024-24994 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ivanti · avalanche | High 8.8 | 68% | · | |
| CVE-2024-23535 | A Path Traversal vulnerability in web component of Ivanti Avalanche before 6.4.3 allows a remote authenticated attacker to execute arbitrary commands as SYSTEM. ivanti · avalanche | High 8.8 | 68% | · | |
| CVE-2024-2961 | The iconv() function in the GNU C Library versions 2.39 and older may overflow the output buffer passed to it by up to 4 bytes when converting strings to the ISO-2022-CN-EXT character set, which may be used to crash an application or overwrite a neighbouring variable. gnu · glibc | High 7.3 | 88% | 1 exploit | |
| CVE-2024-31817 | In TOTOLINK EX200 V4.0.3c.7646_B20201211, an attacker can obtain sensitive information without authorization through the function getSysStatusCfg. totolink · ex200 firmware | High 7.5 | 55% | · | |
| CVE-2024-3721 | The manipulation of the argument mdb/mdc leads to os command injection. | Medium 6.3 | 86% | · | |
| CVE-2024-1728 | Duplicate Advisory: Gradio Local File Inclusion vulnerability gradio project · gradio | Critical 9.2 | 85% | · | |
| CVE-2024-31997 | XWiki Platform remote code execution from account through UIExtension parameters xwiki · xwiki | High 8.8 | 74% | 1 exploit | |
| CVE-2024-31984 | XWiki Platform: Remote code execution through space title and Solr space facet xwiki · xwiki | High 8.8 | 83% | 1 exploit | |
| CVE-2024-31465 | XWiki Platform: Remote code execution from account via SearchSuggestSourceSheet xwiki · xwiki | High 8.8 | 76% | · | |
| CVE-2024-24809 | Versions prior to 6.0 are vulnerable to path traversal and unrestricted upload of file with dangerous type. | High 8.5 | 54% | 2 exploits | |
| CVE-2024-31309 | HTTP/2 CONTINUATION DoS attack can cause Apache Traffic Server to consume more resources on the server. apache · traffic server | High 7.5 | 95% | · | |
| CVE-2024-26256 | Libarchive Remote Code Execution Vulnerability libarchive · libarchive | High 7.8 | 88% | · | |
| CVE-2024-26212 | DHCP Server Service Denial of Service Vulnerability microsoft · windows server 2008 | High 7.5 | 63% | · | |
| CVE-2024-27983 | An attacker can make the Node.js HTTP/2 server completely unavailable by sending a small amount of HTTP/2 frames packets with a few HTTP/2 frames inside. | High 8.2 | 87% | · | |
| CVE-2024-2511 | Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that… | Medium 5.9 | 52% | · | |
| CVE-2024-28741 | Cross Site Scripting vulnerability in EginDemirbilek NorthStar C2 v1 allows a remote attacker to execute arbitrary code via the login.php component. | High 8.8 | 78% | 1 exploit | |
| CVE-2023-45288 | net/http, x/net/http2: close connections when receiving too many headers | High 7.5 | 92% | · | |
| CVE-2024-27316 | HTTP/2 incoming headers exceeding the limit are temporarily buffered in nghttp2 in order to generate an informative HTTP 413 response. fedoraproject · fedora | High 7.5 | 91% | · | |
| CVE-2024-30255 | The HTTP/2 protocol stack in Envoy versions prior to 1.29.3, 1.28.2, 1.27.4, and 1.26.8 are vulnerable to CPU exhaustion due to flood of CONTINUATION frames. envoyproxy · envoy | High 7.5 | 88% | · | |
| CVE-2024-3116 | pgAdmin Remote Code Execution (RCE) vulnerability pgadmin · pgadmin 4 | Critical 9.8 | 66% | 1 exploit | |
| CVE-2024-28182 | The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. nghttp2 · nghttp2 | Medium 5.3 | 85% | · | |
| CVE-2024-27919 | In versions 1.29.0 and 1.29.1, theEnvoy HTTP/2 protocol stack is vulnerable to the flood of CONTINUATION frames. envoyproxy · envoy | High 7.5 | 87% | · | |
| CVE-2024-2653 | AMPHP Denial of Service via HTTP/2 CONTINUATION Frames | High 8.2 | 83% | · | |
| CVE-2024-2758 | FW: HTTP/2 CONTINUATION frames can be utilized for DoS attacks | Medium 6.3 | 73% | · | |
| CVE-2024-2389 | In Flowmon versions prior to 11.1.14 and 12.3.5, an operating system command injection vulnerability has been identified. progress · flowmon | Critical 9.8 | 93% | 2 exploits | |
| CVE-2024-0637 | Centreon updateDirectory SQL Injection Remote Code Execution Vulnerability centreon · centreon web | High 8.8 | 72% | · | |
| CVE-2024-23115 | Centreon updateGroups SQL Injection Remote Code Execution Vulnerability centreon · centreon | High 7.2 | 67% | · | |
| CVE-2024-23118 | Centreon updateContactHostCommands SQL Injection Remote Code Execution Vulnerability centreon · centreon web | High 7.2 | 53% | · | |
| CVE-2024-23117 | Centreon updateContactServiceCommands SQL Injection Remote Code Execution Vulnerability centreon · centreon web | High 7.2 | 53% | · | |
| CVE-2024-23116 | Centreon updateLCARelation SQL Injection Remote Code Execution Vulnerability centreon · centreon web | High 7.2 | 53% | · | |
| CVE-2024-3094 | Malicious code was discovered in the upstream tarballs of xz, starting with version 5.6.0. enterprise linux · 10 | Critical 10.0 | 91% | · | |
| CVE-2024-31138 | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings jetbrains · teamcity | Medium 5.4 | 75% | · | |
| CVE-2024-25735 | An issue was discovered on WyreStorm Apollo VX20 devices before 1.3.58. wyrestorm · apollo vx20 firmware | Critical 9.1 | 51% | 2 exploits | |
| CVE-2024-2863 | This vulnerability allows remote attackers to traverse paths via file upload on the affected LG LED Assistant. lg · lg led assistant | Critical 9.8 | 64% | · | |
| CVE-2024-2862 | This vulnerability allows remote attackers to reset the password of anonymous users without authorization on the affected LG LED Assistant. lg · lg led assistant | Critical 9.8 | 51% | · | |
| CVE-2024-24725 | Gibbon through 26.0.00 allows remote authenticated users to conduct PHP deserialization attacks via columnOrder in a POST request to the modules/System%20Admin/import_run.php&type=externalAssessment&step=4 URI. gibbonedu · gibbon | High 8.8 | 51% | 2 exploits | |
| CVE-2024-27921 | Grav File Upload Path Traversal getgrav · grav | High 8.8 | 61% | 1 exploit | |
| CVE-2024-2448 | An OS command injection vulnerability has been identified in LoadMaster. progress · loadmaster | High 8.8 | 55% | · | |
| CVE-2024-2054 | The Artica-Proxy administrative web application will deserialize arbitrary PHP objects supplied by unauthenticated users and subsequently enable code execution as the "www-data" user. articatech · artica proxy | Critical 9.8 | 81% | 2 exploits | |
| CVE-2024-1800 | In Progress® Telerik® Report Server versions prior to 2024 Q1 (10.0.24.130), a remote code execution attack is possible through an insecure deserialization vulnerability. progress · telerik report server | High 8.8 | 40% | 1 exploit | |
| CVE-2024-27096 | An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. glpi-project · glpi | Medium 6.5 | 59% | · |
Showing 301–350 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.