Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2023-25157Critical 9.8GeoServer OGC Filter SQL Injection Vulnerabilitiesosgeo · geoserverEPSS85%·Published Feb 22, 2023
- CVE-2022-23521Critical 9.8Git is distributed revision control system.git-scm · gitEPSS56%·Published Feb 21, 2023
- CVE-2022-39952Critical 9.8A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or…fortinet · fortinacEPSS100%1 exploitPublished Feb 17, 2023
- CVE-2023-21716Critical 9.8Microsoft Word Remote Code Execution Vulnerabilitymicrosoft · wordEPSS85%Ransomware1 actorPublished Feb 14, 2023
- CVE-2022-40022Critical 9.8Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.microchip · syncserver s650 firmwareEPSS92%1 exploitPublished Feb 13, 2023
- CVE-2022-48323Critical 9.8Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue.sunlogin · sunflowerEPSS57%1 exploitPublished Feb 13, 2023
- CVE-2022-45699Critical 9.8Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.apsystems · ecu-r firmwareEPSS77%1 exploitPublished Feb 9, 2023
- CVE-2022-3229Critical 9.8Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated…unifiedremote · unified remoteEPSS66%1 exploitPublished Feb 6, 2023
- CVE-2023-23333Critical 9.8There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.contec · solarview compact firmwareEPSS99%3 exploitsPublished Feb 6, 2023
- CVE-2023-20073Critical 9.8A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device.cisco · rv340 firmwareEPSS90%·Published Feb 3, 2023
- CVE-2023-23076Critical 9.8OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules.zohocorp · manageengine supportcenter plusEPSS74%·Published Feb 1, 2023
- CVE-2023-0587Critical 9.1A file upload vulnerability in exists in Trend Micro Apex One server build 11110.trendmicro · apex oneEPSS60%·Published Feb 1, 2023
- CVE-2022-31706Critical 9.8The vRealize Log Insight contains a Directory Traversal Vulnerability.vmware · vrealize log insightEPSS87%1 exploitPublished Jan 25, 2023
- CVE-2022-31704Critical 9.8The vRealize Log Insight contains a broken access control vulnerability.vmware · vrealize log insightEPSS81%1 exploitPublished Jan 25, 2023
- CVE-2023-23488Critical 9.8The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route.strangerstudios · paid memberships proEPSS92%1 exploitPublished Jan 20, 2023
- CVE-2023-0297Critical 9.8Code Injection in pyload-ngpyload · pyloadEPSS96%2 exploitsPublished Jan 14, 2023
- CVE-2023-22480Critical 9.8KubeOperator allows unauthorized access to system APIfit2cloud · kubeoperatorEPSS67%·Published Jan 9, 2023
- CVE-2023-22463Critical 9.8KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeysfit2cloud · kubepiEPSS70%·Published Jan 6, 2023
- CVE-2022-47523Critical 9.8Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection.zohocorp · manageengine access manager plusEPSS71%·Published Jan 5, 2023
- CVE-2021-45467Critical 9.8In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi…control-webpanel · webpanelEPSS71%·Published Dec 26, 2022
- CVE-2021-45466Critical 9.8In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.control-webpanel · webpanelEPSS55%·Published Dec 26, 2022
- CVE-2022-44456Critical 9.8CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request.contec · conprosys hmi systemEPSS70%·Published Dec 19, 2022
- CVE-2022-45933Critical 9.8KubeView vulnerable to full cluster takeover due to improper authenticationkubeview project · kubeviewEPSS52%·Published Nov 27, 2022
- CVE-2022-43672Critical 9.8Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671.zohocorp · manageengine password manager proEPSS67%·Published Nov 12, 2022
- CVE-2022-43671Critical 9.8Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection.zohocorp · manageengine password manager proEPSS75%·Published Nov 12, 2022
- CVE-2022-40471Critical 9.8Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.phporetnom23 · clinic\'s patient management systemEPSS23%3 exploitsPublished Oct 31, 2022
- CVE-2016-20016Critical 9.8MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI.mvpower · tv-7104he firmwareEPSS86%2 exploitsPublished Oct 19, 2022
- CVE-2022-2992Critical 9.9Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitLabgitlab · gitlabEPSS86%1 exploitPublished Oct 17, 2022
- CVE-2022-2884Critical 9.9Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in GitLabgitlab · gitlabEPSS76%1 exploitPublished Oct 17, 2022
- CVE-2022-38418Critical 9.8Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user.adobe · coldfusionEPSS80%·Published Oct 14, 2022
- CVE-2022-35711Critical 9.8Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.adobe · coldfusionEPSS74%·Published Oct 14, 2022
- CVE-2022-35690Critical 9.8Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user.adobe · coldfusionEPSS73%·Published Oct 14, 2022
- CVE-2022-32174Critical 9.0Gogs vulnerable to Cross-site Scriptinggogs · gogsEPSS58%·Published Oct 11, 2022
- CVE-2022-3218Critical 9.8Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution.necta · wifi mouse serverEPSS74%5 exploitsPublished Sep 19, 2022
- CVE-2022-40300Critical 9.8Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities.zohocorp · manageengine password manager proEPSS99%·Published Sep 16, 2022
- CVE-2022-36096Critical 9.0XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments listxwiki · xwikiEPSS60%·Published Sep 16, 2022
- CVE-2022-36098Critical 9.0XWiki Platform Mentions UI vulnerable to Cross-site Scriptingxwiki · xwikiEPSS72%·Published Sep 16, 2022
- CVE-2022-36094Critical 9.0XWiki Platform Web Parent POM vulnerable to XSS in the attachment historyxwiki · xwikiEPSS65%·Published Sep 16, 2022
- CVE-2022-34721Critical 9.8Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS76%·Published Sep 14, 2022
- CVE-2022-34718Critical 9.8Windows TCP/IP Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS54%·Published Sep 14, 2022
- CVE-2022-37860Critical 9.8The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability.tp-link · m7350 firmwareEPSS80%·Published Sep 12, 2022
- CVE-2022-31814Critical 9.8pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header.netgate · pfblockerngEPSS92%3 exploitsPublished Sep 5, 2022
- CVE-2022-36553Critical 9.8Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi.hytec · hwl-2511-ss firmwareEPSS91%·Published Aug 29, 2022
- CVE-2022-31499Critical 9.8Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo.nortekcontrol · emerge e3 firmwareEPSS65%2 exploitsPublished Aug 25, 2022
- CVE-2021-42627Critical 9.8The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page.dlink · dir-615 firmwareEPSS63%·Published Aug 23, 2022
- CVE-2022-30547Critical 9.9A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.wwbn · avideoEPSS64%·Published Aug 22, 2022
- CVE-2022-37061Critical 9.8All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection.flir · flir ax8 firmwareEPSS100%6 exploitsPublished Aug 18, 2022
- CVE-2020-9850Critical 9.8webkitgtk: Logic issue may lead to arbitrary code executionapple · icloudEPSS77%1 exploitPublished Aug 15, 2022
- CVE-2022-38130Critical 9.8The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS.keysight · sensor management serverEPSS55%·Published Aug 10, 2022
- CVE-2022-32429Critical 9.8An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution.megatech · msnswitch firmwareEPSS76%2 exploitsPublished Aug 10, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-25157 | GeoServer OGC Filter SQL Injection Vulnerabilities osgeo · geoserver | Critical 9.8 | 85% | · | |
| CVE-2022-23521 | Git is distributed revision control system. git-scm · git | Critical 9.8 | 56% | · | |
| CVE-2022-39952 | A external control of file name or path in Fortinet FortiNAC versions 9.4.0, 9.2.0 through 9.2.5, 9.1.0 through 9.1.7, 8.8.0 through 8.8.11, 8.7.0 through 8.7.6, 8.6.0 through 8.6.5, 8.5.0 through 8.5.4, 8.3.7 may allow an unauthenticated attacker to execute unauthorized code or… fortinet · fortinac | Critical 9.8 | 100% | 1 exploit | |
| CVE-2023-21716 | Microsoft Word Remote Code Execution Vulnerability microsoft · word | Critical 9.8 | 85% | Ransomware1 actor | |
| CVE-2022-40022 | Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability. microchip · syncserver s650 firmware | Critical 9.8 | 92% | 1 exploit | |
| CVE-2022-48323 | Sunlogin Sunflower Simplified (aka Sunflower Simple and Personal) 1.0.1.43315 is vulnerable to a path traversal issue. sunlogin · sunflower | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-45699 | Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter. apsystems · ecu-r firmware | Critical 9.8 | 77% | 1 exploit | |
| CVE-2022-3229 | Because the web management interface for Unified Intents' Unified Remote solution does not itself require authentication, a remote, unauthenticated attacker can change or disable authentication requirements for the Unified Remote protocol, and leverage this now-unauthenticated… unifiedremote · unified remote | Critical 9.8 | 66% | 1 exploit | |
| CVE-2023-23333 | There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php. contec · solarview compact firmware | Critical 9.8 | 99% | 3 exploits | |
| CVE-2023-20073 | A vulnerability in the web-based management interface of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an unauthenticated, remote attacker to upload arbitrary files to an affected device. cisco · rv340 firmware | Critical 9.8 | 90% | · | |
| CVE-2023-23076 | OS Command injection vulnerability in Support Center Plus 11 via Executor in Action when creating new schedules. zohocorp · manageengine supportcenter plus | Critical 9.8 | 74% | · | |
| CVE-2023-0587 | A file upload vulnerability in exists in Trend Micro Apex One server build 11110. trendmicro · apex one | Critical 9.1 | 60% | · | |
| CVE-2022-31706 | The vRealize Log Insight contains a Directory Traversal Vulnerability. vmware · vrealize log insight | Critical 9.8 | 87% | 1 exploit | |
| CVE-2022-31704 | The vRealize Log Insight contains a broken access control vulnerability. vmware · vrealize log insight | Critical 9.8 | 81% | 1 exploit | |
| CVE-2023-23488 | The Paid Memberships Pro WordPress Plugin, version < 2.9.8, is affected by an unauthenticated SQL injection vulnerability in the 'code' parameter of the '/pmpro/v1/order' REST route. strangerstudios · paid memberships pro | Critical 9.8 | 92% | 1 exploit | |
| CVE-2023-0297 | Code Injection in pyload-ng pyload · pyload | Critical 9.8 | 96% | 2 exploits | |
| CVE-2023-22480 | KubeOperator allows unauthorized access to system API fit2cloud · kubeoperator | Critical 9.8 | 67% | · | |
| CVE-2023-22463 | KubePi allows malicious actor to login with a forged JWT token via Hardcoded Jwtsigkeys fit2cloud · kubepi | Critical 9.8 | 70% | · | |
| CVE-2022-47523 | Zoho ManageEngine Access Manager Plus before 4309, Password Manager Pro before 12210, and PAM360 before 5801 are vulnerable to SQL Injection. zohocorp · manageengine access manager plus | Critical 9.8 | 71% | · | |
| CVE-2021-45467 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, an unauthenticated attacker can use %00 bytes to cause /user/loader.php to register an arbitrary API key, as demonstrated by a /user/loader.php?api=1&scripts= .%00./.%00./api/account_new_create&acc=guadaapi… control-webpanel · webpanel | Critical 9.8 | 71% | · | |
| CVE-2021-45466 | In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder. control-webpanel · webpanel | Critical 9.8 | 55% | · | |
| CVE-2022-44456 | CONPROSYS HMI System (CHS) Ver.3.4.4?and earlier allows a remote unauthenticated attacker to execute an arbitrary OS command on the server where the product is running by sending a specially crafted request. contec · conprosys hmi system | Critical 9.8 | 70% | · | |
| CVE-2022-45933 | KubeView vulnerable to full cluster takeover due to improper authentication kubeview project · kubeview | Critical 9.8 | 52% | · | |
| CVE-2022-43672 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection (in a different software component relative to CVE-2022-43671. zohocorp · manageengine password manager pro | Critical 9.8 | 67% | · | |
| CVE-2022-43671 | Zoho ManageEngine Password Manager Pro before 12122, PAM360 before 5711, and Access Manager Plus before 4306 allow SQL Injection. zohocorp · manageengine password manager pro | Critical 9.8 | 75% | · | |
| CVE-2022-40471 | Remote Code Execution in Clinic's Patient Management System v 1.0 allows Attacker to Upload arbitrary php webshell via profile picture upload functionality in users.php oretnom23 · clinic\'s patient management system | Critical 9.8 | 23% | 3 exploits | |
| CVE-2016-20016 | MVPower CCTV DVR models, including TV-7104HE 1.8.4 115215B9 and TV7108HE, contain a web shell that is accessible via a /shell URI. mvpower · tv-7104he firmware | Critical 9.8 | 86% | 2 exploits | |
| CVE-2022-2992 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') in GitLab gitlab · gitlab | Critical 9.9 | 86% | 1 exploit | |
| CVE-2022-2884 | Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') in GitLab gitlab · gitlab | Critical 9.9 | 76% | 1 exploit | |
| CVE-2022-38418 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. adobe · coldfusion | Critical 9.8 | 80% | · | |
| CVE-2022-35711 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. adobe · coldfusion | Critical 9.8 | 74% | · | |
| CVE-2022-35690 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by a Stack-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of the current user. adobe · coldfusion | Critical 9.8 | 73% | · | |
| CVE-2022-32174 | Gogs vulnerable to Cross-site Scripting gogs · gogs | Critical 9.0 | 58% | · | |
| CVE-2022-3218 | Due to a reliance on client-side authentication, the WiFi Mouse (Mouse Server) from Necta LLC's authentication mechanism is trivially bypassed, which can result in remote code execution. necta · wifi mouse server | Critical 9.8 | 74% | 5 exploits | |
| CVE-2022-40300 | Zoho ManageEngine Password Manager Pro through 12120 before 12121, PAM360 through 5550 before 5600, and Access Manager Plus through 4304 before 4305 have multiple SQL injection vulnerabilities. zohocorp · manageengine password manager pro | Critical 9.8 | 99% | · | |
| CVE-2022-36096 | XWiki Platform vulnerable to Cross-site Scripting in the deleted attachments list xwiki · xwiki | Critical 9.0 | 60% | · | |
| CVE-2022-36098 | XWiki Platform Mentions UI vulnerable to Cross-site Scripting xwiki · xwiki | Critical 9.0 | 72% | · | |
| CVE-2022-36094 | XWiki Platform Web Parent POM vulnerable to XSS in the attachment history xwiki · xwiki | Critical 9.0 | 65% | · | |
| CVE-2022-34721 | Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 76% | · | |
| CVE-2022-34718 | Windows TCP/IP Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 54% | · | |
| CVE-2022-37860 | The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability. tp-link · m7350 firmware | Critical 9.8 | 80% | · | |
| CVE-2022-31814 | pfSense pfBlockerNG through 2.1.4_26 allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the HTTP Host header. netgate · pfblockerng | Critical 9.8 | 92% | 3 exploits | |
| CVE-2022-36553 | Hytec Inter HWL-2511-SS v1.05 and below was discovered to contain a command injection vulnerability via the component /www/cgi-bin/popen.cgi. hytec · hwl-2511-ss firmware | Critical 9.8 | 91% | · | |
| CVE-2022-31499 | Nortek Linear eMerge E3-Series devices before 0.32-08f allow an unauthenticated attacker to inject OS commands via ReaderNo. nortekcontrol · emerge e3 firmware | Critical 9.8 | 65% | 2 exploits | |
| CVE-2021-42627 | The WAN configuration page "wan.htm" on D-Link DIR-615 devices with firmware 20.06 can be accessed directly without authentication which can lead to disclose the information about WAN settings and also leverage attacker to modify the data fields of page. dlink · dir-615 firmware | Critical 9.8 | 63% | · | |
| CVE-2022-30547 | A directory traversal vulnerability exists in the unzipDirectory functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. wwbn · avideo | Critical 9.9 | 64% | · | |
| CVE-2022-37061 | All FLIR AX8 thermal sensor cameras version up to and including 1.46.16 are vulnerable to Remote Command Injection. flir · flir ax8 firmware | Critical 9.8 | 100% | 6 exploits | |
| CVE-2020-9850 | webkitgtk: Logic issue may lead to arbitrary code execution apple · icloud | Critical 9.8 | 77% | 1 exploit | |
| CVE-2022-38130 | The com.keysight.tentacle.config.ResourceManager.smsRestoreDatabaseZip() method is used to restore the HSQLDB database used in SMS. keysight · sensor management server | Critical 9.8 | 55% | · | |
| CVE-2022-32429 | An authentication-bypass issue in the component http://MYDEVICEIP/cgi-bin-sdb/ExportSettings.sh of Mega System Technologies Inc MSNSwitch MNT.2408 allows unauthenticated attackers to arbitrarily configure settings within the application, leading to remote code execution. megatech · msnswitch firmware | Critical 9.8 | 76% | 2 exploits |
Showing 301–350 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.