Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2023-21547High 7.5Internet Key Exchange (IKE) Protocol Denial of Service Vulnerabilitymicrosoft · windows 10 1607EPSS89%·Published Jan 10, 2023
- CVE-2022-44149High 8.8The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component.nexxtsolutions · amp300 firmwareEPSS64%4 exploitsPublished Jan 6, 2023
- CVE-2022-43396High 8.8Apache Kylin vulnerable to Command injection by Useless configurationapache · kylinEPSS55%·Published Dec 30, 2022
- CVE-2022-46689High 7.0A race condition was addressed with additional validation.apple · ipadosEPSS48%1 exploitPublished Dec 15, 2022
- CVE-2022-29517High 8.8A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0.lansweeper · lansweeperEPSS58%·Published Dec 15, 2022
- CVE-2022-4223High 8.8pgadmin4 vulnerable to Code Injectionpgadmin · pgadmin 4EPSS80%·Published Dec 13, 2022
- CVE-2022-44690High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS82%·Published Dec 13, 2022
- CVE-2022-41076High 8.5PowerShell Remote Code Execution Vulnerabilitymicrosoft · powershellEPSS61%·Published Dec 13, 2022
- CVE-2022-3786High 7.5OpenSSL: X.509 Email Address Variable Length Buffer Overflowopenssl · opensslEPSS92%·Published Dec 12, 2022
- CVE-2022-41800High 8.7In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint.f5 · big-ip access policy managerEPSS77%3 exploitsPublished Dec 7, 2022
- CVE-2022-41622High 8.8In all versions,f5 · big-ip access policy managerEPSS92%3 exploitsPublished Dec 7, 2022
- CVE-2022-44635High 8.8Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code.apache · fineractEPSS69%·Published Nov 29, 2022
- CVE-2018-25032High 7.5zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.zlib · zlibEPSS52%·Published Nov 25, 2022
- CVE-2022-40770High 7.2Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection.zohocorp · manageengine servicedesk plusEPSS81%·Published Nov 23, 2022
- CVE-2022-42904High 7.2Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings.zohocorp · manageengine admanager plusEPSS83%·Published Nov 18, 2022
- CVE-2022-40127High 8.8Apache Airflow vulnerable to OS Command Injection via example DAGsapache · airflowEPSS86%·Published Nov 14, 2022
- CVE-2022-3602High 7.5X.509 Email Address 4-byte Buffer Overflowopenssl · opensslEPSS91%·Published Nov 1, 2022
- CVE-2022-38108High 7.2SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.solarwinds · orion platformEPSS66%1 exploitPublished Oct 20, 2022
- CVE-2022-36958High 8.8SolarWinds Platform was susceptible to the Deserialization of Untrusted Data.solarwinds · orion platformEPSS82%·Published Oct 20, 2022
- CVE-2022-38421High 7.2Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user.adobe · coldfusionEPSS80%·Published Oct 14, 2022
- CVE-2022-38419High 7.5Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read.adobe · coldfusionEPSS54%·Published Oct 14, 2022
- CVE-2022-41034High 7.8Visual Studio Code Remote Code Execution Vulnerabilitymicrosoft · visual studio codeEPSS67%1 exploitPublished Oct 11, 2022
- CVE-2022-38053High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS76%·Published Oct 11, 2022
- CVE-2022-38044High 7.8Windows CD-ROM File System Driver Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS56%·Published Oct 11, 2022
- CVE-2022-39288High 7.5fastify vulnerable to denial of service via malicious Content-Typefastify · fastifyEPSS59%·Published Oct 11, 2022
- CVE-2022-36961High 8.8A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution.solarwinds · orion platformEPSS74%·Published Sep 30, 2022
- CVE-2014-0050High 7.5MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended…apache · commons fileuploadEPSS83%1 exploitPublished Sep 28, 2022
- CVE-2022-36099High 8.8XWiki Platform Wiki UI Main Wiki Eval Injection vulnerabilityxwiki · xwikiEPSS76%1 exploitPublished Sep 16, 2022
- CVE-2022-36100High 8.8XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injectionxwiki · xwikiEPSS74%·Published Sep 16, 2022
- CVE-2022-36534High 8.8Super Flexible Software GmbH & Co.syncovery · syncoveryEPSS52%2 exploitsPublished Sep 16, 2022
- CVE-2022-35823High 8.8Microsoft SharePoint Remote Code Execution Vulnerabilitymicrosoft · sharepoint enterprise serverEPSS54%·Published Sep 14, 2022
- CVE-2022-37961High 8.8Microsoft SharePoint Server Remote Code Execution Vulnerabilitymicrosoft · sharepoint serverEPSS51%·Published Sep 14, 2022
- CVE-2022-37958High 8.1SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS86%·Published Sep 13, 2022
- CVE-2022-20828High 7.2A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root…cisco · asa firepowerEPSS49%2 exploitsPublished Sep 8, 2022
- CVE-2022-31474High 7.5BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Downloadithemes · backupbuddyEPSS64%·Published Sep 5, 2022
- CVE-2022-25813High 7.5In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page.apache · ofbizEPSS67%·Published Sep 2, 2022
- CVE-2022-2068High 7.3openssl: the c_rehash script allows command injectionopenssl · opensslEPSS96%·Published Aug 31, 2022
- CVE-2022-1292High 7.3openssl - security updateopenssl · opensslEPSS83%·Published Aug 31, 2022
- CVE-2022-38772High 8.8Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature.zohocorp · manageengine opmanagerEPSS78%·Published Aug 29, 2022
- CVE-2022-36633High 8.8Improper token validation leading to code execution in Teleportgoteleport · teleportEPSS50%1 exploitPublished Aug 25, 2022
- CVE-2022-30534High 8.8An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364.wwbn · avideoEPSS75%·Published Aug 22, 2022
- CVE-2022-0778High 7.5openssl - security updateopenssl · opensslEPSS73%·Published Aug 15, 2022
- CVE-2022-37024High 8.8Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code…zohocorp · manageengine opmanagerEPSS80%·Published Aug 10, 2022
- CVE-2018-7187High 8.8Remote command execution via "go get" command with "-insecure" option in cmd/gogolang · goEPSS63%1 exploitPublished Aug 9, 2022
- CVE-2022-31626High 8.8php7.3 - security updateEPSS58%·Published Aug 9, 2022
- CVE-2018-16873High 8.1Remote command execution via "go get" with "-u" flag in cmd/gogolang · goEPSS66%·Published Aug 4, 2022
- CVE-2022-2414High 7.5Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks.dogtagpki · dogtagpkiEPSS85%·Published Jul 29, 2022
- CVE-2022-30287High 8.0Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class.horde · groupwareEPSS69%·Published Jul 28, 2022
- CVE-2022-35650High 7.5Moodle Arbitrary file read when importing lesson questionsmoodle · moodleEPSS54%·Published Jul 26, 2022
- CVE-2022-34753High 8.8A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised.schneider-electric · spacelogic c-bus home controller firmwareEPSS70%1 exploitPublished Jul 13, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-21547 | Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability microsoft · windows 10 1607 | High 7.5 | 89% | · | |
| CVE-2022-44149 | The web service on Nexxt Amp300 ARN02304U8 42.103.1.5095 and 80.103.2.5045 devices allows remote OS command execution by placing &telnetd in the JSON host field to the ping feature of the goform/sysTools component. nexxtsolutions · amp300 firmware | High 8.8 | 64% | 4 exploits | |
| CVE-2022-43396 | Apache Kylin vulnerable to Command injection by Useless configuration apache · kylin | High 8.8 | 55% | · | |
| CVE-2022-46689 | A race condition was addressed with additional validation. apple · ipados | High 7.0 | 48% | 1 exploit | |
| CVE-2022-29517 | A directory traversal vulnerability exists in the HelpdeskActions.aspx edittemplate functionality of Lansweeper lansweeper 10.1.1.0. lansweeper · lansweeper | High 8.8 | 58% | · | |
| CVE-2022-4223 | pgadmin4 vulnerable to Code Injection pgadmin · pgadmin 4 | High 8.8 | 80% | · | |
| CVE-2022-44690 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 82% | · | |
| CVE-2022-41076 | PowerShell Remote Code Execution Vulnerability microsoft · powershell | High 8.5 | 61% | · | |
| CVE-2022-3786 | OpenSSL: X.509 Email Address Variable Length Buffer Overflow openssl · openssl | High 7.5 | 92% | · | |
| CVE-2022-41800 | In all versions of BIG-IP, when running in Appliance mode, an authenticated user assigned the Administrator role may be able to bypass Appliance mode restrictions, utilizing an undisclosed iControl REST endpoint. f5 · big-ip access policy manager | High 8.7 | 77% | 3 exploits | |
| CVE-2022-41622 | In all versions, f5 · big-ip access policy manager | High 8.8 | 92% | 3 exploits | |
| CVE-2022-44635 | Apache Fineract allowed an authenticated user to perform remote code execution due to a path traversal vulnerability in a file upload component of Apache Fineract, allowing an attacker to run remote code. apache · fineract | High 8.8 | 69% | · | |
| CVE-2018-25032 | zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches. zlib · zlib | High 7.5 | 52% | · | |
| CVE-2022-40770 | Zoho ManageEngine ServiceDesk Plus versions 13010 and prior are vulnerable to authenticated command injection. zohocorp · manageengine servicedesk plus | High 7.2 | 81% | · | |
| CVE-2022-42904 | Zoho ManageEngine ADManager Plus through 7151 allows authenticated admin users to execute the commands in proxy settings. zohocorp · manageengine admanager plus | High 7.2 | 83% | · | |
| CVE-2022-40127 | Apache Airflow vulnerable to OS Command Injection via example DAGs apache · airflow | High 8.8 | 86% | · | |
| CVE-2022-3602 | X.509 Email Address 4-byte Buffer Overflow openssl · openssl | High 7.5 | 91% | · | |
| CVE-2022-38108 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. solarwinds · orion platform | High 7.2 | 66% | 1 exploit | |
| CVE-2022-36958 | SolarWinds Platform was susceptible to the Deserialization of Untrusted Data. solarwinds · orion platform | High 8.8 | 82% | · | |
| CVE-2022-38421 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could result in arbitrary code execution in the context of the current user. adobe · coldfusion | High 7.2 | 80% | · | |
| CVE-2022-38419 | Adobe ColdFusion versions Update 14 (and earlier) and Update 4 (and earlier) are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could result in arbitrary file system read. adobe · coldfusion | High 7.5 | 54% | · | |
| CVE-2022-41034 | Visual Studio Code Remote Code Execution Vulnerability microsoft · visual studio code | High 7.8 | 67% | 1 exploit | |
| CVE-2022-38053 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 76% | · | |
| CVE-2022-38044 | Windows CD-ROM File System Driver Remote Code Execution Vulnerability microsoft · windows 10 | High 7.8 | 56% | · | |
| CVE-2022-39288 | fastify vulnerable to denial of service via malicious Content-Type fastify · fastify | High 7.5 | 59% | · | |
| CVE-2022-36961 | A vulnerable component of Orion Platform was vulnerable to SQL Injection, an authenticated attacker could leverage this for privilege escalation or remote code execution. solarwinds · orion platform | High 8.8 | 74% | · | |
| CVE-2014-0050 | MultipartStream.java in Apache Commons FileUpload before 1.3.1, as used in Apache Tomcat, JBoss Web, and other products, allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted Content-Type header that bypasses a loop's intended… apache · commons fileupload | High 7.5 | 83% | 1 exploit | |
| CVE-2022-36099 | XWiki Platform Wiki UI Main Wiki Eval Injection vulnerability xwiki · xwiki | High 8.8 | 76% | 1 exploit | |
| CVE-2022-36100 | XWiki Platform Applications Tag and XWiki Platform Tag UI vulnerable to Eval Injection xwiki · xwiki | High 8.8 | 74% | · | |
| CVE-2022-36534 | Super Flexible Software GmbH & Co. syncovery · syncovery | High 8.8 | 52% | 2 exploits | |
| CVE-2022-35823 | Microsoft SharePoint Remote Code Execution Vulnerability microsoft · sharepoint enterprise server | High 8.8 | 54% | · | |
| CVE-2022-37961 | Microsoft SharePoint Server Remote Code Execution Vulnerability microsoft · sharepoint server | High 8.8 | 51% | · | |
| CVE-2022-37958 | SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability microsoft · windows 10 | High 8.1 | 86% | · | |
| CVE-2022-20828 | A vulnerability in the CLI parser of Cisco FirePOWER Software for Adaptive Security Appliance (ASA) FirePOWER module could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected ASA FirePOWER module as the root… cisco · asa firepower | High 7.2 | 49% | 2 exploits | |
| CVE-2022-31474 | BackupBuddy 8.5.8.0 - 8.7.4.1 - Arbitrary File Download ithemes · backupbuddy | High 7.5 | 64% | · | |
| CVE-2022-25813 | In Apache OFBiz, versions 18.12.05 and earlier, an attacker acting as an anonymous user of the ecommerce plugin, can insert a malicious content in a message “Subject” field from the "Contact us" page. apache · ofbiz | High 7.5 | 67% | · | |
| CVE-2022-2068 | openssl: the c_rehash script allows command injection openssl · openssl | High 7.3 | 96% | · | |
| CVE-2022-1292 | openssl - security update openssl · openssl | High 7.3 | 83% | · | |
| CVE-2022-38772 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 125658, 126003, 126105, and 126120 allow authenticated users to make database changes that lead to remote code execution in the NMAP feature. zohocorp · manageengine opmanager | High 8.8 | 78% | · | |
| CVE-2022-36633 | Improper token validation leading to code execution in Teleport goteleport · teleport | High 8.8 | 50% | 1 exploit | |
| CVE-2022-30534 | An OS command injection vulnerability exists in the aVideoEncoder chunkfile functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. wwbn · avideo | High 8.8 | 75% | · | |
| CVE-2022-0778 | openssl - security update openssl · openssl | High 7.5 | 73% | · | |
| CVE-2022-37024 | Zoho ManageEngine OpManager, OpManager Plus, OpManager MSP, Network Configuration Manager, NetFlow Analyzer, and OpUtils before 2022-07-29 through 2022-07-30 ( 125658, 126003, 126105, and 126120) allow authenticated users to make database changes that lead to remote code… zohocorp · manageengine opmanager | High 8.8 | 80% | · | |
| CVE-2018-7187 | Remote command execution via "go get" command with "-insecure" option in cmd/go golang · go | High 8.8 | 63% | 1 exploit | |
| CVE-2022-31626 | php7.3 - security update | High 8.8 | 58% | · | |
| CVE-2018-16873 | Remote command execution via "go get" with "-u" flag in cmd/go golang · go | High 8.1 | 66% | · | |
| CVE-2022-2414 | Access to external entities when parsing XML documents can lead to XML external entity (XXE) attacks. dogtagpki · dogtagpki | High 7.5 | 85% | · | |
| CVE-2022-30287 | Horde Groupware Webmail Edition through 5.2.22 allows a reflection injection attack through which an attacker can instantiate a driver class. horde · groupware | High 8.0 | 69% | · | |
| CVE-2022-35650 | Moodle Arbitrary file read when importing lesson questions moodle · moodle | High 7.5 | 54% | · | |
| CVE-2022-34753 | A CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote root exploit when the command is compromised. schneider-electric · spacelogic c-bus home controller firmware | High 8.8 | 70% | 1 exploit |
Showing 301–350 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.