Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
780 vulnerabilities · highest exploit probability first
- CVE-2020-27988Medium 5.4Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field).nagios · nagios xiEPSS91%·Published Nov 16, 2020
- CVE-2020-27128Medium 6.5A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system.cisco · sd-wanEPSS61%·Published Nov 6, 2020
- CVE-2020-6308Medium 5.3SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally.sap · businessobjects business intelligence platformEPSS62%·Published Oct 20, 2020
- CVE-2020-8821Medium 5.4An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint.webmin · webminEPSS79%·Published Oct 12, 2020
- CVE-2020-14179Medium 5.3Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint.atlassian · jira serverEPSS76%·Published Sep 20, 2020
- CVE-2020-14181Medium 5.3Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint.atlassian · data centerEPSS100%2 exploitsPublished Sep 16, 2020
- CVE-2020-12027Medium 4.3All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system.rockwellautomation · factorytalk viewEPSS53%1 exploitPublished Jul 20, 2020
- CVE-2020-9496Medium 6.1XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03apache · ofbizEPSS99%5 exploitsPublished Jul 15, 2020
- CVE-2020-5405Medium 6.5Directory traversal attack in Spring Cloud Configvmware · spring cloud configEPSS69%·Published Jun 5, 2020
- CVE-2020-8617Medium 5.9Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server.isc · bindEPSS93%1 exploitPublished May 19, 2020
- CVE-2020-12256Medium 5.4rConfig 3.9.4 is vulnerable to reflected XSS.rconfig · rconfigEPSS96%1 exploitPublished May 18, 2020
- CVE-2020-12259Medium 5.4rConfig 3.9.4 is vulnerable to reflected XSS.rconfig · rconfigEPSS96%·Published May 18, 2020
- CVE-2020-11022Medium 6.1Potential XSS vulnerability in jQueryjquery · jqueryEPSS99%2 exploitsPublished Apr 29, 2020
- CVE-2020-10977Medium 5.5GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects.gitlab · gitlabEPSS43%2 exploitsPublished Apr 8, 2020
- CVE-2020-11547Medium 5.3PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or…paessler · prtg network monitorEPSS52%·Published Apr 4, 2020
- CVE-2020-8143Medium 6.1An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144.revive-adserver · revive adserverEPSS70%·Published Apr 3, 2020
- CVE-2020-1934Medium 5.3In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server.apache · http serverEPSS52%·Published Apr 1, 2020
- CVE-2020-1943Medium 6.1Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07.apache · ofbizEPSS97%·Published Apr 1, 2020
- CVE-2020-11456Medium 5.4LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups).limesurvey · limesurveyEPSS71%2 exploitsPublished Apr 1, 2020
- CVE-2020-10821Medium 4.8Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter.nagios · nagios xiEPSS71%·Published Mar 22, 2020
- CVE-2020-10819Medium 4.8Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter.nagios · nagios xiEPSS71%·Published Mar 22, 2020
- CVE-2019-19985Medium 5.3The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure.icegram · email subscribers \& newslettersEPSS71%1 exploitPublished Dec 26, 2019
- CVE-2019-1439Medium 6.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.microsoft · windows 10EPSS75%·Published Nov 12, 2019
- CVE-2019-1166Medium 5.9A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering Vulnerability'.microsoft · windows 10EPSS68%·Published Oct 10, 2019
- CVE-2019-10092Medium 6.1In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page.apache · http serverEPSS81%2 exploitsPublished Sep 26, 2019
- CVE-2019-1252Medium 6.5An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'.microsoft · windows 10EPSS60%·Published Sep 11, 2019
- CVE-2019-8451Medium 6.5The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class.atlassian · jira serverEPSS94%·Published Sep 11, 2019
- CVE-2019-8449Medium 5.3The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability.atlassian · jiraEPSS85%2 exploitsPublished Sep 11, 2019
- CVE-2019-3964Medium 6.1In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter.open-emr · openemrEPSS53%·Published Aug 20, 2019
- CVE-2019-3963Medium 6.1In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter.open-emr · openemrEPSS53%·Published Aug 20, 2019
- CVE-2019-1184Medium 6.7An elevation of privilege vulnerability exists when Windows Core Shell COM Server Registrar improperly handles COM calls.microsoft · windows 10EPSS70%1 exploitPublished Aug 14, 2019
- CVE-2019-9516Medium 6.5Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service.redhat · jboss core servicesEPSS56%·Published Aug 13, 2019
- CVE-2019-12265Medium 5.3Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component.windriver · vxworksEPSS60%·Published Aug 9, 2019
- CVE-2019-13396Medium 5.3FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module.getflightpath · flightpathEPSS63%2 exploitsPublished Jul 10, 2019
- CVE-2019-13345Medium 6.1The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter.squid-cache · squidEPSS74%·Published Jul 5, 2019
- CVE-2019-7255Medium 6.1Linear eMerge E3-Series devices allow XSS.nortekcontrol · linear emerge elite firmwareEPSS56%2 exploitsPublished Jul 2, 2019
- CVE-2019-1622Medium 5.3A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device.cisco · data center network managerEPSS79%2 exploitsPublished Jun 27, 2019
- CVE-2018-13380Medium 6.1A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or…fortinet · fortiproxyEPSS62%·Published Jun 4, 2019
- CVE-2019-0221Medium 6.1Cross-site scripting in Apache Tomcatapache · tomcatEPSS59%1 exploitPublished May 30, 2019
- CVE-2019-12347Medium 6.1In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action.netgate · pfsenseEPSS59%2 exploitsPublished May 29, 2019
- CVE-2019-3799Medium 6.5Path Traversal in Spring Cloud Configvmware · spring cloud configEPSS85%1 exploitPublished May 23, 2019
- CVE-2019-3403Medium 5.3The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check.atlassian · jiraEPSS51%·Published May 22, 2019
- CVE-2019-11358Medium 6.1XSS in jQuery as used in Drupal, Backdrop CMS, and other productsbackdropcms · backdropEPSS87%1 exploitPublished Apr 26, 2019
- CVE-2019-3829Medium 5.3A memory corruption (double free) vulnerability in the certificate verification API.gnu · gnutlsEPSS59%·Published Mar 27, 2019
- CVE-2019-9692Medium 6.5class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG).cmsmadesimple · cms made simpleEPSS46%6 exploitsPublished Mar 11, 2019
- CVE-2019-8953Medium 6.1The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php.netgate · haproxyEPSS52%2 exploitsPublished Feb 20, 2019
- CVE-2019-8943Medium 6.5WordPress through 5.0.3 allows Path Traversal in wp_crop_image().wordpress · wordpressEPSS92%7 exploitsPublished Feb 20, 2019
- CVE-2019-6111Medium 5.9Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client.openbsd · opensshEPSS58%3 exploitsPublished Jan 31, 2019
- CVE-2018-16042Medium 6.5Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass…adobe · readerEPSS82%·Published Jan 18, 2019
- CVE-2013-7108Medium 5.5nagios3 - security updateicinga · icingaEPSS62%1 exploitPublished Dec 24, 2018
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2020-27988 | Nagios XI before 5.7.5 is vulnerable to XSS in Manage Users (Username field). nagios · nagios xi | Medium 5.4 | 91% | · | |
| CVE-2020-27128 | A vulnerability in the application data endpoints of Cisco SD-WAN vManage Software could allow an authenticated, remote attacker to write arbitrary files to an affected system. cisco · sd-wan | Medium 6.5 | 61% | · | |
| CVE-2020-6308 | SAP BusinessObjects Business Intelligence Platform (Web Services) versions - 410, 420, 430, allows an unauthenticated attacker to inject arbitrary values as CMS parameters to perform lookups on the internal network which is otherwise not accessible externally. sap · businessobjects business intelligence platform | Medium 5.3 | 62% | · | |
| CVE-2020-8821 | An Improper Data Validation Vulnerability exists in Webmin 1.941 and earlier affecting the Command Shell Endpoint. webmin · webmin | Medium 5.4 | 79% | · | |
| CVE-2020-14179 | Affected versions of Atlassian Jira Server and Data Center allow remote, unauthenticated attackers to view custom field names and custom SLA names via an Information Disclosure vulnerability in the /secure/QueryComponent!Default.jspa endpoint. atlassian · jira server | Medium 5.3 | 76% | · | |
| CVE-2020-14181 | Affected versions of Atlassian Jira Server and Data Center allow an unauthenticated user to enumerate users via an Information Disclosure vulnerability in the /ViewUserHover.jspa endpoint. atlassian · data center | Medium 5.3 | 100% | 2 exploits | |
| CVE-2020-12027 | All versions of FactoryTalk View SE disclose the hostnames and file paths for certain files within the system. rockwellautomation · factorytalk view | Medium 4.3 | 53% | 1 exploit | |
| CVE-2020-9496 | XML-RPC request are vulnerable to unsafe deserialization and Cross-Site Scripting issues in Apache OFBiz 17.12.03 apache · ofbiz | Medium 6.1 | 99% | 5 exploits | |
| CVE-2020-5405 | Directory traversal attack in Spring Cloud Config vmware · spring cloud config | Medium 6.5 | 69% | · | |
| CVE-2020-8617 | Using a specially-crafted message, an attacker may potentially cause a BIND server to reach an inconsistent state if the attacker knows (or successfully guesses) the name of a TSIG key used by the server. isc · bind | Medium 5.9 | 93% | 1 exploit | |
| CVE-2020-12256 | rConfig 3.9.4 is vulnerable to reflected XSS. rconfig · rconfig | Medium 5.4 | 96% | 1 exploit | |
| CVE-2020-12259 | rConfig 3.9.4 is vulnerable to reflected XSS. rconfig · rconfig | Medium 5.4 | 96% | · | |
| CVE-2020-11022 | Potential XSS vulnerability in jQuery jquery · jquery | Medium 6.1 | 99% | 2 exploits | |
| CVE-2020-10977 | GitLab EE/CE 8.5 to 12.9 is vulnerable to a an path traversal when moving an issue between projects. gitlab · gitlab | Medium 5.5 | 43% | 2 exploits | |
| CVE-2020-11547 | PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or… paessler · prtg network monitor | Medium 5.3 | 52% | · | |
| CVE-2020-8143 | An Open Redirect vulnerability was discovered in Revive Adserver version < 5.0.5 and reported by HackerOne user hoangn144. revive-adserver · revive adserver | Medium 6.1 | 70% | · | |
| CVE-2020-1934 | In Apache HTTP Server 2.4.0 to 2.4.41, mod_proxy_ftp may use uninitialized memory when proxying to a malicious FTP server. apache · http server | Medium 5.3 | 52% | · | |
| CVE-2020-1943 | Data sent with contentId to /control/stream is not sanitized, allowing XSS attacks in Apache OFBiz 16.11.01 to 16.11.07. apache · ofbiz | Medium 6.1 | 97% | · | |
| CVE-2020-11456 | LimeSurvey before 4.1.12+200324 has stored XSS in application/views/admin/surveysgroups/surveySettings.php and application/models/SurveysGroups.php (aka survey groups). limesurvey · limesurvey | Medium 5.4 | 71% | 2 exploits | |
| CVE-2020-10821 | Nagios XI 5.6.11 allows XSS via the account/main.php theme parameter. nagios · nagios xi | Medium 4.8 | 71% | · | |
| CVE-2020-10819 | Nagios XI 5.6.11 allows XSS via the includes/components/ldap_ad_integration/ username parameter. nagios · nagios xi | Medium 4.8 | 71% | · | |
| CVE-2019-19985 | The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed unauthenticated file download with user information disclosure. icegram · email subscribers \& newsletters | Medium 5.3 | 71% | 1 exploit | |
| CVE-2019-1439 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. microsoft · windows 10 | Medium 6.5 | 75% | · | |
| CVE-2019-1166 | A tampering vulnerability exists in Microsoft Windows when a man-in-the-middle attacker is able to successfully bypass the NTLM MIC (Message Integrity Check) protection, aka 'Windows NTLM Tampering Vulnerability'. microsoft · windows 10 | Medium 5.9 | 68% | · | |
| CVE-2019-10092 | In Apache HTTP Server 2.4.0-2.4.39, a limited cross-site scripting issue was reported affecting the mod_proxy error page. apache · http server | Medium 6.1 | 81% | 2 exploits | |
| CVE-2019-1252 | An information disclosure vulnerability exists when the Windows GDI component improperly discloses the contents of its memory, aka 'Windows GDI Information Disclosure Vulnerability'. microsoft · windows 10 | Medium 6.5 | 60% | · | |
| CVE-2019-8451 | The /plugins/servlet/gadgets/makeRequest resource in Jira before version 8.4.0 allows remote attackers to access the content of internal network resources via a Server Side Request Forgery (SSRF) vulnerability due to a logic bug in the JiraWhitelist class. atlassian · jira server | Medium 6.5 | 94% | · | |
| CVE-2019-8449 | The /rest/api/latest/groupuserpicker resource in Jira before version 8.4.0 allows remote attackers to enumerate usernames via an information disclosure vulnerability. atlassian · jira | Medium 5.3 | 85% | 2 exploits | |
| CVE-2019-3964 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the doc_id parameter. open-emr · openemr | Medium 6.1 | 53% | · | |
| CVE-2019-3963 | In OpenEMR 5.0.1 and earlier, controller.php contains a reflected XSS vulnerability in the patient_id parameter. open-emr · openemr | Medium 6.1 | 53% | · | |
| CVE-2019-1184 | An elevation of privilege vulnerability exists when Windows Core Shell COM Server Registrar improperly handles COM calls. microsoft · windows 10 | Medium 6.7 | 70% | 1 exploit | |
| CVE-2019-9516 | Some HTTP/2 implementations are vulnerable to a header leak, potentially leading to a denial of service. redhat · jboss core services | Medium 6.5 | 56% | · | |
| CVE-2019-12265 | Wind River VxWorks 6.5, 6.6, 6.7, 6.8, 6.9.3 and 6.9.4 has a Memory Leak in the IGMPv3 client component. windriver · vxworks | Medium 5.3 | 60% | · | |
| CVE-2019-13396 | FlightPath 4.x and 5.0-x allows directory traversal and Local File Inclusion through the form_include parameter in an index.php?q=system-handle-form-submit POST request because of an include_once in system_handle_form_submit in modules/system/system.module. getflightpath · flightpath | Medium 5.3 | 63% | 2 exploits | |
| CVE-2019-13345 | The cachemgr.cgi web module of Squid through 4.7 has XSS via the user_name or auth parameter. squid-cache · squid | Medium 6.1 | 74% | · | |
| CVE-2019-7255 | Linear eMerge E3-Series devices allow XSS. nortekcontrol · linear emerge elite firmware | Medium 6.1 | 56% | 2 exploits | |
| CVE-2019-1622 | A vulnerability in the web-based management interface of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to retrieve sensitive information from an affected device. cisco · data center network manager | Medium 5.3 | 79% | 2 exploits | |
| CVE-2018-13380 | A Cross-site Scripting (XSS) vulnerability in Fortinet FortiOS 6.0.0 to 6.0.4, 5.6.0 to 5.6.7, 5.4.0 to 5.4.12, 5.2 and below and Fortinet FortiProxy 2.0.0, 1.2.8 and below under SSL VPN web portal allows attacker to execute unauthorized malicious script code via the error or… fortinet · fortiproxy | Medium 6.1 | 62% | · | |
| CVE-2019-0221 | Cross-site scripting in Apache Tomcat apache · tomcat | Medium 6.1 | 59% | 1 exploit | |
| CVE-2019-12347 | In pfSense 2.4.4-p3, a stored XSS vulnerability occurs when attackers inject a payload into the Name or Description field via an acme_accountkeys_edit.php action. netgate · pfsense | Medium 6.1 | 59% | 2 exploits | |
| CVE-2019-3799 | Path Traversal in Spring Cloud Config vmware · spring cloud config | Medium 6.5 | 85% | 1 exploit | |
| CVE-2019-3403 | The /rest/api/2/user/picker rest resource in Jira before version 7.13.3, from version 8.0.0 before version 8.0.4, and from version 8.1.0 before version 8.1.1 allows remote attackers to enumerate usernames via an incorrect authorisation check. atlassian · jira | Medium 5.3 | 51% | · | |
| CVE-2019-11358 | XSS in jQuery as used in Drupal, Backdrop CMS, and other products backdropcms · backdrop | Medium 6.1 | 87% | 1 exploit | |
| CVE-2019-3829 | A memory corruption (double free) vulnerability in the certificate verification API. gnu · gnutls | Medium 5.3 | 59% | · | |
| CVE-2019-9692 | class.showtime2_image.php in CMS Made Simple (CMSMS) before 2.2.10 does not ensure that a watermark file has a standard image file extension (GIF, JPG, JPEG, or PNG). cmsmadesimple · cms made simple | Medium 6.5 | 46% | 6 exploits | |
| CVE-2019-8953 | The HAProxy package before 0.59_16 for pfSense has XSS via the desc (aka Description) or table_actionsaclN parameter, related to haproxy_listeners.php and haproxy_listeners_edit.php. netgate · haproxy | Medium 6.1 | 52% | 2 exploits | |
| CVE-2019-8943 | WordPress through 5.0.3 allows Path Traversal in wp_crop_image(). wordpress · wordpress | Medium 6.5 | 92% | 7 exploits | |
| CVE-2019-6111 | Due to the scp implementation being derived from 1983 rcp, the server chooses which files/directories are sent to the client. openbsd · openssh | Medium 5.9 | 58% | 3 exploits | |
| CVE-2018-16042 | Adobe Acrobat and Reader versions 2019.008.20081 and earlier, 2019.008.20080 and earlier, 2019.008.20081 and earlier, 2017.011.30106 and earlier version, 2017.011.30105 and earlier version, 2015.006.30457 and earlier, and 2015.006.30456 and earlier have a security bypass… adobe · reader | Medium 6.5 | 82% | · | |
| CVE-2013-7108 | nagios3 - security update icinga · icinga | Medium 5.5 | 62% | 1 exploit |
Showing 301–350 of 780
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.