Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2024-28255Critical 9.8The JwtFilter handles the API authentication by requiring and verifying JWT tokens.open-metadata · openmetadataEPSS73%2 exploitsPublished Mar 15, 2024
- CVE-2024-28254High 8.8The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution.open-metadata · openmetadataEPSS46%1 exploitPublished Mar 15, 2024
- CVE-2024-27317Critical 9.9Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modificationapache · pulsarEPSS57%·Published Mar 14, 2024
- CVE-2024-1883Medium 6.1This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server.papercut · papercut ngEPSS61%·Published Mar 14, 2024
- CVE-2024-1222Critical 9.8This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges.papercut · papercut ngEPSS64%·Published Mar 14, 2024
- CVE-2024-1071Critical 9.8The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied…ultimatemember · ultimate memberEPSS89%·Published Mar 13, 2024
- CVE-2024-27956Critical 9.8Automatic <= 3.92.0 - Unauthenticated SQL Injectionvalvepress · automaticEPSS94%1 exploitPublished Mar 12, 2024
- CVE-2024-2194High 7.2WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site ScriptingEPSS68%·Published Mar 10, 2024
- CVE-2024-2044Critical 9.4pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated userpgadmin · pgadmin 4EPSS79%1 exploitPublished Mar 7, 2024
- CVE-2024-28156Medium 5.4Jenkins Build Monitor View Plugin vulnerable to stored Cross-site Scriptingjenkins · build monitor viewEPSS79%·Published Mar 7, 2024
- CVE-2024-25111High 7.5Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug.squid-cache · squidEPSS65%·Published Mar 6, 2024
- CVE-2024-0692High 8.8The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability.solarwinds · security event managerEPSS92%·Published Mar 4, 2024
- CVE-2024-20328Medium 5.3A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names.clamav · clamavEPSS85%·Published Mar 1, 2024
- CVE-2024-27292High 7.5Docassemble unauthorized access through URL manipulationjhpyle · docassembleEPSS69%·Published Feb 29, 2024
- CVE-2024-25723High 7.1ZenML Server Remote Privilege Escalation Vulnerabilityzenml · zenmlEPSS71%·Published Feb 27, 2024
- CVE-2023-40000Medium 6.1LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'litespeedtech · litespeed cacheEPSS55%1 exploitPublished Feb 26, 2024
- CVE-2024-1698Critical 9.8NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injectionwpdeveloper · notificationxEPSS78%·Published Feb 25, 2024
- CVE-2024-1451High 8.7A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims."gitlab · gitlabEPSS51%·Published Feb 22, 2024
- CVE-2024-1380Medium 5.3Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Exportrelevanssi · relevanssiEPSS50%·Published Feb 21, 2024
- CVE-2024-1512Critical 9.8MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injectionstylemixthemes · masterstudy lmsEPSS78%·Published Feb 19, 2024
- CVE-2024-20931High 7.5Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server.oracle · weblogic serverEPSS60%·Published Feb 19, 2024
- CVE-2024-23478High 8.0SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability.solarwinds · access rights managerEPSS82%·Published Feb 15, 2024
- CVE-2024-25617High 7.5Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing.squid-cache · squidEPSS88%·Published Feb 14, 2024
- CVE-2023-50868High 7.5The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue.isc · bindEPSS74%·Published Feb 14, 2024
- CVE-2023-50387High 7.5Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue.isc · bindEPSS100%·Published Feb 14, 2024
- CVE-2024-22024High 8.3An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication.ivanti · connect secureEPSS95%·Published Feb 13, 2024
- CVE-2023-47218High 8.3An OS command injection vulnerability has been reported to affect several QNAP operating system versions.qnap · qtsEPSS90%1 exploitPublished Feb 13, 2024
- CVE-2024-23759Critical 9.8Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function.gambio · gambioEPSS48%1 exploitPublished Feb 12, 2024
- CVE-2023-50386High 8.8Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSetsapache · solrEPSS84%1 exploitPublished Feb 9, 2024
- CVE-2024-23108Critical 9.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.fortinet · fortisiemEPSS80%Ransomware1 actorPublished Feb 8, 2024
- CVE-2023-6933Critical 9.8Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injectionwpengine · better search replaceEPSS68%·Published Feb 8, 2024
- CVE-2023-6989Critical 9.8Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusiongetshieldsecurity · shield securityEPSS57%·Published Feb 8, 2024
- CVE-2024-23917Critical 9.8In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possiblejetbrains · teamcityEPSS54%·Published Feb 6, 2024
- CVE-2023-46359Critical 9.8An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature.hardy-barth · cph2 echarge firmwareEPSS88%·Published Feb 5, 2024
- CVE-2024-22319Critical 9.8IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API.ibm · operational decision managerEPSS76%·Published Feb 5, 2024
- CVE-2024-22320High 8.8IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization.ibm · operational decision managerEPSS73%·Published Feb 5, 2024
- CVE-2024-21888High 8.8A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator.ivanti · connect secureEPSS85%1 exploitPublished Feb 1, 2024
- CVE-2024-23334High 8.2aiohttp is vulnerable to directory traversalaiohttp · aiohttpEPSS77%·Published Jan 29, 2024
- CVE-2024-0986Critical 9.8It has been rated as critical.issabel · pbxEPSS58%·Published Jan 28, 2024
- CVE-2023-52251High 8.8An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages.provectus · uiEPSS87%2 exploitsPublished Jan 25, 2024
- CVE-2024-22729Critical 9.8NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page.netis-systems · mw5360 firmwareEPSS71%2 exploitsPublished Jan 25, 2024
- CVE-2024-23898High 8.8Cross-site WebSocket hijacking vulnerability in the Jenkins CLIjenkins · jenkinsEPSS67%·Published Jan 24, 2024
- CVE-2024-23638Medium 6.5Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses.squid-cache · squidEPSS60%·Published Jan 24, 2024
- CVE-2024-0204Critical 9.8Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal.fortra · goanywhere managed file transferEPSS95%2 exploitsPublished Jan 22, 2024
- CVE-2022-34169High 7.5The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets.apache · xalan-javaEPSS82%·Published Jan 18, 2024
- CVE-2023-5914Medium 6.1Cross-site scripting (XSS)cloud · citrix storefrontEPSS75%·Published Jan 17, 2024
- CVE-2024-0507High 8.8An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console.github · enterprise serverEPSS66%·Published Jan 16, 2024
- CVE-2024-0200Critical 9.8An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection.github · enterprise serverEPSS72%·Published Jan 16, 2024
- CVE-2022-1609Critical 9.8The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site.weblizar · school managementEPSS64%·Published Jan 16, 2024
- CVE-2023-6623Critical 9.8Essential Blocks <= 4.4.2 - Unauthenticated Local File Inclusionwpdeveloper · essential blocksEPSS51%·Published Jan 16, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2024-28255 | The JwtFilter handles the API authentication by requiring and verifying JWT tokens. open-metadata · openmetadata | Critical 9.8 | 73% | 2 exploits | |
| CVE-2024-28254 | The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. open-metadata · openmetadata | High 8.8 | 46% | 1 exploit | |
| CVE-2024-27317 | Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification apache · pulsar | Critical 9.9 | 57% | · | |
| CVE-2024-1883 | This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. papercut · papercut ng | Medium 6.1 | 61% | · | |
| CVE-2024-1222 | This allows attackers to use a maliciously formed API request to gain access to an API authorization level with elevated privileges. papercut · papercut ng | Critical 9.8 | 64% | · | |
| CVE-2024-1071 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to SQL Injection via the 'sorting' parameter in versions 2.1.3 to 2.8.2 due to insufficient escaping on the user supplied… ultimatemember · ultimate member | Critical 9.8 | 89% | · | |
| CVE-2024-27956 | Automatic <= 3.92.0 - Unauthenticated SQL Injection valvepress · automatic | Critical 9.8 | 94% | 1 exploit | |
| CVE-2024-2194 | WP Statistics <= 14.5 - Unauthenticated Stored Cross-Site Scripting | High 7.2 | 68% | · | |
| CVE-2024-2044 | pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user pgadmin · pgadmin 4 | Critical 9.4 | 79% | 1 exploit | |
| CVE-2024-28156 | Jenkins Build Monitor View Plugin vulnerable to stored Cross-site Scripting jenkins · build monitor view | Medium 5.4 | 79% | · | |
| CVE-2024-25111 | Starting in version 3.5.27 and prior to version 6.8, Squid may be vulnerable to a Denial of Service attack against HTTP Chunked decoder due to an uncontrolled recursion bug. squid-cache · squid | High 7.5 | 65% | · | |
| CVE-2024-0692 | The SolarWinds Security Event Manager was susceptible to Remote Code Execution Vulnerability. solarwinds · security event manager | High 8.8 | 92% | · | |
| CVE-2024-20328 | A vulnerability in the VirusEvent feature of ClamAV could allow a local attacker to inject arbitrary commands with the privileges of the application service account.The vulnerability is due to unsafe handling of file names. clamav · clamav | Medium 5.3 | 85% | · | |
| CVE-2024-27292 | Docassemble unauthorized access through URL manipulation jhpyle · docassemble | High 7.5 | 69% | · | |
| CVE-2024-25723 | ZenML Server Remote Privilege Escalation Vulnerability zenml · zenml | High 7.1 | 71% | · | |
| CVE-2023-40000 | LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg' litespeedtech · litespeed cache | Medium 6.1 | 55% | 1 exploit | |
| CVE-2024-1698 | NotificationX – Best FOMO, Social Proof, WooCommerce Sales Popup & Notification Bar Plugin With Elementor <= 2.8.2 - Unauthenticated SQL Injection wpdeveloper · notificationx | Critical 9.8 | 78% | · | |
| CVE-2024-1451 | A crafted payload added to the user profile page could lead to a stored XSS on the client side, allowing attackers to perform arbitrary actions on behalf of victims." gitlab · gitlab | High 8.7 | 51% | · | |
| CVE-2024-1380 | Relevanssi – A Better Search <= 4.22.0 (Free) and <= 2.25.0 (Premium) - Missing Authorization to Unauthenticated Query Log Export relevanssi · relevanssi | Medium 5.3 | 50% | · | |
| CVE-2024-1512 | MasterStudy LMS WordPress Plugin – for Online Courses and Education <= 3.2.5 - Unauthenticated SQL Injection stylemixthemes · masterstudy lms | Critical 9.8 | 78% | · | |
| CVE-2024-20931 | Easily exploitable vulnerability allows unauthenticated attacker with network access via T3, IIOP to compromise Oracle WebLogic Server. oracle · weblogic server | High 7.5 | 60% | · | |
| CVE-2024-23478 | SolarWinds Access Rights Manager (ARM) was found to be susceptible to a Remote Code Execution Vulnerability. solarwinds · access rights manager | High 8.0 | 82% | · | |
| CVE-2024-25617 | Due to a Collapse of Data into Unsafe Value bug ,Squid may be vulnerable to a Denial of Service attack against HTTP header parsing. squid-cache · squid | High 7.5 | 88% | · | |
| CVE-2023-50868 | The Closest Encloser Proof aspect of the DNS protocol (in RFC 5155 when RFC 9276 guidance is skipped) allows remote attackers to cause a denial of service (CPU consumption for SHA-1 computations) via DNSSEC responses in a random subdomain attack, aka the "NSEC3" issue. isc · bind | High 7.5 | 74% | · | |
| CVE-2023-50387 | Certain DNSSEC aspects of the DNS protocol (in RFC 4033, 4034, 4035, 6840, and related RFCs) allow remote attackers to cause a denial of service (CPU consumption) via one or more DNSSEC responses, aka the "KeyTrap" issue. isc · bind | High 7.5 | 100% | · | |
| CVE-2024-22024 | An XML external entity or XXE vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x), Ivanti Policy Secure (9.x, 22.x) and ZTA gateways which allows an attacker to access certain restricted resources without authentication. ivanti · connect secure | High 8.3 | 95% | · | |
| CVE-2023-47218 | An OS command injection vulnerability has been reported to affect several QNAP operating system versions. qnap · qts | High 8.3 | 90% | 1 exploit | |
| CVE-2024-23759 | Deserialization of Untrusted Data in Gambio through 4.9.2.0 allows attackers to run arbitrary code via "search" parameter of the Parcelshopfinder/AddAddressBookEntry" function. gambio · gambio | Critical 9.8 | 48% | 1 exploit | |
| CVE-2023-50386 | Apache Solr: Backup/Restore APIs allow for deployment of executables in malicious ConfigSets apache · solr | High 8.8 | 84% | 1 exploit | |
| CVE-2024-23108 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests. fortinet · fortisiem | Critical 9.8 | 80% | Ransomware1 actor | |
| CVE-2023-6933 | Better Search Replace <= 1.4.4 - Unauthenticated PHP Object Injection wpengine · better search replace | Critical 9.8 | 68% | · | |
| CVE-2023-6989 | Shield Security – Smart Bot Blocking & Intrusion Prevention Security <= 18.5.9 - Unauthenticated Local File Inclusion getshieldsecurity · shield security | Critical 9.8 | 57% | · | |
| CVE-2024-23917 | In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible jetbrains · teamcity | Critical 9.8 | 54% | · | |
| CVE-2023-46359 | An OS command injection vulnerability in Hardy Barth cPH2 eCharge Ladestation v1.87.0 and earlier, may allow an unauthenticated remote attacker to execute arbitrary commands on the system via a specifically crafted arguments passed to the connectivity check feature. hardy-barth · cph2 echarge firmware | Critical 9.8 | 88% | · | |
| CVE-2024-22319 | IBM Operational Decision Manager 8.10.3, 8.10.4, 8.10.5.1, 8.11, 8.11.0.1, 8.11.1 and 8.12.0.1 is susceptible to remote code execution attack via JNDI injection when passing an unchecked argument to a certain API. ibm · operational decision manager | Critical 9.8 | 76% | · | |
| CVE-2024-22320 | IBM Operational Decision Manager 8.10.3 could allow a remote authenticated attacker to execute arbitrary code on the system, caused by an unsafe deserialization. ibm · operational decision manager | High 8.8 | 73% | · | |
| CVE-2024-21888 | A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a user to elevate privileges to that of an administrator. ivanti · connect secure | High 8.8 | 85% | 1 exploit | |
| CVE-2024-23334 | aiohttp is vulnerable to directory traversal aiohttp · aiohttp | High 8.2 | 77% | · | |
| CVE-2024-0986 | It has been rated as critical. issabel · pbx | Critical 9.8 | 58% | · | |
| CVE-2023-52251 | An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/{topic}/messages. provectus · ui | High 8.8 | 87% | 2 exploits | |
| CVE-2024-22729 | NETIS SYSTEMS MW5360 V1.0.1.3031 was discovered to contain a command injection vulnerability via the password parameter on the login page. netis-systems · mw5360 firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2024-23898 | Cross-site WebSocket hijacking vulnerability in the Jenkins CLI jenkins · jenkins | High 8.8 | 67% | · | |
| CVE-2024-23638 | Due to an expired pointer reference bug, Squid prior to version 6.6 is vulnerable to a Denial of Service attack against Cache Manager error responses. squid-cache · squid | Medium 6.5 | 60% | · | |
| CVE-2024-0204 | Authentication bypass in Fortra's GoAnywhere MFT prior to 7.4.1 allows an unauthorized user to create an admin user via the administration portal. fortra · goanywhere managed file transfer | Critical 9.8 | 95% | 2 exploits | |
| CVE-2022-34169 | The Apache Xalan Java XSLT library is vulnerable to an integer truncation issue when processing malicious XSLT stylesheets. apache · xalan-java | High 7.5 | 82% | · | |
| CVE-2023-5914 | Cross-site scripting (XSS) cloud · citrix storefront | Medium 6.1 | 75% | · | |
| CVE-2024-0507 | An attacker with access to a Management Console user account with the editor role could escalate privileges through a command injection vulnerability in the Management Console. github · enterprise server | High 8.8 | 66% | · | |
| CVE-2024-0200 | An unsafe reflection vulnerability was identified in GitHub Enterprise Server that could lead to reflection injection. github · enterprise server | Critical 9.8 | 72% | · | |
| CVE-2022-1609 | The School Management WordPress plugin before 9.9.7 contains an obfuscated backdoor injected in it's license checking code that registers a REST API handler, allowing an unauthenticated attacker to execute arbitrary PHP code on the site. weblizar · school management | Critical 9.8 | 64% | · | |
| CVE-2023-6623 | Essential Blocks <= 4.4.2 - Unauthenticated Local File Inclusion wpdeveloper · essential blocks | Critical 9.8 | 51% | · |
Showing 351–400 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.