Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2022-34715Critical 9.8Windows Network File System Remote Code Execution Vulnerabilitymicrosoft · windows server 2022EPSS81%·Published Aug 10, 2022
- CVE-2022-36267Critical 9.8In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability.airspan · airspot 5410 firmwareEPSS55%3 exploitsPublished Aug 8, 2022
- CVE-2022-35869Critical 9.8This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114).inductiveautomation · ignitionEPSS60%·Published Jul 25, 2022
- CVE-2022-33318Critical 9.8Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics…iconics · genesis64EPSS50%·Published Jul 25, 2022
- CVE-2022-36446Critical 9.8software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command.webmin · webminEPSS96%3 exploitsPublished Jul 25, 2022
- CVE-2022-2487Critical 9.8The manipulation of the argument start_hour leads to os command injection.wavlink · wl-wn535k2 firmwareEPSS79%1 exploitPublished Jul 20, 2022
- CVE-2022-31137Critical 9.8Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability.roxy-wi · roxy-wiEPSS91%2 exploitsPublished Jul 8, 2022
- CVE-2022-25046Critical 9.8A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request.control-webpanel · webpanelEPSS57%1 exploitPublished Jul 7, 2022
- CVE-2022-31126Critical 9.8A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file.roxy-wi · roxy-wiEPSS53%1 exploitPublished Jul 6, 2022
- CVE-2022-34265Critical 9.3Django Trunc() and Extract() database functions vulnerable to SQL Injectiondjangoproject · djangoEPSS74%·Published Jul 5, 2022
- CVE-2022-2143Critical 9.8The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code.advantech · iviewEPSS60%2 exploitsPublished Jun 29, 2022
- CVE-2022-31061Critical 9.8In affected versions there is a SQL injection vulnerability which is possible on login page.glpi-project · glpiEPSS51%·Published Jun 28, 2022
- CVE-2022-28171Critical 9.8The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability.hikvision · ds-a71024 firmwareEPSS52%2 exploitsPublished Jun 27, 2022
- CVE-2022-29775Critical 9.8iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL.ispyconnect · ispyEPSS60%·Published Jun 21, 2022
- CVE-2022-24562Critical 9.8In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution.iobit · iotransferEPSS54%2 exploitsPublished Jun 16, 2022
- CVE-2022-30136Critical 9.8Windows Network File System Remote Code Execution Vulnerabilitymicrosoft · windows server 2012EPSS73%·Published Jun 15, 2022
- CVE-2009-3555Critical 9.8The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4…apache · http serverEPSS87%3 exploitsPublished Jun 10, 2022
- CVE-2022-29013Critical 9.8A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request.razer · sila firmwareEPSS77%2 exploitsPublished Jun 8, 2022
- CVE-2022-25237Critical 9.8Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter.bonitasoft · bonita webEPSS56%·Published Jun 2, 2022
- CVE-2022-22972Critical 9.8VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users.vmware · identity managerEPSS56%·Published Jun 1, 2022
- CVE-2022-24422Critical 9.8Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability.dell · idrac9EPSS59%·Published May 26, 2022
- CVE-2021-38540Critical 9.3Missing Authentication for Critical Function in Apache Airflowapache · airflowEPSS81%·Published May 24, 2022
- CVE-2021-3197Critical 9.8SaltStack Salt is vulnerable to shell injection via ProxyCommand argumentsaltstack · saltEPSS72%·Published May 24, 2022
- CVE-2021-25281Critical 9.8SaltStack Salt Improper Authentication vulnerabilitysaltstack · saltEPSS73%1 exploitPublished May 24, 2022
- CVE-2020-25592Critical 9.8SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapisaltstack · saltEPSS57%1 exploitPublished May 24, 2022
- CVE-2020-26935Critical 9.8phpMyAdmin SQL injection vulnerabilityphpmyadmin · phpmyadminEPSS66%·Published May 24, 2022
- CVE-2020-9757Critical 9.8SEOmatic for CraftCMS allows Server-Side Template Injectioncraftcms · craft cmsEPSS73%1 exploitPublished May 24, 2022
- CVE-2019-15954Critical 9.9Total.js CMS RCE Vulnerabilitytotaljs · total.js cmsEPSS79%2 exploitsPublished May 24, 2022
- CVE-2018-20434Critical 9.8LibreNMS arbitrary OS commands executionlibrenms · librenmsEPSS71%4 exploitsPublished May 24, 2022
- CVE-2014-9390Critical 9.3JGit Improper Input Validation vulnerabilityapple · xcodeEPSS76%1 exploitPublished May 17, 2022
- CVE-2014-8739Critical 9.8jQuery File Upload Plugin Unrestricted file upload vulnerabilitycreative-solutions · creative contact formEPSS92%5 exploitsPublished May 17, 2022
- CVE-2021-44790Critical 9.8A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts).apache · http serverEPSS97%2 exploitsPublished May 17, 2022
- CVE-2022-1386Critical 9.8Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgeryfusion builder project · fusion builderEPSS71%·Published May 17, 2022
- CVE-2011-3587Critical 9.3Zope Command Execution Vulnerabilityplone · ploneEPSS78%2 exploitsPublished May 17, 2022
- CVE-2013-5093Critical 9.5graphite-web is vulnerable to Remote Code Execution via renderLocalView functiongraphite project · graphiteEPSS39%1 exploitPublished May 17, 2022
- CVE-2016-5734Critical 9.8phpMyAdmin Code Injection vulnerabilityphpmyadmin · phpmyadminEPSS81%3 exploitsPublished May 17, 2022
- CVE-2014-8684Critical 9.8CodeIgniter and Kohana vulnerable to PHP Object Injectioncodeigniter · codeigniterEPSS72%2 exploitsPublished May 17, 2022
- CVE-2018-10094Critical 9.8Dolibarr SQL injection vulnerabilitydolibarr · dolibarrEPSS70%2 exploitsPublished May 14, 2022
- CVE-2008-5619Critical 10.0PHPMailer susceptible to arbitrary code executionroundcube · webmailEPSS59%2 exploitsPublished May 14, 2022
- CVE-2013-2134Critical 9.3Arbitrary code execution in Apache Struts 2apache · strutsEPSS70%1 exploitPublished May 14, 2022
- CVE-2016-9299Critical 9.8Improper Neutralization of Special Elements used in an LDAP Query in Jenkinsjenkins · jenkinsEPSS97%1 exploitPublished May 14, 2022
- CVE-2013-1965Critical 9.3Improper Control of Generation of Code in Apache Strutsapache · strutsEPSS94%·Published May 14, 2022
- CVE-2013-1966Critical 9.3Arbitrary code execution in Apache Strutsapache · strutsEPSS74%2 exploitsPublished May 14, 2022
- CVE-2016-3087Critical 9.8Apache Struts vulnerable to arbitrary remote code execution due to improper input validationapache · strutsEPSS82%3 exploitsPublished May 14, 2022
- CVE-2018-10931Critical 9.8Cobbler has Exposed Dangerous Method or Functioncobbler project · cobblerEPSS68%·Published May 13, 2022
- CVE-2018-9160Critical 9.8SiCKRAGE Discloses Plaintext Credentialssickrage · sickrageEPSS76%·Published May 13, 2022
- CVE-2017-9232Critical 9.8Juju uses a UNIX domain socket without setting appropriate permissionscanonical · jujuEPSS49%1 exploitPublished May 13, 2022
- CVE-2018-7251Critical 9.8Anchor CMS Logs Credentialsanchorcms · anchorEPSS72%1 exploitPublished May 13, 2022
- CVE-2015-8103Critical 9.8Jenkins CLI Deserialization of Untrusted Data vulnerabilityjenkins · jenkinsEPSS87%4 exploitsPublished May 13, 2022
- CVE-2019-9194Critical 9.8elFinder command injection vulnerability in the PHP connectorstd42 · elfinderEPSS97%5 exploitsPublished May 13, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-34715 | Windows Network File System Remote Code Execution Vulnerability microsoft · windows server 2022 | Critical 9.8 | 81% | · | |
| CVE-2022-36267 | In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerability. airspan · airspot 5410 firmware | Critical 9.8 | 55% | 3 exploits | |
| CVE-2022-35869 | This vulnerability allows remote attackers to bypass authentication on affected installations of Inductive Automation Ignition 8.1.15 (b2022030114). inductiveautomation · ignition | Critical 9.8 | 60% | · | |
| CVE-2022-33318 | Deserialization of Untrusted Data vulnerability in Mitsubishi Electric GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric Iconics Digital Solutions GENESIS64 versions 10.97 to 10.97.1, Mitsubishi Electric ICONICS Suite versions 10.97 to 10.97.1, Mitsubishi Electric Iconics… iconics · genesis64 | Critical 9.8 | 50% | · | |
| CVE-2022-36446 | software/apt-lib.pl in Webmin before 1.997 lacks HTML escaping for a UI command. webmin · webmin | Critical 9.8 | 96% | 3 exploits | |
| CVE-2022-2487 | The manipulation of the argument start_hour leads to os command injection. wavlink · wl-wn535k2 firmware | Critical 9.8 | 79% | 1 exploit | |
| CVE-2022-31137 | Versions prior to 6.1.1.0 are subject to a remote code execution vulnerability. roxy-wi · roxy-wi | Critical 9.8 | 91% | 2 exploits | |
| CVE-2022-25046 | A path traversal vulnerability in loader.php of CWP v0.9.8.1122 allows attackers to execute arbitrary code via a crafted POST request. control-webpanel · webpanel | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-31126 | A vulnerability in Roxy-wi allows a remote, unauthenticated attacker to code execution by sending a specially crafted HTTP request to /app/options.py file. roxy-wi · roxy-wi | Critical 9.8 | 53% | 1 exploit | |
| CVE-2022-34265 | Django Trunc() and Extract() database functions vulnerable to SQL Injection djangoproject · django | Critical 9.3 | 74% | · | |
| CVE-2022-2143 | The affected product is vulnerable to two instances of command injection, which may allow an attacker to remotely execute arbitrary code. advantech · iview | Critical 9.8 | 60% | 2 exploits | |
| CVE-2022-31061 | In affected versions there is a SQL injection vulnerability which is possible on login page. glpi-project · glpi | Critical 9.8 | 51% | · | |
| CVE-2022-28171 | The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. hikvision · ds-a71024 firmware | Critical 9.8 | 52% | 2 exploits | |
| CVE-2022-29775 | iSpyConnect iSpy v7.2.2.0 allows attackers to bypass authentication via a crafted URL. ispyconnect · ispy | Critical 9.8 | 60% | · | |
| CVE-2022-24562 | In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access to the entire file-system (with admin privileges) on the victim's endpoint, which can result in data theft and remote code execution. iobit · iotransfer | Critical 9.8 | 54% | 2 exploits | |
| CVE-2022-30136 | Windows Network File System Remote Code Execution Vulnerability microsoft · windows server 2012 | Critical 9.8 | 73% | · | |
| CVE-2009-3555 | The TLS protocol, and the SSL protocol 3.0 and possibly earlier, as used in Microsoft Internet Information Services (IIS) 7.0, mod_ssl in the Apache HTTP Server 2.2.14 and earlier, OpenSSL before 0.9.8l, GnuTLS 2.8.5 and earlier, Mozilla Network Security Services (NSS) 3.12.4… apache · http server | Critical 9.8 | 87% | 3 exploits | |
| CVE-2022-29013 | A command injection in the command parameter of Razer Sila Gaming Router v2.0.441_api-2.0.418 allows attackers to execute arbitrary commands via a crafted POST request. razer · sila firmware | Critical 9.8 | 77% | 2 exploits | |
| CVE-2022-25237 | Bonita Web 2021.2 is affected by a authentication/authorization bypass vulnerability due to an overly broad exclude pattern used in the RestAPIAuthorizationFilter. bonitasoft · bonita web | Critical 9.8 | 56% | · | |
| CVE-2022-22972 | VMware Workspace ONE Access, Identity Manager and vRealize Automation contain an authentication bypass vulnerability affecting local domain users. vmware · identity manager | Critical 9.8 | 56% | · | |
| CVE-2022-24422 | Dell iDRAC9 versions 5.00.00.00 and later but prior to 5.10.10.00, contain an improper authentication vulnerability. dell · idrac9 | Critical 9.8 | 59% | · | |
| CVE-2021-38540 | Missing Authentication for Critical Function in Apache Airflow apache · airflow | Critical 9.3 | 81% | · | |
| CVE-2021-3197 | SaltStack Salt is vulnerable to shell injection via ProxyCommand argument saltstack · salt | Critical 9.8 | 72% | · | |
| CVE-2021-25281 | SaltStack Salt Improper Authentication vulnerability saltstack · salt | Critical 9.8 | 73% | 1 exploit | |
| CVE-2020-25592 | SaltStack Salt Improper Validation of eauth credentials and tokens in salt-netapi saltstack · salt | Critical 9.8 | 57% | 1 exploit | |
| CVE-2020-26935 | phpMyAdmin SQL injection vulnerability phpmyadmin · phpmyadmin | Critical 9.8 | 66% | · | |
| CVE-2020-9757 | SEOmatic for CraftCMS allows Server-Side Template Injection craftcms · craft cms | Critical 9.8 | 73% | 1 exploit | |
| CVE-2019-15954 | Total.js CMS RCE Vulnerability totaljs · total.js cms | Critical 9.9 | 79% | 2 exploits | |
| CVE-2018-20434 | LibreNMS arbitrary OS commands execution librenms · librenms | Critical 9.8 | 71% | 4 exploits | |
| CVE-2014-9390 | JGit Improper Input Validation vulnerability apple · xcode | Critical 9.3 | 76% | 1 exploit | |
| CVE-2014-8739 | jQuery File Upload Plugin Unrestricted file upload vulnerability creative-solutions · creative contact form | Critical 9.8 | 92% | 5 exploits | |
| CVE-2021-44790 | A carefully crafted request body can cause a buffer overflow in the mod_lua multipart parser (r:parsebody() called from Lua scripts). apache · http server | Critical 9.8 | 97% | 2 exploits | |
| CVE-2022-1386 | Fusion Builder <= 3.6.1 & Avada <= 7.6.1 - Unauthenticated Server-Side Request Forgery fusion builder project · fusion builder | Critical 9.8 | 71% | · | |
| CVE-2011-3587 | Zope Command Execution Vulnerability plone · plone | Critical 9.3 | 78% | 2 exploits | |
| CVE-2013-5093 | graphite-web is vulnerable to Remote Code Execution via renderLocalView function graphite project · graphite | Critical 9.5 | 39% | 1 exploit | |
| CVE-2016-5734 | phpMyAdmin Code Injection vulnerability phpmyadmin · phpmyadmin | Critical 9.8 | 81% | 3 exploits | |
| CVE-2014-8684 | CodeIgniter and Kohana vulnerable to PHP Object Injection codeigniter · codeigniter | Critical 9.8 | 72% | 2 exploits | |
| CVE-2018-10094 | Dolibarr SQL injection vulnerability dolibarr · dolibarr | Critical 9.8 | 70% | 2 exploits | |
| CVE-2008-5619 | PHPMailer susceptible to arbitrary code execution roundcube · webmail | Critical 10.0 | 59% | 2 exploits | |
| CVE-2013-2134 | Arbitrary code execution in Apache Struts 2 apache · struts | Critical 9.3 | 70% | 1 exploit | |
| CVE-2016-9299 | Improper Neutralization of Special Elements used in an LDAP Query in Jenkins jenkins · jenkins | Critical 9.8 | 97% | 1 exploit | |
| CVE-2013-1965 | Improper Control of Generation of Code in Apache Struts apache · struts | Critical 9.3 | 94% | · | |
| CVE-2013-1966 | Arbitrary code execution in Apache Struts apache · struts | Critical 9.3 | 74% | 2 exploits | |
| CVE-2016-3087 | Apache Struts vulnerable to arbitrary remote code execution due to improper input validation apache · struts | Critical 9.8 | 82% | 3 exploits | |
| CVE-2018-10931 | Cobbler has Exposed Dangerous Method or Function cobbler project · cobbler | Critical 9.8 | 68% | · | |
| CVE-2018-9160 | SiCKRAGE Discloses Plaintext Credentials sickrage · sickrage | Critical 9.8 | 76% | · | |
| CVE-2017-9232 | Juju uses a UNIX domain socket without setting appropriate permissions canonical · juju | Critical 9.8 | 49% | 1 exploit | |
| CVE-2018-7251 | Anchor CMS Logs Credentials anchorcms · anchor | Critical 9.8 | 72% | 1 exploit | |
| CVE-2015-8103 | Jenkins CLI Deserialization of Untrusted Data vulnerability jenkins · jenkins | Critical 9.8 | 87% | 4 exploits | |
| CVE-2019-9194 | elFinder command injection vulnerability in the PHP connector std42 · elfinder | Critical 9.8 | 97% | 5 exploits |
Showing 351–400 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.