Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,474 vulnerabilities · highest exploit probability first
- CVE-2022-30216High 8.8Windows Server Service Tampering Vulnerabilitymicrosoft · windows 10EPSS89%·Published Jul 12, 2022
- CVE-2022-2185High 8.8A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code…gitlab · gitlabEPSS77%·Published Jul 1, 2022
- CVE-2022-30522High 7.5If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort.apache · http serverEPSS90%·Published Jun 24, 2022
- CVE-2021-4104High 7.5JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration.apache · log4jEPSS81%·Published Jun 20, 2022
- CVE-2022-21449High 7.5OpenJDK: Improper ECDSA signature verification (Libraries, 8277233)oracle · graalvmEPSS77%·Published Jun 20, 2022
- CVE-2022-30780High 7.5Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers.lighttpd · lighttpdEPSS57%1 exploitPublished Jun 11, 2022
- CVE-2016-2183High 7.5SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32)openssl · opensslEPSS95%·Published Jun 10, 2022
- CVE-2021-3712High 7.4Read buffer overruns processing ASN.1 stringsopenssl · opensslEPSS50%·Published May 24, 2022
- CVE-2021-21659High 8.1XXE vulnerability in Jenkins URLTrigger Pluginjenkins · urltriggerEPSS67%·Published May 24, 2022
- CVE-2021-25282High 8.8SaltStack Salt Directory Traversal vulnerabilitysaltstack · saltEPSS92%1 exploitPublished May 24, 2022
- CVE-2020-25540High 7.5ThinkAdmin directory traversal vulnerabilitythinkadmin · thinkadminEPSS75%2 exploitsPublished May 24, 2022
- CVE-2019-9514High 7.5golang.org/x/net/http vulnerable to a reset floodredhat · developer toolsEPSS83%·Published May 24, 2022
- CVE-2019-9512High 7.5golang.org/x/net/http vulnerable to ping floodsnodejs · node.jsEPSS83%·Published May 24, 2022
- CVE-2019-14322High 7.5Pallets Werkzeug vulnerable to Path Traversalpalletsprojects · werkzeugEPSS56%1 exploitPublished May 24, 2022
- CVE-2019-12799High 8.8Shopware Insecure Deserialization Vulnerabilityshopware · shopwareEPSS54%1 exploitPublished May 24, 2022
- CVE-2022-21500High 7.5The supported version that is affected is 12.2.oracle · e-business suiteEPSS72%·Published May 19, 2022
- CVE-2021-44224High 8.2A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server…apache · http serverEPSS82%·Published May 17, 2022
- CVE-2022-22719High 7.5A carefully crafted request body can cause a read to a random memory area which could cause the process to crash.apache · http serverEPSS69%·Published May 17, 2022
- CVE-2010-4335High 7.5CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary codecakefoundation · cakephpEPSS55%3 exploitsPublished May 17, 2022
- CVE-2016-0709High 7.2Path Traversal in Apache Jetspeedapache · jetspeedEPSS77%2 exploitsPublished May 17, 2022
- CVE-2016-0710High 8.8Apache Jetspeed vulnerable to SQL Injectionapache · jetspeedEPSS52%3 exploitsPublished May 17, 2022
- CVE-2017-11870High 7.5Chakra Core vulnerable to privilege escalation when writing to JavaScript null scope objectsmicrosoft · chakracoreEPSS60%·Published May 17, 2022
- CVE-2022-30781High 7.5Shell command injection in giteagitea · giteaEPSS88%2 exploitsPublished May 17, 2022
- CVE-2016-0792High 8.8Jenkins allows Deserialization of Untrusted Data via an XML Filejenkins · jenkinsEPSS83%1 exploitPublished May 14, 2022
- CVE-2018-7490High 8.7uWSGI Directory Traversal vulnerabilityunbit · uwsgiEPSS69%·Published May 14, 2022
- CVE-2015-7611High 8.1Apache James Server OS Command Injectionapache · james serverEPSS69%2 exploitsPublished May 14, 2022
- CVE-2016-0956High 7.5Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Postadobe · experience managerEPSS51%1 exploitPublished May 14, 2022
- CVE-2016-7190High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS67%1 exploitPublished May 14, 2022
- CVE-2016-7194High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS58%1 exploitPublished May 14, 2022
- CVE-2016-7202High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS73%·Published May 14, 2022
- CVE-2016-7203High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS65%·Published May 14, 2022
- CVE-2016-7240High 7.5ChakraCore RCE Vulnerabilitymicrosoft · edgeEPSS66%·Published May 14, 2022
- CVE-2018-1000130High 8.1Injection in Jolokia agentjolokia · webarchive agentEPSS74%·Published May 14, 2022
- CVE-2017-12616High 7.5Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcatapache · tomcatEPSS70%·Published May 14, 2022
- CVE-2017-11911High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS65%·Published May 14, 2022
- CVE-2017-11909High 7.5ChakraCore vulnerable to remote code executionmicrosoft · chakracoreEPSS65%·Published May 14, 2022
- CVE-2017-11914High 7.5ChakraCore vulnerable to privilege escalation due to exposure from scriptFunctionmicrosoft · chakracoreEPSS63%·Published May 14, 2022
- CVE-2017-11893High 7.5ChakraCore vulnerable to remote code executionmicrosoft · chakracoreEPSS68%·Published May 14, 2022
- CVE-2014-0112High 7.3ClassLoader manipulation in Apache Strutsapache · strutsEPSS98%3 exploitsPublished May 14, 2022
- CVE-2014-0113High 7.5ClassLoader manipulation in Apache Strutsapache · strutsEPSS78%1 exploitPublished May 14, 2022
- CVE-2021-22901High 8.1curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection.haxx · curlEPSS64%·Published May 13, 2022
- CVE-2018-8145High 7.5ChakraCore information disclosure vulnerabilitymicrosoft · chakracoreEPSS67%1 exploitPublished May 13, 2022
- CVE-2018-1000600High 8.8CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentialsjenkins · githubEPSS91%·Published May 13, 2022
- CVE-2018-1000207High 7.2MODX Revolution Incorrect Access Control vulnerabilitymodx · modx revolutionEPSS64%1 exploitPublished May 13, 2022
- CVE-2017-11610High 8.7Incorrect Default Permissions in Supervisorsupervisord · supervisorEPSS87%1 exploitPublished May 13, 2022
- CVE-2018-10054High 8.8Improper Input Validation in Datomiccognitect · datomicEPSS34%1 exploitPublished May 13, 2022
- CVE-2019-10867High 8.8Pimcore Unserialize Remote Code Executionpimcore · pimcoreEPSS69%4 exploitsPublished May 13, 2022
- CVE-2017-1000119High 7.2October CMS PHP Code Executionoctobercms · octoberEPSS61%2 exploitsPublished May 13, 2022
- CVE-2016-5388High 8.1Improper Access Control in Apache Tomcatapache · tomcatEPSS51%·Published May 13, 2022
- CVE-2019-0567High 7.5ChakraCore RCE Vulnerabilitymicrosoft · chakracoreEPSS80%1 exploitPublished May 13, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-30216 | Windows Server Service Tampering Vulnerability microsoft · windows 10 | High 8.8 | 89% | · | |
| CVE-2022-2185 | A critical issue has been discovered in GitLab affecting all versions starting from 14.0 prior to 14.10.5, 15.0 prior to 15.0.4, and 15.1 prior to 15.1.1 where an authenticated user authorized to import projects could import a maliciously crafted project leading to remote code… gitlab · gitlab | High 8.8 | 77% | · | |
| CVE-2022-30522 | If Apache HTTP Server 2.4.53 is configured to do transformations with mod_sed in contexts where the input to mod_sed may be very large, mod_sed may make excessively large memory allocations and trigger an abort. apache · http server | High 7.5 | 90% | · | |
| CVE-2021-4104 | JMSAppender in Log4j 1.2 is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration. apache · log4j | High 7.5 | 81% | · | |
| CVE-2022-21449 | OpenJDK: Improper ECDSA signature verification (Libraries, 8277233) oracle · graalvm | High 7.5 | 77% | · | |
| CVE-2022-30780 | Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c has a typo that disrupts use of multiple read operations on large headers. lighttpd · lighttpd | High 7.5 | 57% | 1 exploit | |
| CVE-2016-2183 | SSL/TLS: Birthday attack against 64-bit block ciphers (SWEET32) openssl · openssl | High 7.5 | 95% | · | |
| CVE-2021-3712 | Read buffer overruns processing ASN.1 strings openssl · openssl | High 7.4 | 50% | · | |
| CVE-2021-21659 | XXE vulnerability in Jenkins URLTrigger Plugin jenkins · urltrigger | High 8.1 | 67% | · | |
| CVE-2021-25282 | SaltStack Salt Directory Traversal vulnerability saltstack · salt | High 8.8 | 92% | 1 exploit | |
| CVE-2020-25540 | ThinkAdmin directory traversal vulnerability thinkadmin · thinkadmin | High 7.5 | 75% | 2 exploits | |
| CVE-2019-9514 | golang.org/x/net/http vulnerable to a reset flood redhat · developer tools | High 7.5 | 83% | · | |
| CVE-2019-9512 | golang.org/x/net/http vulnerable to ping floods nodejs · node.js | High 7.5 | 83% | · | |
| CVE-2019-14322 | Pallets Werkzeug vulnerable to Path Traversal palletsprojects · werkzeug | High 7.5 | 56% | 1 exploit | |
| CVE-2019-12799 | Shopware Insecure Deserialization Vulnerability shopware · shopware | High 8.8 | 54% | 1 exploit | |
| CVE-2022-21500 | The supported version that is affected is 12.2. oracle · e-business suite | High 7.5 | 72% | · | |
| CVE-2021-44224 | A crafted URI sent to httpd configured as a forward proxy (ProxyRequests on) can cause a crash (NULL pointer dereference) or, for configurations mixing forward and reverse proxy declarations, can allow for requests to be directed to a declared Unix Domain Socket endpoint (Server… apache · http server | High 8.2 | 82% | · | |
| CVE-2022-22719 | A carefully crafted request body can cause a read to a random memory area which could cause the process to crash. apache · http server | High 7.5 | 69% | · | |
| CVE-2010-4335 | CakePHP allows remote attackers to modify internal Cake cache and execute arbitrary code cakefoundation · cakephp | High 7.5 | 55% | 3 exploits | |
| CVE-2016-0709 | Path Traversal in Apache Jetspeed apache · jetspeed | High 7.2 | 77% | 2 exploits | |
| CVE-2016-0710 | Apache Jetspeed vulnerable to SQL Injection apache · jetspeed | High 8.8 | 52% | 3 exploits | |
| CVE-2017-11870 | Chakra Core vulnerable to privilege escalation when writing to JavaScript null scope objects microsoft · chakracore | High 7.5 | 60% | · | |
| CVE-2022-30781 | Shell command injection in gitea gitea · gitea | High 7.5 | 88% | 2 exploits | |
| CVE-2016-0792 | Jenkins allows Deserialization of Untrusted Data via an XML File jenkins · jenkins | High 8.8 | 83% | 1 exploit | |
| CVE-2018-7490 | uWSGI Directory Traversal vulnerability unbit · uwsgi | High 8.7 | 69% | · | |
| CVE-2015-7611 | Apache James Server OS Command Injection apache · james server | High 8.1 | 69% | 2 exploits | |
| CVE-2016-0956 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Sling Servlets Post adobe · experience manager | High 7.5 | 51% | 1 exploit | |
| CVE-2016-7190 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 67% | 1 exploit | |
| CVE-2016-7194 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 58% | 1 exploit | |
| CVE-2016-7202 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 73% | · | |
| CVE-2016-7203 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 65% | · | |
| CVE-2016-7240 | ChakraCore RCE Vulnerability microsoft · edge | High 7.5 | 66% | · | |
| CVE-2018-1000130 | Injection in Jolokia agent jolokia · webarchive agent | High 8.1 | 74% | · | |
| CVE-2017-12616 | Exposure of Sensitive Information to an Unauthorized Actor in Apache Tomcat apache · tomcat | High 7.5 | 70% | · | |
| CVE-2017-11911 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 65% | · | |
| CVE-2017-11909 | ChakraCore vulnerable to remote code execution microsoft · chakracore | High 7.5 | 65% | · | |
| CVE-2017-11914 | ChakraCore vulnerable to privilege escalation due to exposure from scriptFunction microsoft · chakracore | High 7.5 | 63% | · | |
| CVE-2017-11893 | ChakraCore vulnerable to remote code execution microsoft · chakracore | High 7.5 | 68% | · | |
| CVE-2014-0112 | ClassLoader manipulation in Apache Struts apache · struts | High 7.3 | 98% | 3 exploits | |
| CVE-2014-0113 | ClassLoader manipulation in Apache Struts apache · struts | High 7.5 | 78% | 1 exploit | |
| CVE-2021-22901 | curl 7.75.0 through 7.76.1 suffers from a use-after-free vulnerability resulting in already freed memory being used when a TLS 1.3 session ticket arrives over a connection. haxx · curl | High 8.1 | 64% | · | |
| CVE-2018-8145 | ChakraCore information disclosure vulnerability microsoft · chakracore | High 7.5 | 67% | 1 exploit | |
| CVE-2018-1000600 | CSRF vulnerability and missing permission checks in GitHub Plugin allowed capturing credentials jenkins · github | High 8.8 | 91% | · | |
| CVE-2018-1000207 | MODX Revolution Incorrect Access Control vulnerability modx · modx revolution | High 7.2 | 64% | 1 exploit | |
| CVE-2017-11610 | Incorrect Default Permissions in Supervisor supervisord · supervisor | High 8.7 | 87% | 1 exploit | |
| CVE-2018-10054 | Improper Input Validation in Datomic cognitect · datomic | High 8.8 | 34% | 1 exploit | |
| CVE-2019-10867 | Pimcore Unserialize Remote Code Execution pimcore · pimcore | High 8.8 | 69% | 4 exploits | |
| CVE-2017-1000119 | October CMS PHP Code Execution octobercms · october | High 7.2 | 61% | 2 exploits | |
| CVE-2016-5388 | Improper Access Control in Apache Tomcat apache · tomcat | High 8.1 | 51% | · | |
| CVE-2019-0567 | ChakraCore RCE Vulnerability microsoft · chakracore | High 7.5 | 80% | 1 exploit |
Showing 351–400 of 1,474
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.