Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
3,919 vulnerabilities · highest exploit probability first
- CVE-2023-50290Medium 6.5Solr: Host environment variables are published via the Metrics APIapache · solrEPSS68%·Published Jan 16, 2024
- CVE-2023-6875Critical 9.8POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app APIwpexperts · post smtpEPSS90%Ransomware1 actorPublished Jan 12, 2024
- CVE-2023-6567High 7.5LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_bythimpress · learnpressEPSS51%·Published Jan 12, 2024
- CVE-2023-50919Critical 9.8An issue was discovered on GL.iNet devices before version 4.5.0.gl-inet · gl-a1300 firmwareEPSS48%2 exploitsPublished Jan 12, 2024
- CVE-2023-31446Critical 9.8In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized.cassianetworks · xc1000 firmwareEPSS61%1 exploitPublished Jan 10, 2024
- CVE-2024-0352Critical 9.8A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311.likeshop · likeshopEPSS73%·Published Jan 9, 2024
- CVE-2024-20697High 7.3Windows libarchive Remote Code Execution Vulnerabilitymicrosoft · windows 11 22h2EPSS72%·Published Jan 9, 2024
- CVE-2023-51409Critical 9.8AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_uploadmeowapps · ai engineEPSS63%·Published Jan 8, 2024
- CVE-2024-21650Critical 9.8XWiki Remote Code Execution Vulnerability via User Registrationxwiki · xwikiEPSS93%·Published Jan 8, 2024
- CVE-2024-0305High 7.5Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login.ncast project · ncastEPSS67%1 exploitPublished Jan 8, 2024
- CVE-2023-7102Critical 9.8Use of a Third Party library produced a vulnerability in Barracuda Networks Inc.barracuda · email security gateway 300 firmwareEPSS45%1 exploitPublished Dec 28, 2023
- CVE-2023-51467Critical 9.8The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary codeapache · ofbizEPSS96%1 exploitPublished Dec 27, 2023
- CVE-2023-50968High 7.5Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations.apache · ofbizEPSS63%·Published Dec 27, 2023
- CVE-2023-51448High 8.8Cacti provides an operational monitoring and fault management framework.cacti · cactiEPSS67%2 exploitsPublished Dec 22, 2023
- CVE-2023-49085High 8.8Cacti provides an operational monitoring and fault management framework.cacti · cactiEPSS74%3 exploitsPublished Dec 22, 2023
- CVE-2023-49084High 8.8While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server.cacti · cactiEPSS64%2 exploitsPublished Dec 21, 2023
- CVE-2023-46264Critical 9.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution.ivanti · avalancheEPSS90%·Published Dec 20, 2023
- CVE-2023-46262High 7.5An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server.ivanti · avalancheEPSS83%·Published Dec 20, 2023
- CVE-2023-46263Critical 9.8An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution.ivanti · avalancheEPSS82%·Published Dec 20, 2023
- CVE-2023-6909High 8.7MLflow Path Traversal Vulnerabilitylfprojects · mlflowEPSS90%·Published Dec 20, 2023
- CVE-2023-38126High 7.2Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability.softing · edgeaggregatorEPSS71%·Published Dec 19, 2023
- CVE-2021-22962Critical 9.1An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack.ivanti · avalancheEPSS91%·Published Dec 19, 2023
- CVE-2023-48795Medium 5.9Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka TerrapinEPSS94%·Published Dec 18, 2023
- CVE-2023-6895Critical 9.8It has been declared as critical.hikvision · intercom broadcast systemEPSS89%Ransomware1 exploit1 actorPublished Dec 17, 2023
- CVE-2023-6893High 7.5Affected by this issue is some unknown functionality of the file /php/exportrecord.php.hikvision · intercom broadcast systemEPSS70%1 exploitPublished Dec 17, 2023
- CVE-2023-50721High 8.8Remote code execution from account through SearchAdminxwiki · xwikiEPSS79%·Published Dec 16, 2023
- CVE-2023-50720Medium 5.3Solr search discloses email addresses of usersxwiki · xwikiEPSS59%·Published Dec 16, 2023
- CVE-2023-50719High 7.5Solr search discloses password hashes of all usersxwiki · xwikiEPSS84%·Published Dec 16, 2023
- CVE-2023-50917Critical 9.8MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters.mjdm · majordomoEPSS38%1 exploitPublished Dec 15, 2023
- CVE-2023-48085Critical 9.8Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php.nagios · nagios xiEPSS76%·Published Dec 15, 2023
- CVE-2023-42326High 8.8An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components.netgate · pfsenseEPSS64%·Published Dec 15, 2023
- CVE-2023-42325Medium 5.4Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page.netgate · pfsenseEPSS58%·Published Dec 15, 2023
- CVE-2023-42327Medium 5.4Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page.netgate · pfsenseEPSS55%·Published Dec 15, 2023
- CVE-2023-50269High 7.5Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing.squid-cache · squidEPSS58%·Published Dec 14, 2023
- CVE-2023-46727Critical 9.8Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack.glpi-project · glpiEPSS68%·Published Dec 13, 2023
- CVE-2023-25690Critical 9.8Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack.apache · http serverEPSS85%·Published Dec 13, 2023
- CVE-2023-35628High 8.1Windows MSHTML Platform Remote Code Execution Vulnerabilitymicrosoft · windows 10 1507EPSS93%Ransomware1 actorPublished Dec 13, 2023
- CVE-2023-6553Critical 9.8Backup Migration <= 1.3.7 - Unauthenticated Remote Code Executionbackupbliss · backup migrationEPSS98%2 exploitsPublished Dec 10, 2023
- CVE-2023-50164Critical 9.8Apache Struts vulnerable to path traversalapache · strutsEPSS81%·Published Dec 7, 2023
- CVE-2023-48123High 8.8An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file.netgate · pfsenseEPSS68%·Published Dec 6, 2023
- CVE-2023-49070Critical 9.8Pre-auth RCE in Apache Ofbiz 18.12.09.apache · ofbizEPSS95%1 exploitPublished Dec 6, 2023
- CVE-2022-1471Critical 9.8SnakeYaml Constructor Deserialization Remote Code Executionsnakeyaml project · snakeyamlEPSS100%3 exploitsPublished Dec 6, 2023
- CVE-2023-6063High 7.5WP Fastest Cache <= 1.2.1 - Unauthenticated SQL Injectionwpfastestcache · wp fastest cacheEPSS74%·Published Dec 5, 2023
- CVE-2023-49285High 7.5Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing.squid-cache · squidEPSS88%·Published Dec 4, 2023
- CVE-2023-37928High 8.8A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted…zyxel · nas326 firmwareEPSS60%·Published Dec 1, 2023
- CVE-2023-6360Critical 9.8The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route.joedolson · my calendarEPSS63%·Published Nov 30, 2023
- CVE-2022-41678High 8.8Apache ActiveMQ Deserialization of Untrusted Data vulnerabilityapache · activemqEPSS86%·Published Nov 28, 2023
- CVE-2023-48022Critical 9.8Ray has arbitrary code execution via jobs submission APIanyscale · rayEPSS84%1 exploitPublished Nov 28, 2023
- CVE-2023-4220Medium 6.1Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web…chamilo · chamilo lmsEPSS76%2 exploitsPublished Nov 28, 2023
- CVE-2023-3368Critical 9.8Command injection in /main/webservices/additional_webservices.php in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters.chamilo · chamiloEPSS70%·Published Nov 28, 2023
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2023-50290 | Solr: Host environment variables are published via the Metrics API apache · solr | Medium 6.5 | 68% | · | |
| CVE-2023-6875 | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API wpexperts · post smtp | Critical 9.8 | 90% | Ransomware1 actor | |
| CVE-2023-6567 | LearnPress <= 4.2.5.7 - Unauthenticated SQL Injection via order_by thimpress · learnpress | High 7.5 | 51% | · | |
| CVE-2023-50919 | An issue was discovered on GL.iNet devices before version 4.5.0. gl-inet · gl-a1300 firmware | Critical 9.8 | 48% | 2 exploits | |
| CVE-2023-31446 | In Cassia Gateway firmware XC1000_2.1.1.2303082218 and XC2000_2.1.1.2303090947, the queueUrl parameter in /bypass/config is not sanitized. cassianetworks · xc1000 firmware | Critical 9.8 | 61% | 1 exploit | |
| CVE-2024-0352 | A vulnerability classified as critical was found in Likeshop up to 2.5.7.20210311. likeshop · likeshop | Critical 9.8 | 73% | · | |
| CVE-2024-20697 | Windows libarchive Remote Code Execution Vulnerability microsoft · windows 11 22h2 | High 7.3 | 72% | · | |
| CVE-2023-51409 | AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload meowapps · ai engine | Critical 9.8 | 63% | · | |
| CVE-2024-21650 | XWiki Remote Code Execution Vulnerability via User Registration xwiki · xwiki | Critical 9.8 | 93% | · | |
| CVE-2024-0305 | Affected by this issue is some unknown functionality of the file /manage/IPSetup.php of the component Guest Login. ncast project · ncast | High 7.5 | 67% | 1 exploit | |
| CVE-2023-7102 | Use of a Third Party library produced a vulnerability in Barracuda Networks Inc. barracuda · email security gateway 300 firmware | Critical 9.8 | 45% | 1 exploit | |
| CVE-2023-51467 | The vulnerability permits attackers to circumvent authentication processes, enabling them to remotely execute arbitrary code apache · ofbiz | Critical 9.8 | 96% | 1 exploit | |
| CVE-2023-50968 | Arbitrary file properties reading vulnerability in Apache Software Foundation Apache OFBiz when user operates an uri call without authorizations. apache · ofbiz | High 7.5 | 63% | · | |
| CVE-2023-51448 | Cacti provides an operational monitoring and fault management framework. cacti · cacti | High 8.8 | 67% | 2 exploits | |
| CVE-2023-49085 | Cacti provides an operational monitoring and fault management framework. cacti · cacti | High 8.8 | 74% | 3 exploits | |
| CVE-2023-49084 | While using the detected SQL Injection and insufficient processing of the include file path, it is possible to execute arbitrary code on the server. cacti · cacti | High 8.8 | 64% | 2 exploits | |
| CVE-2023-46264 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remove code execution. ivanti · avalanche | Critical 9.8 | 90% | · | |
| CVE-2023-46262 | An unauthenticated attacked could send a specifically crafted web request causing a Server-Side Request Forgery (SSRF) in Ivanti Avalanche Remote Control server. ivanti · avalanche | High 7.5 | 83% | · | |
| CVE-2023-46263 | An unrestricted upload of file with dangerous type vulnerability exists in Avalanche versions 6.4.1 and below that could allow an attacker to achieve a remote code execution. ivanti · avalanche | Critical 9.8 | 82% | · | |
| CVE-2023-6909 | MLflow Path Traversal Vulnerability lfprojects · mlflow | High 8.7 | 90% | · | |
| CVE-2023-38126 | Softing edgeAggregator Restore Configuration Directory Traversal Remote Code Execution Vulnerability. softing · edgeaggregator | High 7.2 | 71% | · | |
| CVE-2021-22962 | An attacker can send a specially crafted request which could lead to leakage of sensitive data or potentially a resource-based DoS attack. ivanti · avalanche | Critical 9.1 | 91% | · | |
| CVE-2023-48795 | Prefix Truncation Attack against ChaCha20-Poly1305 and Encrypt-then-MAC aka Terrapin | Medium 5.9 | 94% | · | |
| CVE-2023-6895 | It has been declared as critical. hikvision · intercom broadcast system | Critical 9.8 | 89% | Ransomware1 exploit1 actor | |
| CVE-2023-6893 | Affected by this issue is some unknown functionality of the file /php/exportrecord.php. hikvision · intercom broadcast system | High 7.5 | 70% | 1 exploit | |
| CVE-2023-50721 | Remote code execution from account through SearchAdmin xwiki · xwiki | High 8.8 | 79% | · | |
| CVE-2023-50720 | Solr search discloses email addresses of users xwiki · xwiki | Medium 5.3 | 59% | · | |
| CVE-2023-50719 | Solr search discloses password hashes of all users xwiki · xwiki | High 7.5 | 84% | · | |
| CVE-2023-50917 | MajorDoMo (aka Major Domestic Module) before 0662e5e allows command execution via thumb.php shell metacharacters. mjdm · majordomo | Critical 9.8 | 38% | 1 exploit | |
| CVE-2023-48085 | Nagios XI before version 5.11.3 was discovered to contain a remote code execution (RCE) vulnerability via the component command_test.php. nagios · nagios xi | Critical 9.8 | 76% | · | |
| CVE-2023-42326 | An issue in Netgate pfSense v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the interfaces_gif_edit.php and interfaces_gre_edit.php components. netgate · pfsense | High 8.8 | 64% | · | |
| CVE-2023-42325 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted url to the status_logs_filter_dynamic.php page. netgate · pfsense | Medium 5.4 | 58% | · | |
| CVE-2023-42327 | Cross Site Scripting (XSS) vulnerability in Netgate pfSense v.2.7.0 allows a remote attacker to gain privileges via a crafted URL to the getserviceproviders.php page. netgate · pfsense | Medium 5.4 | 55% | · | |
| CVE-2023-50269 | Due to an Uncontrolled Recursion bug in versions 2.6 through 2.7.STABLE9, versions 3.1 through 5.9, and versions 6.0.1 through 6.5, Squid may be vulnerable to a Denial of Service attack against HTTP Request parsing. squid-cache · squid | High 7.5 | 58% | · | |
| CVE-2023-46727 | Starting in version 10.0.0 and prior to version 10.0.11, GLPI inventory endpoint can be used to drive a SQL injection attack. glpi-project · glpi | Critical 9.8 | 68% | · | |
| CVE-2023-25690 | Some mod_proxy configurations on Apache HTTP Server versions 2.4.0 through 2.4.55 allow a HTTP Request Smuggling attack. apache · http server | Critical 9.8 | 85% | · | |
| CVE-2023-35628 | Windows MSHTML Platform Remote Code Execution Vulnerability microsoft · windows 10 1507 | High 8.1 | 93% | Ransomware1 actor | |
| CVE-2023-6553 | Backup Migration <= 1.3.7 - Unauthenticated Remote Code Execution backupbliss · backup migration | Critical 9.8 | 98% | 2 exploits | |
| CVE-2023-50164 | Apache Struts vulnerable to path traversal apache · struts | Critical 9.8 | 81% | · | |
| CVE-2023-48123 | An issue in Netgate pfSense Plus v.23.05.1 and before and pfSense CE v.2.7.0 allows a remote attacker to execute arbitrary code via a crafted request to the packet_capture.php file. netgate · pfsense | High 8.8 | 68% | · | |
| CVE-2023-49070 | Pre-auth RCE in Apache Ofbiz 18.12.09. apache · ofbiz | Critical 9.8 | 95% | 1 exploit | |
| CVE-2022-1471 | SnakeYaml Constructor Deserialization Remote Code Execution snakeyaml project · snakeyaml | Critical 9.8 | 100% | 3 exploits | |
| CVE-2023-6063 | WP Fastest Cache <= 1.2.1 - Unauthenticated SQL Injection wpfastestcache · wp fastest cache | High 7.5 | 74% | · | |
| CVE-2023-49285 | Due to a Buffer Overread bug Squid is vulnerable to a Denial of Service attack against Squid HTTP Message processing. squid-cache · squid | High 7.5 | 88% | · | |
| CVE-2023-37928 | A post-authentication command injection vulnerability in the WSGI server of the Zyxel NAS326 firmware version V5.21(AAZF.14)C0 and NAS542 firmware version V5.21(ABAG.11)C0 could allow an authenticated attacker to execute some operating system (OS) commands by sending a crafted… zyxel · nas326 firmware | High 8.8 | 60% | · | |
| CVE-2023-6360 | The 'My Calendar' WordPress Plugin, version < 3.4.22 is affected by an unauthenticated SQL injection vulnerability in the 'from' and 'to' parameters in the '/my-calendar/v1/events' rest route. joedolson · my calendar | Critical 9.8 | 63% | · | |
| CVE-2022-41678 | Apache ActiveMQ Deserialization of Untrusted Data vulnerability apache · activemq | High 8.8 | 86% | · | |
| CVE-2023-48022 | Ray has arbitrary code execution via jobs submission API anyscale · ray | Critical 9.8 | 84% | 1 exploit | |
| CVE-2023-4220 | Unrestricted file upload in big file upload functionality in /main/inc/lib/javascript/bigupload/inc/bigUpload.php in Chamilo LMS <= v1.11.24 allows unauthenticated attackers to perform stored cross-site scripting attacks and obtain remote code execution via uploading of web… chamilo · chamilo lms | Medium 6.1 | 76% | 2 exploits | |
| CVE-2023-3368 | Command injection in /main/webservices/additional_webservices.php in Chamilo LMS <= v1.11.20 allows unauthenticated attackers to obtain remote code execution via improper neutralisation of special characters. chamilo · chamilo | Critical 9.8 | 70% | · |
Showing 401–450 of 3,919
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.