Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 20, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2017-8046Critical 9.8Remote code execution in PATCH requests in Spring Data RESTpivotal software · spring data restEPSS75%1 exploitPublished May 13, 2022
- CVE-2022-26937Critical 9.8Windows Network File System Remote Code Execution Vulnerabilitymicrosoft · windows serverEPSS76%·Published May 11, 2022
- CVE-2022-26809Critical 9.8Remote Procedure Call Runtime Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS91%Ransomware1 actorPublished May 11, 2022
- CVE-2022-29535Critical 9.8Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports.zohocorp · manageengine opmanagerEPSS92%·Published May 5, 2022
- CVE-2022-1162Critical 9.8A hardcoded password was set for accounts registered using an OmniAuth provider (e.g.gitlab · gitlabEPSS76%1 exploitPublished May 5, 2022
- CVE-2022-29155Critical 9.8In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query.openldap · openldapEPSS64%·Published May 4, 2022
- CVE-2022-29081Critical 9.8Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction.zohocorp · manageengine access manager plusEPSS84%·Published Apr 28, 2022
- CVE-2021-46422Critical 9.8Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication.telesquare · sdt-cs3b1 firmwareEPSS94%3 exploitsPublished Apr 27, 2022
- CVE-2021-46442Critical 9.8In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization.dlink · dir-825 firmwareEPSS56%1 exploitPublished Apr 27, 2022
- CVE-2022-29806Critical 9.8ZoneMinder before 1.36.13 allows remote code execution via an invalid language.zoneminder · zoneminderEPSS67%2 exploitsPublished Apr 26, 2022
- CVE-2011-3923Critical 9.8Struts ParameterInterceptor vulnerability allows remote command executionapache · strutsEPSS89%2 exploitsPublished Apr 22, 2022
- CVE-2022-26133Critical 9.8SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute…atlassian · bitbucket data centerEPSS70%·Published Apr 20, 2022
- CVE-2022-0540Critical 9.8A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request.atlassian · jira serverEPSS88%·Published Apr 20, 2022
- CVE-2022-22956Critical 9.8VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework.vmware · identity managerEPSS50%1 exploitPublished Apr 14, 2022
- CVE-2021-31805Critical 9.8Expression Language Injection in Apache Strutsapache · strutsEPSS85%·Published Apr 13, 2022
- CVE-2021-46419Critical 9.1An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts.telesquare · tlr-2855ks6 firmwareEPSS71%2 exploitsPublished Apr 7, 2022
- CVE-2022-28219Critical 9.8Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution.zohocorp · manageengine adaudit plusEPSS97%2 exploitsPublished Apr 5, 2022
- CVE-2022-0342Critical 9.8An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG…zyxel · atp100 firmwareEPSS95%·Published Apr 4, 2022
- CVE-2022-28368Critical 9.8Remote code injection in dompdf/dompdfdompdf project · dompdfEPSS83%2 exploitsPublished Apr 4, 2022
- CVE-2022-28381Critical 9.8Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932.allmediaserver · allmediaserverEPSS70%3 exploitsPublished Apr 3, 2022
- CVE-2022-22274Critical 9.8A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall.sonicwall · sonicosEPSS76%·Published Mar 30, 2022
- CVE-2022-23305Critical 9.8By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout.apache · log4jEPSS67%·Published Mar 24, 2022
- CVE-2022-23881Critical 9.8ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php.zzzcms · zzzphpEPSS57%1 exploitPublished Mar 23, 2022
- CVE-2022-26960Critical 9.1Path Traversal in Studio-42 elFinder through 2.1.60std42 · elfinderEPSS51%·Published Mar 22, 2022
- CVE-2022-26148Critical 9.8The Zabbix password can be found in the api_jsonrpc.php HTML source code.grafana · grafanaEPSS53%·Published Mar 21, 2022
- CVE-2022-24637Critical 9.8Improper Privilege Management in Open Web Analyticsopenwebanalytics · open web analyticsEPSS99%3 exploitsPublished Mar 19, 2022
- CVE-2021-30180Critical 9.8Code injection in Apache Dubboapache · dubboEPSS60%·Published Mar 18, 2022
- CVE-2021-30181Critical 9.8Code injection in Apache Dubboapache · dubboEPSS61%·Published Mar 18, 2022
- CVE-2022-23943Critical 9.8Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data.apache · http serverEPSS50%·Published Mar 16, 2022
- CVE-2022-25487Critical 9.8Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php.thedigitalcraft · atomcmsEPSS54%2 exploitsPublished Mar 15, 2022
- CVE-2022-0169Critical 9.8Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter10web · photo galleryEPSS75%·Published Mar 15, 2022
- CVE-2021-25003Critical 9.8WPCargo <= 6.8.9 - Unauthenticated Remote Code Executionwptaskforce · wpcargo track \& traceEPSS56%·Published Mar 15, 2022
- CVE-2021-3711Critical 9.8SM2 Decryption Buffer Overflowopenssl · opensslEPSS88%·Published Mar 11, 2022
- CVE-2021-25216Critical 9.8In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running…isc · bindEPSS83%·Published Mar 11, 2022
- CVE-2021-4045Critical 9.8TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root.tp-link · tapo c200 firmwareEPSS72%2 exploitsPublished Mar 10, 2022
- CVE-2022-0441Critical 9.8The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an adminstylemixthemes · masterstudy lmsEPSS85%1 exploitPublished Mar 7, 2022
- CVE-2021-4039Critical 9.8A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device.zyxel · nwa1100-nh firmwareEPSS71%2 exploitsPublished Mar 2, 2022
- CVE-2022-0412Critical 9.8TI WooCommerce Wishlist / TI WooCommerce Wishlist Pro < 1.40.1 - Unauthenticated SQL Injectiontemplateinvaders · ti woocommerce wishlistEPSS74%·Published Mar 1, 2022
- CVE-2022-25061Critical 9.8TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute.tp-link · tl-wr840n firmwareEPSS59%·Published Feb 28, 2022
- CVE-2022-25075Critical 9.8TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function.totolink · a3000ru firmwareEPSS56%·Published Feb 24, 2022
- CVE-2021-44521Critical 9.1cassandra: RCE for scripted UDFsapache · cassandraEPSS58%·Published Feb 17, 2022
- CVE-2021-3781Critical 9.9A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command.artifex · ghostscriptEPSS84%·Published Feb 16, 2022
- CVE-2021-24931Critical 9.8Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injectionays-pro · secure copy content protection and content lockingEPSS79%2 exploitsPublished Feb 15, 2022
- CVE-2018-1002105Critical 9.8Privilege Escalation in Kuberneteskubernetes · kubernetesEPSS87%2 exploitsPublished Feb 15, 2022
- CVE-2018-15727Critical 9.8Grafana Authentication Bypassgrafana · grafanaEPSS64%·Published Feb 15, 2022
- CVE-2020-27955Critical 9.8Git LFS can execute a Git binary from the current directorygit large file storage project · git large file storageEPSS82%3 exploitsPublished Feb 11, 2022
- CVE-2022-20705Critical 9.8Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and…cisco · rv160 firmwareEPSS80%1 exploitPublished Feb 11, 2022
- CVE-2020-13957Critical 9.8Incorrect Authorization in Apache Solrapache · solrEPSS79%·Published Feb 10, 2022
- CVE-2020-13942Critical 9.8Injection and Improper Input Validation in Apache Unomiapache · unomiEPSS68%·Published Feb 10, 2022
- CVE-2022-21907Critical 9.8HTTP Protocol Stack Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS93%1 exploitPublished Feb 9, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2017-8046 | Remote code execution in PATCH requests in Spring Data REST pivotal software · spring data rest | Critical 9.8 | 75% | 1 exploit | |
| CVE-2022-26937 | Windows Network File System Remote Code Execution Vulnerability microsoft · windows server | Critical 9.8 | 76% | · | |
| CVE-2022-26809 | Remote Procedure Call Runtime Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 91% | Ransomware1 actor | |
| CVE-2022-29535 | Zoho ManageEngine OPManager through 125588 allows SQL Injection via a few default reports. zohocorp · manageengine opmanager | Critical 9.8 | 92% | · | |
| CVE-2022-1162 | A hardcoded password was set for accounts registered using an OmniAuth provider (e.g. gitlab · gitlab | Critical 9.8 | 76% | 1 exploit | |
| CVE-2022-29155 | In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. openldap · openldap | Critical 9.8 | 64% | · | |
| CVE-2022-29081 | Zoho ManageEngine Access Manager Plus before 4302, Password Manager Pro before 12007, and PAM360 before 5401 are vulnerable to access-control bypass on a few Rest API URLs (for SSOutAction. zohocorp · manageengine access manager plus | Critical 9.8 | 84% | · | |
| CVE-2021-46422 | Telesquare SDT-CW3B1 1.1.0 is affected by an OS command injection vulnerability that allows a remote attacker to execute OS commands without any authentication. telesquare · sdt-cs3b1 firmware | Critical 9.8 | 94% | 3 exploits | |
| CVE-2021-46442 | In the "webupg" binary of D-Link DIR-825 G1, attackers can bypass authentication through parameters "autoupgrade.asp", and perform functions such as downloading configuration files and updating firmware without authorization. dlink · dir-825 firmware | Critical 9.8 | 56% | 1 exploit | |
| CVE-2022-29806 | ZoneMinder before 1.36.13 allows remote code execution via an invalid language. zoneminder · zoneminder | Critical 9.8 | 67% | 2 exploits | |
| CVE-2011-3923 | Struts ParameterInterceptor vulnerability allows remote command execution apache · struts | Critical 9.8 | 89% | 2 exploits | |
| CVE-2022-26133 | SharedSecretClusterAuthenticator in Atlassian Bitbucket Data Center versions 5.14.0 and later before 7.6.14, 7.7.0 and later prior to 7.17.6, 7.18.0 and later prior to 7.18.4, 7.19.0 and later prior to 7.19.4, and 7.20.0 allow a remote, unauthenticated attacker to execute… atlassian · bitbucket data center | Critical 9.8 | 70% | · | |
| CVE-2022-0540 | A vulnerability in Jira Seraph allows a remote, unauthenticated attacker to bypass authentication by sending a specially crafted HTTP request. atlassian · jira server | Critical 9.8 | 88% | · | |
| CVE-2022-22956 | VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. vmware · identity manager | Critical 9.8 | 50% | 1 exploit | |
| CVE-2021-31805 | Expression Language Injection in Apache Struts apache · struts | Critical 9.8 | 85% | · | |
| CVE-2021-46419 | An unauthorized file deletion vulnerability in Telesquare TLR-2855KS6 via DELETE method can allow deletion of system files and scripts. telesquare · tlr-2855ks6 firmware | Critical 9.1 | 71% | 2 exploits | |
| CVE-2022-28219 | Cewolf in Zoho ManageEngine ADAudit Plus before 7060 is vulnerable to an unauthenticated XXE attack that leads to Remote Code Execution. zohocorp · manageengine adaudit plus | Critical 9.8 | 97% | 2 exploits | |
| CVE-2022-0342 | An authentication bypass vulnerability in the CGI program of Zyxel USG/ZyWALL series firmware versions 4.20 through 4.70, USG FLEX series firmware versions 4.50 through 5.20, ATP series firmware versions 4.32 through 5.20, VPN series firmware versions 4.30 through 5.20, and NSG… zyxel · atp100 firmware | Critical 9.8 | 95% | · | |
| CVE-2022-28368 | Remote code injection in dompdf/dompdf dompdf project · dompdf | Critical 9.8 | 83% | 2 exploits | |
| CVE-2022-28381 | Mediaserver.exe in ALLMediaServer 1.6 has a stack-based buffer overflow that allows remote attackers to execute arbitrary code via a long string to TCP port 888, a related issue to CVE-2017-17932. allmediaserver · allmediaserver | Critical 9.8 | 70% | 3 exploits | |
| CVE-2022-22274 | A Stack-based buffer overflow vulnerability in the SonicOS via HTTP request allows a remote unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution in the firewall. sonicwall · sonicos | Critical 9.8 | 76% | · | |
| CVE-2022-23305 | By design, the JDBCAppender in Log4j 1.2.x accepts an SQL statement as a configuration parameter where the values to be inserted are converters from PatternLayout. apache · log4j | Critical 9.8 | 67% | · | |
| CVE-2022-23881 | ZZZCMS zzzphp v2.1.0 was discovered to contain a remote command execution (RCE) vulnerability via danger_key() at zzz_template.php. zzzcms · zzzphp | Critical 9.8 | 57% | 1 exploit | |
| CVE-2022-26960 | Path Traversal in Studio-42 elFinder through 2.1.60 std42 · elfinder | Critical 9.1 | 51% | · | |
| CVE-2022-26148 | The Zabbix password can be found in the api_jsonrpc.php HTML source code. grafana · grafana | Critical 9.8 | 53% | · | |
| CVE-2022-24637 | Improper Privilege Management in Open Web Analytics openwebanalytics · open web analytics | Critical 9.8 | 99% | 3 exploits | |
| CVE-2021-30180 | Code injection in Apache Dubbo apache · dubbo | Critical 9.8 | 60% | · | |
| CVE-2021-30181 | Code injection in Apache Dubbo apache · dubbo | Critical 9.8 | 61% | · | |
| CVE-2022-23943 | Out-of-bounds Write vulnerability in mod_sed of Apache HTTP Server allows an attacker to overwrite heap memory with possibly attacker provided data. apache · http server | Critical 9.8 | 50% | · | |
| CVE-2022-25487 | Atom CMS v2.0 was discovered to contain a remote code execution (RCE) vulnerability via /admin/uploads.php. thedigitalcraft · atomcms | Critical 9.8 | 54% | 2 exploits | |
| CVE-2022-0169 | Photo Gallery by 10Web <= 1.5.87 - Unauthenticated SQL Injection via bwg_tag_id_bwg_thumbnails_0 Parameter 10web · photo gallery | Critical 9.8 | 75% | · | |
| CVE-2021-25003 | WPCargo <= 6.8.9 - Unauthenticated Remote Code Execution wptaskforce · wpcargo track \& trace | Critical 9.8 | 56% | · | |
| CVE-2021-3711 | SM2 Decryption Buffer Overflow openssl · openssl | Critical 9.8 | 88% | · | |
| CVE-2021-25216 | In BIND 9.5.0 -> 9.11.29, 9.12.0 -> 9.16.13, and versions BIND 9.11.3-S1 -> 9.11.29-S1 and 9.16.8-S1 -> 9.16.13-S1 of BIND Supported Preview Edition, as well as release versions 9.17.0 -> 9.17.1 of the BIND 9.17 development branch, BIND servers are vulnerable if they are running… isc · bind | Critical 9.8 | 83% | · | |
| CVE-2021-4045 | TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. tp-link · tapo c200 firmware | Critical 9.8 | 72% | 2 exploits | |
| CVE-2022-0441 | The MasterStudy LMS WordPress plugin before 2.7.6 does to validate some parameters given when registering a new account, allowing unauthenticated users to register as an admin stylemixthemes · masterstudy lms | Critical 9.8 | 85% | 1 exploit | |
| CVE-2021-4039 | A command injection vulnerability in the web interface of the Zyxel NWA-1100-NH firmware could allow an attacker to execute arbitrary OS commands on the device. zyxel · nwa1100-nh firmware | Critical 9.8 | 71% | 2 exploits | |
| CVE-2022-0412 | TI WooCommerce Wishlist / TI WooCommerce Wishlist Pro < 1.40.1 - Unauthenticated SQL Injection templateinvaders · ti woocommerce wishlist | Critical 9.8 | 74% | · | |
| CVE-2022-25061 | TP-LINK TL-WR840N(ES)_V6.20_180709 was discovered to contain a command injection vulnerability via the component oal_setIp6DefaultRoute. tp-link · tl-wr840n firmware | Critical 9.8 | 59% | · | |
| CVE-2022-25075 | TOTOLink A3000RU V5.9c.2280_B20180512 was discovered to contain a command injection vulnerability in the "Main" function. totolink · a3000ru firmware | Critical 9.8 | 56% | · | |
| CVE-2021-44521 | cassandra: RCE for scripted UDFs apache · cassandra | Critical 9.1 | 58% | · | |
| CVE-2021-3781 | A trivial sandbox (enabled with the -dSAFER option) escape flaw was found in the ghostscript interpreter by injecting a specially crafted pipe command. artifex · ghostscript | Critical 9.9 | 84% | · | |
| CVE-2021-24931 | Secure Copy Content Protection and Content Locking <= 2.8.1 - Unauthenticated SQL Injection ays-pro · secure copy content protection and content locking | Critical 9.8 | 79% | 2 exploits | |
| CVE-2018-1002105 | Privilege Escalation in Kubernetes kubernetes · kubernetes | Critical 9.8 | 87% | 2 exploits | |
| CVE-2018-15727 | Grafana Authentication Bypass grafana · grafana | Critical 9.8 | 64% | · | |
| CVE-2020-27955 | Git LFS can execute a Git binary from the current directory git large file storage project · git large file storage | Critical 9.8 | 82% | 3 exploits | |
| CVE-2022-20705 | Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate privileges Execute arbitrary commands Bypass authentication and authorization protections Fetch and… cisco · rv160 firmware | Critical 9.8 | 80% | 1 exploit | |
| CVE-2020-13957 | Incorrect Authorization in Apache Solr apache · solr | Critical 9.8 | 79% | · | |
| CVE-2020-13942 | Injection and Improper Input Validation in Apache Unomi apache · unomi | Critical 9.8 | 68% | · | |
| CVE-2022-21907 | HTTP Protocol Stack Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 93% | 1 exploit |
Showing 401–450 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.