Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
- CVE-2025-25256Critical 9.8An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and…fortinet · fortisiemEPSS65%Ransomware1 actorPublished Aug 12, 2025
- CVE-2025-29927Critical 9.1Authorization Bypass in Next.js Middlewarevercel · next.jsEPSS99%Ransomware1 exploit1 actorPublished Mar 21, 2025
- CVE-2024-25600Critical 10.0Bricks <= 1.9.6 - Unauthenticated Remote Code ExecutionEPSS88%Ransomware3 exploits1 actorPublished Jun 7, 2024
- CVE-2024-23108Critical 9.8An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests.fortinet · fortisiemEPSS80%Ransomware1 actorPublished Feb 8, 2024
- CVE-2023-6875Critical 9.8POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app APIwpexperts · post smtpEPSS90%Ransomware1 actorPublished Jan 12, 2024
- CVE-2023-6895Critical 9.8It has been declared as critical.hikvision · intercom broadcast systemEPSS89%Ransomware1 exploit1 actorPublished Dec 17, 2023
- CVE-2023-34992Critical 9.8A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests.fortinet · fortisiemEPSS82%Ransomware1 actorPublished Oct 11, 2023
- CVE-2023-39143Critical 9.8PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files.papercut · papercut mfEPSS80%Ransomware3 actorsPublished Aug 9, 2023
- CVE-2023-21716Critical 9.8Microsoft Word Remote Code Execution Vulnerabilitymicrosoft · wordEPSS85%Ransomware1 actorPublished Feb 14, 2023
- CVE-2022-26809Critical 9.8Remote Procedure Call Runtime Remote Code Execution Vulnerabilitymicrosoft · windows 10EPSS91%Ransomware1 actorPublished May 11, 2022
- CVE-2020-0610Critical 9.8A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution…microsoft · windows server 2012EPSS68%Ransomware2 exploits1 actorPublished Jan 14, 2020
- CVE-2020-0609Critical 9.8A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution…microsoft · windows server 2012EPSS78%Ransomware2 exploits1 actorPublished Jan 14, 2020
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-25256 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and… fortinet · fortisiem | Critical 9.8 | 65% | Ransomware1 actor | |
| CVE-2025-29927 | Authorization Bypass in Next.js Middleware vercel · next.js | Critical 9.1 | 99% | Ransomware1 exploit1 actor | |
| CVE-2024-25600 | Bricks <= 1.9.6 - Unauthenticated Remote Code Execution | Critical 10.0 | 88% | Ransomware3 exploits1 actor | |
| CVE-2024-23108 | An improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via via crafted API requests. fortinet · fortisiem | Critical 9.8 | 80% | Ransomware1 actor | |
| CVE-2023-6875 | POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress <= 2.8.7 - Authorization Bypass via type connect-app API wpexperts · post smtp | Critical 9.8 | 90% | Ransomware1 actor | |
| CVE-2023-6895 | It has been declared as critical. hikvision · intercom broadcast system | Critical 9.8 | 89% | Ransomware1 exploit1 actor | |
| CVE-2023-34992 | A improper neutralization of special elements used in an os command ('os command injection') vulnerability in Fortinet allows attacker to execute unauthorized code or commands via crafted API requests. fortinet · fortisiem | Critical 9.8 | 82% | Ransomware1 actor | |
| CVE-2023-39143 | PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. papercut · papercut mf | Critical 9.8 | 80% | Ransomware3 actors | |
| CVE-2023-21716 | Microsoft Word Remote Code Execution Vulnerability microsoft · word | Critical 9.8 | 85% | Ransomware1 actor | |
| CVE-2022-26809 | Remote Procedure Call Runtime Remote Code Execution Vulnerability microsoft · windows 10 | Critical 9.8 | 91% | Ransomware1 actor | |
| CVE-2020-0610 | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution… microsoft · windows server 2012 | Critical 9.8 | 68% | Ransomware2 exploits1 actor | |
| CVE-2020-0609 | A remote code execution vulnerability exists in Windows Remote Desktop Gateway (RD Gateway) when an unauthenticated attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Gateway (RD Gateway) Remote Code Execution… microsoft · windows server 2012 | Critical 9.8 | 78% | Ransomware2 exploits1 actor |
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.