Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
- CVE-2025-55183Medium 5.3Source Code Exposure Vulnerability in React Server Componentsfacebook · reactEPSS64%Ransomware1 actorPublished Dec 11, 2025
- CVE-2025-40598Medium 6.1A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.sonicwall · sma 210 firmwareEPSS64%Ransomware1 actorPublished Jul 23, 2025
- CVE-2025-53771Medium 6.5Microsoft SharePoint Server Spoofing Vulnerabilitymicrosoft · sharepoint serverEPSS100%Ransomware1 exploit8 actorsPublished Jul 8, 2025
- CVE-2021-30119Medium 5.4Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request:…kaseya · vsaEPSS53%Ransomware1 actorPublished Jul 9, 2021
- CVE-2017-5754Medium 5.6Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache.arm · cortex-aEPSS84%Ransomware1 actorPublished Jan 4, 2018
- CVE-2017-5753Medium 5.6Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis.EPSS94%Ransomware3 exploits1 actorPublished Jan 4, 2018
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55183 | Source Code Exposure Vulnerability in React Server Components facebook · react | Medium 5.3 | 64% | Ransomware1 actor | |
| CVE-2025-40598 | A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code. sonicwall · sma 210 firmware | Medium 6.1 | 64% | Ransomware1 actor | |
| CVE-2025-53771 | Microsoft SharePoint Server Spoofing Vulnerability microsoft · sharepoint server | Medium 6.5 | 100% | Ransomware1 exploit8 actors | |
| CVE-2021-30119 | Authenticated reflective XSS in HelpDeskTab/rcResults.asp The parameter result of /HelpDeskTab/rcResults.asp is insecurely returned in the requested web page and can be used to perform a Cross Site Scripting attack Example request:… kaseya · vsa | Medium 5.4 | 53% | Ransomware1 actor | |
| CVE-2017-5754 | Systems with microprocessors utilizing speculative execution and indirect branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis of the data cache. arm · cortex-a | Medium 5.6 | 84% | Ransomware1 actor | |
| CVE-2017-5753 | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | Medium 5.6 | 94% | Ransomware3 exploits1 actor |
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.