Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,642 vulnerabilities · highest exploit probability first
- CVE-2026-19478Critical 9.1GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user…gitlab · gitlabEPSS60%·Published Aug 17, 2026
- CVE-2026-66066Critical 9.5Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processingEPSS28%1 exploitPublished Jul 30, 2026
- CVE-2026-10523Critical 9.8An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative…ivanti · standalone sentryEPSS53%·Published Jun 9, 2026
- CVE-2026-0826Critical 9.2In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform.hp inc. · poly trio 8300EPSS32%1 exploitPublished Jun 1, 2026
- CVE-2024-44000Critical 9.8LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Fileslitespeedtech · litespeed cacheEPSS82%2 exploitsPublished May 13, 2026
- CVE-2024-28000Critical 9.8LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalationlitespeedtech · litespeed cacheEPSS68%1 exploitPublished May 13, 2026
- CVE-2026-34415Critical 9.3Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern.EPSS4.4%1 exploitPublished Apr 22, 2026
- CVE-2026-0740Critical 9.8Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File UploadEPSS63%1 exploitPublished Apr 7, 2026
- CVE-2026-4257Critical 9.8Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill FunctionalityEPSS33%2 exploitsPublished Mar 30, 2026
- CVE-2026-3891Critical 9.8Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File UploadEPSS30%2 exploitsPublished Mar 13, 2026
- CVE-2026-2329Critical 9.3Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflowgrandstream · gxp1610 firmwareEPSS42%2 exploitsPublished Feb 18, 2026
- CVE-2025-40553Critical 9.8SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine.solarwinds · web help deskEPSS68%·Published Feb 9, 2026
- CVE-2025-40554Critical 9.8SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk.solarwinds · web help deskEPSS61%·Published Feb 9, 2026
- CVE-2025-40552Critical 9.8SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication.solarwinds · web help deskEPSS52%·Published Feb 9, 2026
- CVE-2026-0769Critical 9.8Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerabilitylangflow · langflowEPSS42%1 exploitPublished Jan 23, 2026
- CVE-2026-0768Critical 9.8Langflow code Code Injection Remote Code Execution Vulnerabilitylangflow · langflowEPSS23%1 exploitPublished Jan 23, 2026
- CVE-2026-23744Critical 9.8REC in MCPJam inspector due to HTTP Endpoint exposesmcpjam · inspectorEPSS68%2 exploitsPublished Jan 16, 2026
- CVE-2025-12420Critical 9.3A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform.servicenow · now assist ai agentsEPSS53%·Published Jan 12, 2026
- CVE-2026-21858Critical 10.0n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handlingn8n · n8nEPSS78%·Published Jan 7, 2026
- CVE-2025-13486Critical 9.8Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_formEPSS68%1 exploitPublished Dec 5, 2025
- CVE-2025-66516Critical 10.0Apache Tika has XXE vulnerabilityapache · tikaEPSS89%·Published Dec 4, 2025
- CVE-2025-6389Critical 9.8Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callbackEPSS76%·Published Nov 25, 2025
- CVE-2025-34299Critical 9.3Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads.monstaftp · monsta ftpEPSS73%1 exploitPublished Nov 7, 2025
- CVE-2025-11749Critical 9.8AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege EscalationEPSS75%1 exploitPublished Nov 5, 2025
- CVE-2025-11833Critical 9.8Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log DisclosureEPSS61%·Published Nov 3, 2025
- CVE-2025-55315Critical 9.9Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerabilitymicrosoft · asp.net coreEPSS66%1 exploitPublished Oct 15, 2025
- CVE-2025-49844Critical 9.9Redis: Redis Lua Use-After-Free may lead to remote code executionredis · redisEPSS82%·Published Oct 6, 2025
- CVE-2025-59528Critical 10.0Flowise has Remote Code Execution vulnerabilityflowiseai · flowiseEPSS86%2 exploitsPublished Sep 15, 2025
- CVE-2025-7441Critical 9.8StoryChief <= 1.0.42 - Unauthenticated Arbitrary File UploadEPSS50%2 exploitsPublished Aug 18, 2025
- CVE-2025-8943Critical 9.8Flowise OS command remote code executionflowiseai · flowiseEPSS75%1 exploitPublished Aug 14, 2025
- CVE-2025-25256Critical 9.8An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and…fortinet · fortisiemEPSS65%Ransomware1 actorPublished Aug 12, 2025
- CVE-2024-32640Critical 9.8Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the processAsyncObject method that can result in remote code execution.EPSS77%·Published Aug 11, 2025
- CVE-2025-34152Critical 9.4An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint.EPSS87%1 exploitPublished Aug 7, 2025
- CVE-2025-36604Critical 9.8Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability.dell · unity operating environmentEPSS66%·Published Aug 4, 2025
- CVE-2025-54782Critical 9.4@nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developersnestjs · devtools-integrationEPSS52%·Published Aug 1, 2025
- CVE-2019-25224Critical 9.8WP Database Backup < 5.2 - Unauthenticated OS Command Injectionwpseeds · wp database backupEPSS22%1 exploitPublished Jul 25, 2025
- CVE-2025-32429Critical 9.3XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameterxwiki · xwikiEPSS88%1 exploitPublished Jul 24, 2025
- CVE-2025-5394Critical 9.8Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin InstallationEPSS51%·Published Jul 17, 2025
- CVE-2025-34117Critical 9.3A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413.EPSS21%1 exploitPublished Jul 16, 2025
- CVE-2025-34300Critical 10.0A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application.EPSS81%1 exploitPublished Jul 16, 2025
- CVE-2020-36847Critical 9.8The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension.simplefilelist · simple file listEPSS44%3 exploitsPublished Jul 12, 2025
- CVE-2025-6514Critical 9.6mcp-remote exposed to OS command injection via untrusted MCP server connectionsEPSS77%·Published Jul 9, 2025
- CVE-2025-49533Critical 9.8Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker.adobe · experience managerEPSS52%·Published Jul 8, 2025
- CVE-2025-34037Critical 10.0An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080.EPSS93%1 exploitPublished Jun 23, 2025
- CVE-2025-34030Critical 10.0An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php.EPSS52%·Published Jun 20, 2025
- CVE-2025-49132Critical 10.0Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code ExecutionEPSS54%2 exploitsPublished Jun 19, 2025
- CVE-2025-41646Critical 9.8An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion.kunbus · revpi statusEPSS51%·Published Jun 6, 2025
- CVE-2025-44148Critical 9.8Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx componentmailenable · mailenableEPSS55%1 exploitPublished Jun 3, 2025
- CVE-2025-4009Critical 9.3This device exposes a web management interface on port 80.EPSS71%·Published May 28, 2025
- CVE-2025-48827Critical 9.8vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025.vbulletin · vbulletinEPSS76%1 exploitPublished May 27, 2025
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19478 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user… gitlab · gitlab | Critical 9.1 | 60% | · | |
| CVE-2026-66066 | Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing | Critical 9.5 | 28% | 1 exploit | |
| CVE-2026-10523 | An Authentication Bypass vulnerability (CWE-288) in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated attacker to create arbitrary administrative accounts and obtain full administrative… ivanti · standalone sentry | Critical 9.8 | 53% | · | |
| CVE-2026-0826 | In certain scenarios when the admin has enabled Interactive Connectivity Establishment (ICE), a buffer overflow could enable remote code execution on Poly Voice products on the Linux platform. hp inc. · poly trio 8300 | Critical 9.2 | 32% | 1 exploit | |
| CVE-2024-44000 | LiteSpeed Cache <= 6.4.1 - Unauthenticated Sensitive Information Exposure via Log Files litespeedtech · litespeed cache | Critical 9.8 | 82% | 2 exploits | |
| CVE-2024-28000 | LiteSpeed Cache <= 6.3.0.1 - Unauthenticated Privilege Escalation litespeedtech · litespeed cache | Critical 9.8 | 68% | 1 exploit | |
| CVE-2026-34415 | Xerte Online Toolkits versions 3.15 and earlier contain an incomplete input validation vulnerability in the elFinder connector endpoint that fails to block PHP-executable extensions .php4 due to an incorrect regex pattern. | Critical 9.3 | 4.4% | 1 exploit | |
| CVE-2026-0740 | Ninja Forms - File Upload <= 3.3.26 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 63% | 1 exploit | |
| CVE-2026-4257 | Contact Form by Supsystic <= 1.7.36 - Unauthenticated Server-Side Template Injection via Prefill Functionality | Critical 9.8 | 33% | 2 exploits | |
| CVE-2026-3891 | Pix for WooCommerce <= 1.5.0 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 30% | 2 exploits | |
| CVE-2026-2329 | Grandstream GXP1600 VoIP Phones - Unauthenticated stack buffer overflow grandstream · gxp1610 firmware | Critical 9.3 | 42% | 2 exploits | |
| CVE-2025-40553 | SolarWinds Web Help Desk was found to be susceptible to an untrusted data deserialization vulnerability that could lead to remote code execution, which would allow an attacker to run commands on the host machine. solarwinds · web help desk | Critical 9.8 | 68% | · | |
| CVE-2025-40554 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that, if exploited, could allow an attacker to invoke specific actions within Web Help Desk. solarwinds · web help desk | Critical 9.8 | 61% | · | |
| CVE-2025-40552 | SolarWinds Web Help Desk was found to be susceptible to an authentication bypass vulnerability that if exploited, would allow a malicious actor to execute actions and methods that should be protected by authentication. solarwinds · web help desk | Critical 9.8 | 52% | · | |
| CVE-2026-0769 | Langflow eval_custom_component_code Eval Injection Remote Code Execution Vulnerability langflow · langflow | Critical 9.8 | 42% | 1 exploit | |
| CVE-2026-0768 | Langflow code Code Injection Remote Code Execution Vulnerability langflow · langflow | Critical 9.8 | 23% | 1 exploit | |
| CVE-2026-23744 | REC in MCPJam inspector due to HTTP Endpoint exposes mcpjam · inspector | Critical 9.8 | 68% | 2 exploits | |
| CVE-2025-12420 | A vulnerability has been identified in the ServiceNow AI Platform that could enable an unauthenticated user to impersonate another user and perform the operations that the impersonated user is entitled to perform. servicenow · now assist ai agents | Critical 9.3 | 53% | · | |
| CVE-2026-21858 | n8n Vulnerable to Unauthenticated File Access via Improper Webhook Request Handling n8n · n8n | Critical 10.0 | 78% | · | |
| CVE-2025-13486 | Advanced Custom Fields: Extended 0.9.0.5 - 0.9.1.1 - Unauthenticated Remote Code Execution in prepare_form | Critical 9.8 | 68% | 1 exploit | |
| CVE-2025-66516 | Apache Tika has XXE vulnerability apache · tika | Critical 10.0 | 89% | · | |
| CVE-2025-6389 | Sneeit Framework <= 8.3 - Unauthenticated Remote Code Execution in sneeit_articles_pagination_callback | Critical 9.8 | 76% | · | |
| CVE-2025-34299 | Monsta FTP versions 2.11 and earlier contain a vulnerability that allows unauthenticated arbitrary file uploads. monstaftp · monsta ftp | Critical 9.3 | 73% | 1 exploit | |
| CVE-2025-11749 | AI Engine <= 3.1.3 - Unauthenticated Sensitive Information Exposure to Privilege Escalation | Critical 9.8 | 75% | 1 exploit | |
| CVE-2025-11833 | Post SMTP – Complete SMTP Solution with Logs, Alerts, Backup SMTP & Mobile App <= 3.6.0 - Missing Authorization to Account Takeover via Unauthenticated Email Log Disclosure | Critical 9.8 | 61% | · | |
| CVE-2025-55315 | Microsoft Security Advisory CVE-2025-55315: .NET Security Feature Bypass Vulnerability microsoft · asp.net core | Critical 9.9 | 66% | 1 exploit | |
| CVE-2025-49844 | Redis: Redis Lua Use-After-Free may lead to remote code execution redis · redis | Critical 9.9 | 82% | · | |
| CVE-2025-59528 | Flowise has Remote Code Execution vulnerability flowiseai · flowise | Critical 10.0 | 86% | 2 exploits | |
| CVE-2025-7441 | StoryChief <= 1.0.42 - Unauthenticated Arbitrary File Upload | Critical 9.8 | 50% | 2 exploits | |
| CVE-2025-8943 | Flowise OS command remote code execution flowiseai · flowise | Critical 9.8 | 75% | 1 exploit | |
| CVE-2025-25256 | An improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiSIEM version 7.3.0 through 7.3.1, 7.2.0 through 7.2.5, 7.1.0 through 7.1.7, 7.0.0 through 7.0.3 and… fortinet · fortisiem | Critical 9.8 | 65% | Ransomware1 actor | |
| CVE-2024-32640 | Versions prior to 7.4.5, 7.3.12, and 7.2.7 contain a SQL injection vulnerability in the processAsyncObject method that can result in remote code execution. | Critical 9.8 | 77% | · | |
| CVE-2025-34152 | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. | Critical 9.4 | 87% | 1 exploit | |
| CVE-2025-36604 | Dell Unity, version(s) 5.5 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. dell · unity operating environment | Critical 9.8 | 66% | · | |
| CVE-2025-54782 | @nestjs/devtools-integration: CSRF to Sandbox Escape Allows for RCE against JS Developers nestjs · devtools-integration | Critical 9.4 | 52% | · | |
| CVE-2019-25224 | WP Database Backup < 5.2 - Unauthenticated OS Command Injection wpseeds · wp database backup | Critical 9.8 | 22% | 1 exploit | |
| CVE-2025-32429 | XWiki Platform vulnerable to SQL injection through getdeleteddocuments.vm template sort parameter xwiki · xwiki | Critical 9.3 | 88% | 1 exploit | |
| CVE-2025-5394 | Alone – Charity Multipurpose Non-profit WordPress Theme <= 7.8.3 - Missing Authorization to Unauthenticated Arbitrary File Upload via Plugin Installation | Critical 9.8 | 51% | · | |
| CVE-2025-34117 | A remote code execution vulnerability exists in multiple Netcore and Netis routers models with firmware released prior to August 2014 due to the presence of an undocumented backdoor listener on UDP port 53413. | Critical 9.3 | 21% | 1 exploit | |
| CVE-2025-34300 | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. | Critical 10.0 | 81% | 1 exploit | |
| CVE-2020-36847 | The Simple-File-List Plugin for WordPress is vulnerable to Remote Code Execution in versions up to, and including, 4.2.2 via the rename function which can be used to rename uploaded PHP code with a png extension to use a php extension. simplefilelist · simple file list | Critical 9.8 | 44% | 3 exploits | |
| CVE-2025-6514 | mcp-remote exposed to OS command injection via untrusted MCP server connections | Critical 9.6 | 77% | · | |
| CVE-2025-49533 | Adobe Experience Manager (MS) versions 6.5.23.0 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could lead to arbitrary code execution by an attacker. adobe · experience manager | Critical 9.8 | 52% | · | |
| CVE-2025-34037 | An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. | Critical 10.0 | 93% | 1 exploit | |
| CVE-2025-34030 | An OS command injection vulnerability exists in sar2html version 3.2.2 and prior via the plot parameter in index.php. | Critical 10.0 | 52% | · | |
| CVE-2025-49132 | Pterodactyl Panel Allows Unauthenticated Arbitrary Remote Code Execution | Critical 10.0 | 54% | 2 exploits | |
| CVE-2025-41646 | An unauthorized remote attacker can bypass the authentication of the affected software package by misusing an incorrect type conversion. kunbus · revpi status | Critical 9.8 | 51% | · | |
| CVE-2025-44148 | Cross Site Scripting (XSS) vulnerability in MailEnable before v10 allows a remote attacker to execute arbitrary code via the failure.aspx component mailenable · mailenable | Critical 9.8 | 55% | 1 exploit | |
| CVE-2025-4009 | This device exposes a web management interface on port 80. | Critical 9.3 | 71% | · | |
| CVE-2025-48827 | vBulletin 5.0.0 through 5.7.5 and 6.0.0 through 6.0.3 allows unauthenticated users to invoke protected API controllers' methods when running on PHP 8.1 or later, as demonstrated by the /api.php?method=protectedMethod pattern, as exploited in the wild in May 2025. vbulletin · vbulletin | Critical 9.8 | 76% | 1 exploit |
Showing 1–50 of 1,642
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.