Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
1,473 vulnerabilities · highest exploit probability first
- CVE-2026-46300High 7.8kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernelEPSS2.4%2 exploitsPublished May 13, 2026
- CVE-2026-43284High 7.8kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernelEPSS94%14 exploitsPublished May 12, 2026
- CVE-2026-34413High 8.8Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to…EPSS3.1%1 exploitPublished Apr 22, 2026
- CVE-2026-2041High 8.8Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerabilitynagios · nagios xiEPSS76%·Published Feb 20, 2026
- CVE-2026-2043High 8.8Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerabilitynagios · nagios xiEPSS75%·Published Feb 20, 2026
- CVE-2025-15467High 8.8openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsingopenssl · opensslEPSS52%1 exploitPublished Jan 27, 2026
- CVE-2026-22200High 8.7osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Readenhancesoft · osticketEPSS74%·Published Jan 12, 2026
- CVE-2025-55184High 7.5Denial of Service Vulnerability in React Server Componentsfacebook · reactEPSS67%Ransomware1 actorPublished Dec 11, 2025
- CVE-2025-55752High 7.7Apache Tomcat Vulnerable to Relative Path Traversalapache · tomcatEPSS64%·Published Oct 27, 2025
- CVE-2025-62168High 7.5In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure.squid-cache · squidEPSS63%·Published Oct 17, 2025
- CVE-2025-61678High 8.6In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter.EPSS44%1 exploitPublished Oct 14, 2025
- CVE-2025-61675High 8.6In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration…EPSS38%1 exploitPublished Oct 14, 2025
- CVE-2025-57790High 8.7A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue.commvault · commvaultEPSS27%1 exploitPublished Aug 20, 2025
- CVE-2025-53778High 8.8Windows NTLM Elevation of Privilege Vulnerabilitymicrosoft · windows 10 1507EPSS51%·Published Aug 12, 2025
- CVE-2025-54254High 8.6Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read.adobe · experience manager formsEPSS77%·Published Aug 5, 2025
- CVE-2013-10059High 8.6An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint.dlink · dir-615h firmwareEPSS27%3 exploitsPublished Aug 1, 2025
- CVE-2025-40596High 7.3A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution.sonicwall · sma 210 firmwareEPSS57%Ransomware1 actorPublished Jul 23, 2025
- CVE-2025-6023High 7.6Grafana is vulnerable to XSS attacks through open redirects and path traversalEPSS53%·Published Jul 18, 2025
- CVE-2025-6965High 7.2There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available.sqlite · sqliteEPSS73%1 exploitPublished Jul 15, 2025
- CVE-2013-3307High 8.3Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000.EPSS63%1 exploitPublished Jul 11, 2025
- CVE-2025-6970High 7.5The Events Manager – Calendar, Bookings, Tickets, and more!pixelite · events managerEPSS56%·Published Jul 9, 2025
- CVE-2025-5961High 7.2The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116.wpvivid · migration\, backup\, stagingEPSS55%1 exploitPublished Jul 3, 2025
- CVE-2025-5306High 7.0Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection.artica · pandora fmsEPSS36%1 exploitPublished Jun 27, 2025
- CVE-2025-34511High 8.8Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue.sitecore · experience managerEPSS30%1 exploitPublished Jun 17, 2025
- CVE-2025-34510High 8.8Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability.sitecore · experience commerceEPSS24%1 exploitPublished Jun 17, 2025
- CVE-2025-34509High 7.5Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev.sitecore · experience managerEPSS56%2 exploitsPublished Jun 17, 2025
- CVE-2025-49619High 8.5Skyvern has a Jinja runtime leakEPSS20%1 exploitPublished Jun 7, 2025
- CVE-2025-48828High 8.1Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine.vbulletin · vbulletinEPSS58%1 exploitPublished May 27, 2025
- CVE-2024-48766High 8.6NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025.netalertx · netalertxEPSS68%·Published May 13, 2025
- CVE-2025-29971High 7.5Web Threat Defense (WTD.sys) Denial of Service Vulnerabilitymicrosoft · windows 11 22h2EPSS67%·Published May 13, 2025
- CVE-2025-2563High 8.1The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privilegeswpeverest · user registration \& membershipEPSS49%1 exploitPublished Apr 14, 2025
- CVE-2025-3102High 8.1SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User CreationEPSS76%1 exploitPublished Apr 9, 2025
- CVE-2025-2945High 8.8pgAdmin 4 Vulnerable to Remote Code Executionpgadmin · pgadmin 4EPSS56%1 exploitPublished Apr 3, 2025
- CVE-2025-30208High 7.5Vite bypasses server.fs.deny when using ?raw??vitejs · viteEPSS75%3 exploitsPublished Mar 25, 2025
- CVE-2025-1098High 8.8ingress-nginx controller - configuration injection via unsanitized mirror annotationsEPSS82%1 exploitPublished Mar 25, 2025
- CVE-2024-12971High 8.6Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6artica · pandora fmsEPSS61%1 exploitPublished Mar 17, 2025
- CVE-2025-26319High 9.3FlowiseAI Flowise arbitrary file upload vulnerabilityflowiseai · flowiseEPSS56%·Published Mar 5, 2025
- CVE-2025-1094High 8.1Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns.EPSS90%1 exploitPublished Feb 13, 2025
- CVE-2025-24367High 8.7An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server.cacti · cactiEPSS54%2 exploitsPublished Jan 27, 2025
- CVE-2024-13162High 7.2SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.ivanti · endpoint managerEPSS64%·Published Jan 14, 2025
- CVE-2025-21285High 7.5Microsoft Message Queuing (MSMQ) Denial of Service Vulnerabilitymicrosoft · windows 10 1507EPSS56%·Published Jan 13, 2025
- CVE-2025-0107High 7.7An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API…paloaltonetworks · expeditionEPSS78%·Published Jan 11, 2025
- CVE-2024-12856High 7.2The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability.four-faith · f3x24 firmwareEPSS84%·Published Dec 27, 2024
- CVE-2024-55947High 8.7Path Traversal in file update API in gogsgogs · gogsEPSS78%·Published Dec 23, 2024
- CVE-2024-38819High 7.5Spring Framework Path Traversal vulnerabilityEPSS56%·Published Dec 19, 2024
- CVE-2024-49113High 7.5Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerabilitymicrosoft · windows 10 1507EPSS84%·Published Dec 10, 2024
- CVE-2024-54003High 8.6Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerabilityjenkins · simple queueEPSS80%·Published Nov 27, 2024
- CVE-2024-53675High 7.5An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases.hpe · insight remote supportEPSS84%·Published Nov 26, 2024
- CVE-2024-10400High 7.5The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query.themeum · tutor lmsEPSS83%·Published Nov 21, 2024
- CVE-2024-48990High 7.8Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable.needrestart project · needrestartEPSS21%1 exploitPublished Nov 19, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-46300 | kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel | High 7.8 | 2.4% | 2 exploits | |
| CVE-2026-43284 | kernel: "Dirty Frag" ESP XFRM variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel | High 7.8 | 94% | 14 exploits | |
| CVE-2026-34413 | Xerte Online Toolkits versions 3.15 and earlier contain a missing authentication vulnerability in the elFinder connector endpoint at /editor/elfinder/php/connector.php where an HTTP redirect to unauthenticated callers does not call exit() or die(), allowing PHP execution to… | High 8.8 | 3.1% | 1 exploit | |
| CVE-2026-2041 | Nagios Host zabbixagent_configwizard_func Command Injection Remote Code Execution Vulnerability nagios · nagios xi | High 8.8 | 76% | · | |
| CVE-2026-2043 | Nagios Host esensors_websensor_configwizard_func Command Injection Remote Code Execution Vulnerability nagios · nagios xi | High 8.8 | 75% | · | |
| CVE-2025-15467 | openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing openssl · openssl | High 8.8 | 52% | 1 exploit | |
| CVE-2026-22200 | osTicket (1.18.x < 1.18.3, 1.17.x < 1.17.7) PDF Export Arbitrary File Read enhancesoft · osticket | High 8.7 | 74% | · | |
| CVE-2025-55184 | Denial of Service Vulnerability in React Server Components facebook · react | High 7.5 | 67% | Ransomware1 actor | |
| CVE-2025-55752 | Apache Tomcat Vulnerable to Relative Path Traversal apache · tomcat | High 7.7 | 64% | · | |
| CVE-2025-62168 | In Squid versions prior to 7.2, a failure to redact HTTP authentication credentials in error handling allows information disclosure. squid-cache · squid | High 7.5 | 63% | · | |
| CVE-2025-61678 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains an authenticated arbitrary file upload vulnerability affecting the fwbrand parameter. | High 8.6 | 44% | 1 exploit | |
| CVE-2025-61675 | In versions prior to 16.0.92 for FreePBX 16 and versions prior to 17.0.6 for FreePBX 17, the Endpoint Manager module contains authenticated SQL injection vulnerabilities affecting multiple parameters in the basestation, model, firmware, and custom extension configuration… | High 8.6 | 38% | 1 exploit | |
| CVE-2025-57790 | A security vulnerability has been identified that allows remote attackers to perform unauthorized file system access through a path traversal issue. commvault · commvault | High 8.7 | 27% | 1 exploit | |
| CVE-2025-53778 | Windows NTLM Elevation of Privilege Vulnerability microsoft · windows 10 1507 | High 8.8 | 51% | · | |
| CVE-2025-54254 | Adobe Experience Manager versions 6.5.23 and earlier are affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability that could lead to arbitrary file system read. adobe · experience manager forms | High 8.6 | 77% | · | |
| CVE-2013-10059 | An authenticated OS command injection vulnerability exists in various D-Link routers (tested on DIR-615H1 running firmware version 8.04) via the tools_vct.htm endpoint. dlink · dir-615h firmware | High 8.6 | 27% | 3 exploits | |
| CVE-2025-40596 | A Stack-based buffer overflow vulnerability in the SMA100 series web interface allows remote, unauthenticated attacker to cause Denial of Service (DoS) or potentially results in code execution. sonicwall · sma 210 firmware | High 7.3 | 57% | Ransomware1 actor | |
| CVE-2025-6023 | Grafana is vulnerable to XSS attacks through open redirects and path traversal | High 7.6 | 53% | · | |
| CVE-2025-6965 | There exists a vulnerability in SQLite versions before 3.50.2 where the number of aggregate terms could exceed the number of columns available. sqlite · sqlite | High 7.2 | 73% | 1 exploit | |
| CVE-2013-3307 | Linksys E1000 devices through 2.1.02, E1200 devices before 2.0.05, and E3200 devices through 1.0.04 allow OS command injection via shell metacharacters in the apply.cgi ping_ip parameter on TCP port 52000. | High 8.3 | 63% | 1 exploit | |
| CVE-2025-6970 | The Events Manager – Calendar, Bookings, Tickets, and more! pixelite · events manager | High 7.5 | 56% | · | |
| CVE-2025-5961 | The Migration, Backup, Staging – WPvivid Backup & Migration plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'wpvivid_upload_import_files' function in all versions up to, and including, 0.9.116. wpvivid · migration\, backup\, staging | High 7.2 | 55% | 1 exploit | |
| CVE-2025-5306 | Improper Neutralization of Special Elements in the Netflow directory field may allow OS command injection. artica · pandora fms | High 7.0 | 36% | 1 exploit | |
| CVE-2025-34511 | Sitecore PowerShell Extensions, an add-on to Sitecore Experience Manager (XM) and Experience Platform (XP), through version 7.0 is vulnerable to an unrestricted file upload issue. sitecore · experience manager | High 8.8 | 30% | 1 exploit | |
| CVE-2025-34510 | Sitecore Experience Manager (XM), Experience Platform (XP), and Experience Commerce (XC) versions 9.0 through 9.3 and 10.0 through 10.4 are affected by a Zip Slip vulnerability. sitecore · experience commerce | High 8.8 | 24% | 1 exploit | |
| CVE-2025-34509 | Sitecore Experience Manager (XM) and Experience Platform (XP) versions 10.1 to 10.1.4 rev. sitecore · experience manager | High 7.5 | 56% | 2 exploits | |
| CVE-2025-49619 | Skyvern has a Jinja runtime leak | High 8.5 | 20% | 1 exploit | |
| CVE-2025-48828 | Certain vBulletin versions might allow attackers to execute arbitrary PHP code by abusing Template Conditionals in the template engine. vbulletin · vbulletin | High 8.1 | 58% | 1 exploit | |
| CVE-2024-48766 | NetAlertX 24.7.18 before 24.10.12 allows unauthenticated file reading because an HTTP client can ignore a redirect, and because of factors related to strpos and directory traversal, as exploited in the wild in May 2025. netalertx · netalertx | High 8.6 | 68% | · | |
| CVE-2025-29971 | Web Threat Defense (WTD.sys) Denial of Service Vulnerability microsoft · windows 11 22h2 | High 7.5 | 67% | · | |
| CVE-2025-2563 | The User Registration & Membership WordPress plugin before 4.1.2 does not prevent users to set their account role when the Membership Addon is enabled, leading to a privilege escalation issue and allowing unauthenticated users to gain admin privileges wpeverest · user registration \& membership | High 8.1 | 49% | 1 exploit | |
| CVE-2025-3102 | SureTriggers <= 1.0.78 - Authorization Bypass due to Missing Empty Value Check to Unauthenticated Administrative User Creation | High 8.1 | 76% | 1 exploit | |
| CVE-2025-2945 | pgAdmin 4 Vulnerable to Remote Code Execution pgadmin · pgadmin 4 | High 8.8 | 56% | 1 exploit | |
| CVE-2025-30208 | Vite bypasses server.fs.deny when using ?raw?? vitejs · vite | High 7.5 | 75% | 3 exploits | |
| CVE-2025-1098 | ingress-nginx controller - configuration injection via unsanitized mirror annotations | High 8.8 | 82% | 1 exploit | |
| CVE-2024-12971 | Improper Neutralization of Special Elements used in a Command vulnerability allows OS Command Injection.This issue affects Pandora FMS from 700 to 777.6 artica · pandora fms | High 8.6 | 61% | 1 exploit | |
| CVE-2025-26319 | FlowiseAI Flowise arbitrary file upload vulnerability flowiseai · flowise | High 9.3 | 56% | · | |
| CVE-2025-1094 | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage patterns. | High 8.1 | 90% | 1 exploit | |
| CVE-2025-24367 | An authenticated Cacti user can abuse graph creation and graph template functionality to create arbitrary PHP scripts in the web root of the application, leading to remote code execution on the server. cacti · cacti | High 8.7 | 54% | 2 exploits | |
| CVE-2024-13162 | SQL injection in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution. ivanti · endpoint manager | High 7.2 | 64% | · | |
| CVE-2025-21285 | Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability microsoft · windows 10 1507 | High 7.5 | 56% | · | |
| CVE-2025-0107 | An OS command injection vulnerability in Palo Alto Networks Expedition enables an unauthenticated attacker to run arbitrary OS commands as the www-data user in Expedition, which results in the disclosure of usernames, cleartext passwords, device configurations, and device API… paloaltonetworks · expedition | High 7.7 | 78% | · | |
| CVE-2024-12856 | The Four-Faith router models F3x24 and F3x36 are affected by an operating system (OS) command injection vulnerability. four-faith · f3x24 firmware | High 7.2 | 84% | · | |
| CVE-2024-55947 | Path Traversal in file update API in gogs gogs · gogs | High 8.7 | 78% | · | |
| CVE-2024-38819 | Spring Framework Path Traversal vulnerability | High 7.5 | 56% | · | |
| CVE-2024-49113 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability microsoft · windows 10 1507 | High 7.5 | 84% | · | |
| CVE-2024-54003 | Jenkins Simple Queue Plugin has stored cross-site scripting (XSS) vulnerability jenkins · simple queue | High 8.6 | 80% | · | |
| CVE-2024-53675 | An XML external entity injection (XXE) vulnerability in HPE Insight Remote Support may allow remote users to disclose information in certain cases. hpe · insight remote support | High 7.5 | 84% | · | |
| CVE-2024-10400 | The Tutor LMS plugin for WordPress is vulnerable to SQL Injection via the ‘rating_filter’ parameter in all versions up to, and including, 2.7.6 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. themeum · tutor lms | High 7.5 | 83% | · | |
| CVE-2024-48990 | Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Python interpreter with an attacker-controlled PYTHONPATH environment variable. needrestart project · needrestart | High 7.8 | 21% | 1 exploit |
Showing 1–50 of 1,473
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.