Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
21 vulnerabilities · highest exploit probability first
- CVE-2025-9528Low 2.0A vulnerability was determined in Linksys E1700 1.0.0.4.003.linksys · e1700 firmwareEPSS54%2 exploitsPublished Aug 27, 2025
- CVE-2023-22249Low 4.8Magento Open Source allows Cross-Site Scripting (XSS)adobe · commerceEPSS58%·Published Jul 6, 2023
- CVE-2022-35919Low 2.7In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested.minio · minioEPSS52%1 exploitPublished Aug 1, 2022
- CVE-2015-2808Low 3.7openjdk-6 - security updateibm · cognos metrics managerEPSS74%·Published Jun 10, 2022
- CVE-2014-3566Low 3.4The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue.openssl · opensslEPSS100%·Published Jul 7, 2021
- CVE-2016-3325Low 3.1Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."microsoft · edgeEPSS54%1 exploitPublished Sep 14, 2016
- CVE-2016-3251Low 2.8The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address…microsoft · windows 10EPSS58%·Published Jul 12, 2016
- CVE-2016-0701Low 3.7The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple…openssl · opensslEPSS84%·Published Feb 15, 2016
- CVE-2015-3183Low 3.7The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid…apache · http serverEPSS73%·Published Jul 20, 2015
- CVE-2015-4000Low 3.7The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by…oracle · jdkEPSS100%·Published May 21, 2015
- CVE-2010-1157Low 2.6Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the…apache · tomcatEPSS53%1 exploitPublished Apr 23, 2010
- CVE-2009-1536Low 2.6ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP…microsoft · .net frameworkEPSS51%·Published Aug 12, 2009
- CVE-2006-5614Low 2.6Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote attackers to cause a denial of service (svchost.exe crash) via a malformed DNS query, which results in a null pointer dereference.microsoft · windows xpEPSS80%1 exploitPublished Oct 30, 2006
- CVE-2006-5229Low 2.6OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as…openbsd · opensshEPSS58%1 exploitPublished Oct 10, 2006
- CVE-2005-1790Low 2.6Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object…microsoft · internet explorerEPSS83%2 exploitsPublished Jun 1, 2005
- CVE-2004-1857Low 2.1Directory traversal vulnerability in setinfo.hts in HP Web Jetadmin 7.5.2546 allows remote authenticated attackers to read arbitrary files via a ..hp · web jetadminEPSS87%2 exploitsPublished Mar 24, 2004
- CVE-2003-0727Low 2.1Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions.oracle · database serverEPSS68%9 exploitsPublished Oct 20, 2003
- CVE-2002-0422Low 2.6IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response,…microsoft · internet information servicesEPSS51%·Published Aug 12, 2002
- CVE-2002-0568Low 2.1Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory.oracle · application serverEPSS75%·Published Jul 3, 2002
- CVE-2000-0649Low 2.6IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined.microsoft · internet information serverEPSS77%1 exploitPublished Jul 13, 2000
- CVE-2000-0402Low 2.1The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability.microsoft · sql serverEPSS91%4 exploitsPublished May 30, 2000
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-9528 | A vulnerability was determined in Linksys E1700 1.0.0.4.003. linksys · e1700 firmware | Low 2.0 | 54% | 2 exploits | |
| CVE-2023-22249 | Magento Open Source allows Cross-Site Scripting (XSS) adobe · commerce | Low 4.8 | 58% | · | |
| CVE-2022-35919 | In affected versions all 'admin' users authorized for admin:ServerUpdate can selectively trigger an error that in response, returns the content of the path requested. minio · minio | Low 2.7 | 52% | 1 exploit | |
| CVE-2015-2808 | openjdk-6 - security update ibm · cognos metrics manager | Low 3.7 | 74% | · | |
| CVE-2014-3566 | The SSL protocol 3.0, as used in OpenSSL through 1.0.1i and other products, uses nondeterministic CBC padding, which makes it easier for man-in-the-middle attackers to obtain cleartext data via a padding-oracle attack, aka the "POODLE" issue. openssl · openssl | Low 3.4 | 100% | · | |
| CVE-2016-3325 | Microsoft Internet Explorer 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability." microsoft · edge | Low 3.1 | 54% | 1 exploit | |
| CVE-2016-3251 | The GDI component in the kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 allows local users to obtain sensitive kernel-address… microsoft · windows 10 | Low 2.8 | 58% | · | |
| CVE-2016-0701 | The DH_check_pub_key function in crypto/dh/dh_check.c in OpenSSL 1.0.2 before 1.0.2f does not ensure that prime numbers are appropriate for Diffie-Hellman (DH) key exchange, which makes it easier for remote attackers to discover a private DH exponent by making multiple… openssl · openssl | Low 3.7 | 84% | · | |
| CVE-2015-3183 | The chunked transfer coding implementation in the Apache HTTP Server before 2.4.14 does not properly parse chunk headers, which allows remote attackers to conduct HTTP request smuggling attacks via a crafted request, related to mishandling of large chunk-size values and invalid… apache · http server | Low 3.7 | 73% | · | |
| CVE-2015-4000 | The TLS protocol 1.2 and earlier, when a DHE_EXPORT ciphersuite is enabled on a server but not on a client, does not properly convey a DHE_EXPORT choice, which allows man-in-the-middle attackers to conduct cipher-downgrade attacks by rewriting a ClientHello with DHE replaced by… oracle · jdk | Low 3.7 | 100% | · | |
| CVE-2010-1157 | Apache Tomcat 5.5.0 through 5.5.29 and 6.0.0 through 6.0.26 might allow remote attackers to discover the server's hostname or IP address by sending a request for a resource that requires (1) BASIC or (2) DIGEST authentication, and then reading the realm field in the… apache · tomcat | Low 2.6 | 53% | 1 exploit | |
| CVE-2009-1536 | ASP.NET in Microsoft .NET Framework 2.0 SP1 and SP2 and 3.5 Gold and SP1, when ASP 2.0 is used in integrated mode on IIS 7.0, does not properly manage request scheduling, which allows remote attackers to cause a denial of service (daemon outage) via a series of crafted HTTP… microsoft · .net framework | Low 2.6 | 51% | · | |
| CVE-2006-5614 | Microsoft Windows NAT Helper Components (ipnathlp.dll) on Windows XP SP2, when Internet Connection Sharing is enabled, allows remote attackers to cause a denial of service (svchost.exe crash) via a malformed DNS query, which results in a null pointer dereference. microsoft · windows xp | Low 2.6 | 80% | 1 exploit | |
| CVE-2006-5229 | OpenSSH portable 4.1 on SUSE Linux, and possibly other platforms and versions, and possibly under limited configurations, allows remote attackers to determine valid usernames via timing discrepancies in which responses take longer for valid usernames than invalid ones, as… openbsd · openssh | Low 2.6 | 58% | 1 exploit | |
| CVE-2005-1790 | Microsoft Internet Explorer 6 SP2 6.0.2900.2180 and 6.0.2800.1106, and earlier versions, allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a Javascript BODY onload event that calls the window function, aka "Mismatched Document Object… microsoft · internet explorer | Low 2.6 | 83% | 2 exploits | |
| CVE-2004-1857 | Directory traversal vulnerability in setinfo.hts in HP Web Jetadmin 7.5.2546 allows remote authenticated attackers to read arbitrary files via a .. hp · web jetadmin | Low 2.1 | 87% | 2 exploits | |
| CVE-2003-0727 | Multiple buffer overflows in the XML Database (XDB) functionality for Oracle 9i Database Release 2 allow local users to cause a denial of service or hijack user sessions. oracle · database server | Low 2.1 | 68% | 9 exploits | |
| CVE-2002-0422 | IIS 5 and 5.1 supporting WebDAV methods allows remote attackers to determine the internal IP address of the system (which may be obscured by NAT) via (1) a PROPFIND HTTP request with a blank Host header, which leaks the address in an HREF property in a 207 Multi-Status response,… microsoft · internet information services | Low 2.6 | 51% | · | |
| CVE-2002-0568 | Oracle 9i Application Server stores XSQL and SOAP configuration files insecurely, which allows local users to obtain sensitive information including usernames and passwords by requesting (1) XSQLConfig.xml or (2) soapConfig.xml through a virtual directory. oracle · application server | Low 2.1 | 75% | · | |
| CVE-2000-0649 | IIS 4.0 allows remote attackers to obtain the internal IP address of the server via an HTTP 1.0 request for a web page which is protected by basic authentication and has no realm defined. microsoft · internet information server | Low 2.6 | 77% | 1 exploit | |
| CVE-2000-0402 | The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack Password" vulnerability. microsoft · sql server | Low 2.1 | 91% | 4 exploits |
Showing 1–21 of 21
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.