Vulnerability Intelligence · Emerging
Emerging Threats, Before They Hit KEV.
Not on KEV yet, but the exploit signals say watch it: a high EPSS forecast or a weaponized exploit.
Synced hourly · figures as of Oct 19, 2026
780 vulnerabilities · highest exploit probability first
- CVE-2025-55183Medium 5.3Source Code Exposure Vulnerability in React Server Componentsfacebook · reactEPSS64%Ransomware1 actorPublished Dec 11, 2025
- CVE-2025-9491Medium 4.6Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability.microsoft · windows 11 23h2EPSS73%·Published Aug 26, 2025
- CVE-2025-57791Medium 6.9A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation.commvault · commvaultEPSS34%1 exploitPublished Aug 20, 2025
- CVE-2025-47188Medium 6.5A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to…EPSS53%·Published Aug 7, 2025
- CVE-2025-40598Medium 6.1A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code.sonicwall · sma 210 firmwareEPSS64%Ransomware1 actorPublished Jul 23, 2025
- CVE-2025-6197Medium 4.2grafana: Open Redirect in GrafanaEPSS74%·Published Jul 22, 2025
- CVE-2025-53771Medium 6.5Microsoft SharePoint Server Spoofing Vulnerabilitymicrosoft · sharepoint serverEPSS100%Ransomware1 exploit8 actorsPublished Jul 8, 2025
- CVE-2025-34508Medium 5.3A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior.EPSS73%·Published Jun 17, 2025
- CVE-2025-5301Medium 6.1ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol.EPSS62%·Published Jun 12, 2025
- CVE-2025-27817Medium 8.6Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerabilityapache · kafkaEPSS69%·Published Jun 10, 2025
- CVE-2025-4123Medium 6.1Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugingrafana · grafanaEPSS97%·Published May 22, 2025
- CVE-2025-4901Medium 5.3A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125).dlink · di-7003g firmwareEPSS79%1 exploitPublished May 18, 2025
- CVE-2025-43566Medium 6.8ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read.adobe · coldfusionEPSS57%·Published May 13, 2025
- CVE-2025-4443Medium 5.3It has been rated as critical.dlink · dir-605l firmwareEPSS63%·Published May 8, 2025
- CVE-2025-31650Medium 8.7Apache Tomcat Denial of Service via invalid HTTP priority headerapache · tomcatEPSS61%1 exploitPublished Apr 28, 2025
- CVE-2025-46618Medium 6.1In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tabjetbrains · teamcityEPSS63%·Published Apr 25, 2025
- CVE-2025-22037Medium 5.5Linux kernel: ksmbd: fix null pointer dereference in alloc_preauth_hash()EPSS70%·Published Apr 16, 2025
- CVE-2025-30676Medium 6.1Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz.apache · ofbizEPSS68%·Published Apr 1, 2025
- CVE-2024-55963Medium 6.5A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart.appsmith · appsmithEPSS31%2 exploitsPublished Mar 26, 2025
- CVE-2025-2748Medium 6.1The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178.kentico · xperienceEPSS61%·Published Mar 24, 2025
- CVE-2025-29891Medium 4.8Apache Camel Message Header Injection through request parametersapache · camelEPSS76%1 exploitPublished Mar 12, 2025
- CVE-2025-27636Medium 6.3Apache Camel: Camel Message Header Injection via Improper Filteringapache · camelEPSS97%·Published Mar 9, 2025
- CVE-2019-8900Medium 6.8A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devices.apple · secureromEPSS69%·Published Feb 21, 2025
- CVE-2025-27218Medium 5.3Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization.EPSS65%2 exploitsPublished Feb 20, 2025
- CVE-2025-1338Medium 6.9It has been declared as critical.EPSS51%·Published Feb 16, 2025
- CVE-2024-11320Medium 6.9Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism.pandorafms · pandora fmsEPSS91%1 exploitPublished Nov 29, 2024
- CVE-2024-49754Medium 5.4LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.phplibrenms · librenmsEPSS72%1 exploitPublished Nov 15, 2024
- CVE-2024-50599Medium 6.1A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints.synacor · zimbra collaboration suiteEPSS64%·Published Nov 7, 2024
- CVE-2024-50340Medium 6.9Symfony allows changing the environment through a queryEPSS64%·Published Nov 6, 2024
- CVE-2024-9916Medium 6.9A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9.usualtool · usualtoolcmsEPSS74%1 exploitPublished Oct 13, 2024
- CVE-2024-47176Medium 5.3cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL.openprinting · cups-browsedEPSS51%2 exploitsPublished Sep 26, 2024
- CVE-2024-8877Medium 6.9Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204.riello-ups · netman 204 firmwareEPSS77%·Published Sep 25, 2024
- CVE-2024-7120Medium 5.3A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90.raisecom · msg1200 firmwareEPSS93%·Published Jul 26, 2024
- CVE-2024-38030Medium 6.5Windows Themes Spoofing Vulnerabilitymicrosoft · windows 10 1507EPSS51%·Published Jul 10, 2024
- CVE-2024-29510Medium 6.3Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device.artifex · ghostscriptEPSS28%1 exploitPublished Jul 4, 2024
- CVE-2024-27136Medium 5.3Cross site scripting in Apache JSPWikiapache · jspwikiEPSS61%·Published Jun 24, 2024
- CVE-2024-4367Medium 5.6PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDFmozilla · firefoxEPSS71%·Published May 15, 2024
- CVE-2024-34716Medium 6.1PrestaShop cross-site scripting via customer contact form in FO, through file uploadprestashop · prestashopEPSS56%·Published May 15, 2024
- CVE-2022-31097Medium 6.3Grafana Stored Cross-site Scripting in Unified Alertinggrafana · grafanaEPSS70%·Published May 14, 2024
- CVE-2024-31456Medium 6.5Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search.glpi-project · glpiEPSS59%·Published May 7, 2024
- CVE-2024-4439Medium 6.1WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Blockwordpress · wordpressEPSS71%·Published May 6, 2024
- CVE-2023-32167Medium 6.5D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability.dlink · d-view 8EPSS77%·Published May 3, 2024
- CVE-2024-3721Medium 6.3The manipulation of the argument mdb/mdc leads to os command injection.EPSS86%·Published Apr 13, 2024
- CVE-2024-2511Medium 5.9Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that…EPSS52%·Published Apr 8, 2024
- CVE-2024-28182Medium 5.3The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync.nghttp2 · nghttp2EPSS85%·Published Apr 4, 2024
- CVE-2024-2758Medium 6.3FW: HTTP/2 CONTINUATION frames can be utilized for DoS attacksEPSS73%·Published Apr 3, 2024
- CVE-2024-31138Medium 5.4In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settingsjetbrains · teamcityEPSS75%·Published Mar 29, 2024
- CVE-2024-27096Medium 6.5An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database.glpi-project · glpiEPSS59%·Published Mar 18, 2024
- CVE-2024-1883Medium 6.1This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server.papercut · papercut ngEPSS61%·Published Mar 14, 2024
- CVE-2024-28156Medium 5.4Jenkins Build Monitor View Plugin vulnerable to stored Cross-site Scriptingjenkins · build monitor viewEPSS79%·Published Mar 7, 2024
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2025-55183 | Source Code Exposure Vulnerability in React Server Components facebook · react | Medium 5.3 | 64% | Ransomware1 actor | |
| CVE-2025-9491 | Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. microsoft · windows 11 23h2 | Medium 4.6 | 73% | · | |
| CVE-2025-57791 | A security vulnerability has been identified that allows remote attackers to inject or manipulate command-line arguments passed to internal components due to insufficient input validation. commvault · commvault | Medium 6.9 | 34% | 1 exploit | |
| CVE-2025-47188 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to… | Medium 6.5 | 53% | · | |
| CVE-2025-40598 | A Reflected cross-site scripting (XSS) vulnerability exists in the SMA100 series web interface, allowing a remote unauthenticated attacker to potentially execute arbitrary JavaScript code. sonicwall · sma 210 firmware | Medium 6.1 | 64% | Ransomware1 actor | |
| CVE-2025-6197 | grafana: Open Redirect in Grafana | Medium 4.2 | 74% | · | |
| CVE-2025-53771 | Microsoft SharePoint Server Spoofing Vulnerability microsoft · sharepoint server | Medium 6.5 | 100% | Ransomware1 exploit8 actors | |
| CVE-2025-34508 | A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. | Medium 5.3 | 73% | · | |
| CVE-2025-5301 | ONLYOFFICE Docs (DocumentServer) in versions equal and below 8.3.1 are affected by a reflected cross-site scripting (XSS) issue when opening files via the WOPI protocol. | Medium 6.1 | 62% | · | |
| CVE-2025-27817 | Apache Kafka Client Arbitrary File Read and Server Side Request Forgery Vulnerability apache · kafka | Medium 8.6 | 69% | · | |
| CVE-2025-4123 | Grafana Cross-Site-Scripting (XSS) via custom loaded frontend plugin grafana · grafana | Medium 6.1 | 97% | · | |
| CVE-2025-4901 | A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R(68125). dlink · di-7003g firmware | Medium 5.3 | 79% | 1 exploit | |
| CVE-2025-43566 | ColdFusion versions 2025.1, 2023.13, 2021.19 and earlier are affected by an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability that could lead to arbitrary file system read. adobe · coldfusion | Medium 6.8 | 57% | · | |
| CVE-2025-4443 | It has been rated as critical. dlink · dir-605l firmware | Medium 5.3 | 63% | · | |
| CVE-2025-31650 | Apache Tomcat Denial of Service via invalid HTTP priority header apache · tomcat | Medium 8.7 | 61% | 1 exploit | |
| CVE-2025-46618 | In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab jetbrains · teamcity | Medium 6.1 | 63% | · | |
| CVE-2025-22037 | Linux kernel: ksmbd: fix null pointer dereference in alloc_preauth_hash() | Medium 5.5 | 70% | · | |
| CVE-2025-30676 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Apache OFBiz. apache · ofbiz | Medium 6.1 | 68% | · | |
| CVE-2024-55963 | A user on Appsmith that doesn't have admin permissions can trigger the restart API on Appsmith, causing a server restart. appsmith · appsmith | Medium 6.5 | 31% | 2 exploits | |
| CVE-2025-2748 | The Kentico Xperience application does not fully validate or filter files uploaded via the multiple-file upload functionality, which allows for stored XSS.This issue affects Kentico Xperience through 13.0.178. kentico · xperience | Medium 6.1 | 61% | · | |
| CVE-2025-29891 | Apache Camel Message Header Injection through request parameters apache · camel | Medium 4.8 | 76% | 1 exploit | |
| CVE-2025-27636 | Apache Camel: Camel Message Header Injection via Improper Filtering apache · camel | Medium 6.3 | 97% | · | |
| CVE-2019-8900 | A vulnerability in the SecureROM of some Apple devices can be exploited by an unauthenticated local attacker to execute arbitrary code upon booting those devices. apple · securerom | Medium 6.8 | 69% | · | |
| CVE-2025-27218 | Sitecore Experience Manager (XM) and Experience Platform (XP) 10.4 before KB1002844 allow remote code execution through insecure deserialization. | Medium 5.3 | 65% | 2 exploits | |
| CVE-2025-1338 | It has been declared as critical. | Medium 6.9 | 51% | · | |
| CVE-2024-11320 | Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. pandorafms · pandora fms | Medium 6.9 | 91% | 1 exploit | |
| CVE-2024-49754 | LibreNMS has a stored XSS ('Cross-site Scripting') in librenms/includes/html/pages/api-access.inc.php librenms · librenms | Medium 5.4 | 72% | 1 exploit | |
| CVE-2024-50599 | A reflected Cross-Site Scripting (XSS) vulnerability has been identified in Zimbra Collaboration Suite (ZCS) 8.8.15, affecting one of the webmail calendar endpoints. synacor · zimbra collaboration suite | Medium 6.1 | 64% | · | |
| CVE-2024-50340 | Symfony allows changing the environment through a query | Medium 6.9 | 64% | · | |
| CVE-2024-9916 | A vulnerability, which was classified as critical, has been found in HuangDou UTCMS V9. usualtool · usualtoolcms | Medium 6.9 | 74% | 1 exploit | |
| CVE-2024-47176 | cups-browsed binds to INADDR_ANY:631, causing it to trust any packet from any source, and can cause the Get-Printer-Attributes IPP request to an attacker controlled URL. openprinting · cups-browsed | Medium 5.3 | 51% | 2 exploits | |
| CVE-2024-8877 | Improper neutralization of special elements results in a SQL Injection vulnerability in Riello Netman 204. riello-ups · netman 204 firmware | Medium 6.9 | 77% | · | |
| CVE-2024-7120 | A vulnerability, which was classified as critical, was found in Raisecom MSG1200, MSG2100E, MSG2200 and MSG2300 3.90. raisecom · msg1200 firmware | Medium 5.3 | 93% | · | |
| CVE-2024-38030 | Windows Themes Spoofing Vulnerability microsoft · windows 10 1507 | Medium 6.5 | 51% | · | |
| CVE-2024-29510 | Artifex Ghostscript before 10.03.1 allows memory corruption, and SAFER sandbox bypass, via format string injection with a uniprint device. artifex · ghostscript | Medium 6.3 | 28% | 1 exploit | |
| CVE-2024-27136 | Cross site scripting in Apache JSPWiki apache · jspwiki | Medium 5.3 | 61% | · | |
| CVE-2024-4367 | PDF.js vulnerable to arbitrary JavaScript execution upon opening a malicious PDF mozilla · firefox | Medium 5.6 | 71% | · | |
| CVE-2024-34716 | PrestaShop cross-site scripting via customer contact form in FO, through file upload prestashop · prestashop | Medium 6.1 | 56% | · | |
| CVE-2022-31097 | Grafana Stored Cross-site Scripting in Unified Alerting grafana · grafana | Medium 6.3 | 70% | · | |
| CVE-2024-31456 | Prior to 10.0.15, an authenticated user can exploit a SQL injection vulnerability from map search. glpi-project · glpi | Medium 6.5 | 59% | · | |
| CVE-2024-4439 | WordPress Core < 6.5.2 - Unauthenticated & Authenticated (Contributor+) Stored Cross-Site Scripting via Avatar Block wordpress · wordpress | Medium 6.1 | 71% | · | |
| CVE-2023-32167 | D-Link D-View uploadMib Directory Traversal Arbitrary File Creation or Deletion Vulnerability. dlink · d-view 8 | Medium 6.5 | 77% | · | |
| CVE-2024-3721 | The manipulation of the argument mdb/mdc leads to os command injection. | Medium 6.3 | 86% | · | |
| CVE-2024-2511 | Issue summary: Some non-default TLS server configurations can cause unbounded memory growth when processing TLSv1.3 sessions Impact summary: An attacker may exploit certain server configurations to trigger unbounded memory growth that… | Medium 5.9 | 52% | · | |
| CVE-2024-28182 | The nghttp2 library prior to version 1.61.0 keeps reading the unbounded number of HTTP/2 CONTINUATION frames even after a stream is reset to keep HPACK context in sync. nghttp2 · nghttp2 | Medium 5.3 | 85% | · | |
| CVE-2024-2758 | FW: HTTP/2 CONTINUATION frames can be utilized for DoS attacks | Medium 6.3 | 73% | · | |
| CVE-2024-31138 | In JetBrains TeamCity before 2024.03 xSS was possible via Agent Distribution settings jetbrains · teamcity | Medium 5.4 | 75% | · | |
| CVE-2024-27096 | An authenticated user can exploit a SQL injection vulnerability in the search engine to extract data from the database. glpi-project · glpi | Medium 6.5 | 59% | · | |
| CVE-2024-1883 | This is a reflected cross site scripting vulnerability in the PaperCut NG/MF application server. papercut · papercut ng | Medium 6.1 | 61% | · | |
| CVE-2024-28156 | Jenkins Build Monitor View Plugin vulnerable to stored Cross-site Scripting jenkins · build monitor view | Medium 5.4 | 79% | · |
Showing 1–50 of 780
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Not on the KEV catalog yet, but either the EPSS forecast is 50% or higher or a weaponized exploit exists. The signals say watch it; the evidence does not yet justify a listing.