Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
1,413 vulnerabilities · highest score first
- CVE-2022-29548Medium 6.1A reflected XSS issue exists in the Management Console of several WSO2 products.wso2 · api managerEPSS41%2 exploitsPublished Apr 20, 2022
- CVE-2022-24108Critical 9.8The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of…skyoftech · so listing tabsEPSS33%1 exploitPublished May 17, 2022
- CVE-2021-44596Critical 9.8Wondershare LTD Dr.wondershare · dr.foneEPSS23%2 exploitsPublished Apr 29, 2022
- CVE-2021-44567Critical 9.8SQL injection in francoisjacquet/rosariosisrosariosis · rosariosisEPSS23%1 exploitPublished Feb 25, 2022
- CVE-2021-43936Critical 9.8The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution.webhmi · webhmi firmwareEPSS36%2 exploitsPublished Dec 6, 2021
- CVE-2021-43164High 8.8A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless.ruijienetworks · reyeeosEPSS35%2 exploitsPublished May 3, 2022
- CVE-2021-42697High 7.5Uncontrolled Recursion in Akka HTTPakka · http serverEPSS36%1 exploitPublished May 24, 2022
- CVE-2021-42669Critical 9.8A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php.engineers online portal project · engineers online portalEPSS23%2 exploitsPublished Nov 5, 2021
- CVE-2020-5844High 7.2index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location.artica · pandora fmsEPSS30%3 exploitsPublished Mar 16, 2020
- CVE-2020-5515High 7.2Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection.gilacms · gila cmsEPSS27%3 exploitsPublished Jan 6, 2020
- CVE-2020-29134High 8.6The TOTVS Fluig platform allows path traversal through the parameter "file = ..totvs · fluigEPSS28%3 exploitsPublished Mar 5, 2021
- CVE-2019-9164High 8.8Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job.nagios · nagios xiEPSS46%1 exploitPublished Mar 28, 2019
- CVE-2019-7669High 8.8Prima Systems FlexAir, Versions 2.3.38 and prior.primasystems · flexairEPSS31%1 exploitPublished Jul 1, 2019
- CVE-2019-7267Critical 9.8Linear eMerge 50P/5000P devices allow Cookie Path Traversal.nortekcontrol · linear emerge 5000p firmwareEPSS21%1 exploitPublished Jul 2, 2019
- CVE-2019-19307Critical 9.8An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet.cesanta · mongooseEPSS42%1 exploitPublished Nov 26, 2019
- CVE-2019-16451Critical 9.8Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a heap overflow vulnerability.adobe · acrobat dcEPSS35%1 exploitPublished Dec 19, 2019
- CVE-2019-15978High 7.2Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system (OS).cisco · data center network managerEPSS37%2 exploitsPublished Jan 6, 2020
- CVE-2019-15977High 7.5Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device.cisco · data center network managerEPSS38%2 exploitsPublished Jan 6, 2020
- CVE-2019-13360Critical 9.8In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username.control-webpanel · webpanelEPSS24%2 exploitsPublished Jul 16, 2019
- CVE-2019-13359High 7.5In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user.control-webpanel · webpanelEPSS26%3 exploitsPublished Jul 16, 2019
- CVE-2019-13344Medium 5.3An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings.crudlab · wp like buttonEPSS45%2 exploitsPublished Jul 5, 2019
- CVE-2019-1150High 8.8A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts.microsoft · windows 10EPSS26%2 exploitsPublished Aug 14, 2019
- CVE-2019-0235High 8.8Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks.apache · ofbizEPSS33%2 exploitsPublished Apr 30, 2020
- CVE-2018-8413High 7.8A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2012,…microsoft · windows 10EPSS46%1 exploitPublished Oct 10, 2018
- CVE-2018-7300Critical 9.8Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem.eq-3 · homematic ccu2 firmwareEPSS31%1 exploitPublished Feb 22, 2018
- CVE-2018-6396Critical 9.8SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla!google map landkarten project · google map landkartenEPSS24%2 exploitsPublished Feb 17, 2018
- CVE-2018-20841Critical 9.8HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacters in the mac parameter of a protocol.csp?function=set&fname=security&opt=mac_table request.hootoo · tripmate titan ht-tm05 firmwareEPSS48%1 exploitPublished Jun 11, 2019
- CVE-2018-19616High 8.1An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element.rockwellautomation · powermonitor 1000 firmwareEPSS30%1 exploitPublished Dec 26, 2018
- CVE-2018-19126Critical 9.8PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload.prestashop · prestashopEPSS23%2 exploitsPublished Nov 9, 2018
- CVE-2018-16752High 8.8LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp.linknet-usa · lw-n605r firmwareEPSS43%2 exploitsPublished Sep 20, 2018
- CVE-2018-13415Critical 9.8In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack.plex · media serverEPSS31%2 exploitsPublished Aug 13, 2018
- CVE-2018-12054High 7.5Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal.schools alert management script project · schools alert management scriptEPSS38%2 exploitsPublished Jun 8, 2018
- CVE-2018-11094Critical 9.8An issue was discovered on Intelbras NCLOUD 300 1.0 devices.intelbras · ncloud 300 firmwareEPSS33%2 exploitsPublished May 15, 2018
- CVE-2017-6019High 7.5A series of rapid requests to the device may cause it to reboot.schneider-electric · conext combox 865-1058 firmwareEPSS37%1 exploitPublished Apr 7, 2017
- CVE-2017-5815Critical 9.8A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found.hp · intelligent management centerEPSS34%1 exploitPublished Feb 15, 2018
- CVE-2017-14537Medium 6.5trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.netfortris · trixboxEPSS39%3 exploitsPublished Feb 16, 2018
- CVE-2016-6255High 7.5Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler.libupnp project · libupnpEPSS27%1 exploitPublished Mar 7, 2017
- CVE-2016-4108High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS38%1 exploitPublished May 10, 2016
- CVE-2016-1106High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS37%1 exploitPublished May 10, 2016
- CVE-2016-1105High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS38%1 exploitPublished May 10, 2016
- CVE-2016-1104High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS40%1 exploitPublished May 10, 2016
- CVE-2016-1103High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS38%1 exploitPublished May 10, 2016
- CVE-2016-1102High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS40%1 exploitPublished May 10, 2016
- CVE-2016-1101High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS38%1 exploitPublished May 10, 2016
- CVE-2016-1096High 7.5flash-plugin: multiple code execution issues fixed in APSB16-15adobe · flash playerEPSS40%1 exploitPublished May 10, 2016
- CVE-2016-0801Critical 9.8The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal…google · androidEPSS33%1 exploitPublished Feb 7, 2016
- CVE-2015-8644High 8.8flash-plugin: multiple code execution issues fixed in APSB16-01adobe · airEPSS26%1 exploitPublished Dec 28, 2015
- CVE-2015-8635High 8.8flash-plugin: multiple code execution issues fixed in APSB16-01adobe · airEPSS25%1 exploitPublished Dec 28, 2015
- CVE-2015-8634High 8.8flash-plugin: multiple code execution issues fixed in APSB16-01adobe · airEPSS25%1 exploitPublished Dec 28, 2015
- CVE-2015-7855Medium 6.5The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value.ntp · ntpEPSS31%2 exploitsPublished Aug 7, 2017
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2022-29548 | A reflected XSS issue exists in the Management Console of several WSO2 products. wso2 · api manager | Medium 6.1 | 41% | 2 exploits | |
| CVE-2022-24108 | The Skyoftech So Listing Tabs module 2.2.0 for OpenCart allows a remote attacker to inject a serialized PHP object via the setting parameter, potentially resulting in the ability to write to files on the server, cause DoS, and achieve remote code execution because of… skyoftech · so listing tabs | Critical 9.8 | 33% | 1 exploit | |
| CVE-2021-44596 | Wondershare LTD Dr. wondershare · dr.fone | Critical 9.8 | 23% | 2 exploits | |
| CVE-2021-44567 | SQL injection in francoisjacquet/rosariosis rosariosis · rosariosis | Critical 9.8 | 23% | 1 exploit | |
| CVE-2021-43936 | The software allows the attacker to upload or transfer files of dangerous types to the WebHMI portal, that may be automatically processed within the product's environment or lead to arbitrary code execution. webhmi · webhmi firmware | Critical 9.8 | 36% | 2 exploits | |
| CVE-2021-43164 | A Remote Code Execution (RCE) vulnerability exists in Ruijie Networks Ruijie RG-EW Series Routers up to ReyeeOS 1.55.1915 / EW_3.0(1)B11P55 via the updateVersion function in /cgi-bin/luci/api/wireless. ruijienetworks · reyeeos | High 8.8 | 35% | 2 exploits | |
| CVE-2021-42697 | Uncontrolled Recursion in Akka HTTP akka · http server | High 7.5 | 36% | 1 exploit | |
| CVE-2021-42669 | A file upload vulnerability exists in Sourcecodester Engineers Online Portal in PHP via dashboard_teacher.php, which allows changing the avatar through teacher_avatar.php. engineers online portal project · engineers online portal | Critical 9.8 | 23% | 2 exploits | |
| CVE-2020-5844 | index.php?sec=godmode/extensions&sec2=extensions/files_repo in Pandora FMS v7.0 NG allows authenticated administrators to upload malicious PHP scripts, and execute them via base64 decoding of the file location. artica · pandora fms | High 7.2 | 30% | 3 exploits | |
| CVE-2020-5515 | Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection. gilacms · gila cms | High 7.2 | 27% | 3 exploits | |
| CVE-2020-29134 | The TOTVS Fluig platform allows path traversal through the parameter "file = .. totvs · fluig | High 8.6 | 28% | 3 exploits | |
| CVE-2019-9164 | Command injection in Nagios XI before 5.5.11 allows an authenticated users to execute arbitrary remote commands via a new autodiscovery job. nagios · nagios xi | High 8.8 | 46% | 1 exploit | |
| CVE-2019-7669 | Prima Systems FlexAir, Versions 2.3.38 and prior. primasystems · flexair | High 8.8 | 31% | 1 exploit | |
| CVE-2019-7267 | Linear eMerge 50P/5000P devices allow Cookie Path Traversal. nortekcontrol · linear emerge 5000p firmware | Critical 9.8 | 21% | 1 exploit | |
| CVE-2019-19307 | An integer overflow in parse_mqtt in mongoose.c in Cesanta Mongoose 6.16 allows an attacker to achieve remote DoS (infinite loop), or possibly cause an out-of-bounds write, by sending a crafted MQTT protocol packet. cesanta · mongoose | Critical 9.8 | 42% | 1 exploit | |
| CVE-2019-16451 | Adobe Acrobat and Reader versions , 2019.021.20056 and earlier, 2017.011.30152 and earlier, 2017.011.30155 and earlier version, 2017.011.30152 and earlier, and 2015.006.30505 and earlier have a heap overflow vulnerability. adobe · acrobat dc | Critical 9.8 | 35% | 1 exploit | |
| CVE-2019-15978 | Multiple vulnerabilities in the REST and SOAP API endpoints of Cisco Data Center Network Manager (DCNM) could allow an authenticated, remote attacker with administrative privileges on the DCNM application to inject arbitrary commands on the underlying operating system (OS). cisco · data center network manager | High 7.2 | 37% | 2 exploits | |
| CVE-2019-15977 | Multiple vulnerabilities in the authentication mechanisms of Cisco Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to bypass authentication and execute arbitrary actions with administrative privileges on an affected device. cisco · data center network manager | High 7.5 | 38% | 2 exploits | |
| CVE-2019-13360 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers can bypass authentication in the login process by leveraging knowledge of a valid username. control-webpanel · webpanel | Critical 9.8 | 24% | 2 exploits | |
| CVE-2019-13359 | In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, a cwpsrv-xxx cookie allows a normal user to craft and upload a session file to the /tmp directory, and use it to become the root user. control-webpanel · webpanel | High 7.5 | 26% | 3 exploits | |
| CVE-2019-13344 | An authentication bypass vulnerability in the CRUDLab WP Like Button plugin through 1.6.0 for WordPress allows unauthenticated attackers to change settings. crudlab · wp like button | Medium 5.3 | 45% | 2 exploits | |
| CVE-2019-1150 | A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. microsoft · windows 10 | High 8.8 | 26% | 2 exploits | |
| CVE-2019-0235 | Apache OFBiz 17.12.01 is vulnerable to some CSRF attacks. apache · ofbiz | High 8.8 | 33% | 2 exploits | |
| CVE-2018-8413 | A remote code execution vulnerability exists when "Windows Theme API" does not properly decompress files, aka "Windows Theme API Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2019, Windows Server 2012,… microsoft · windows 10 | High 7.8 | 46% | 1 exploit | |
| CVE-2018-7300 | Directory Traversal / Arbitrary File Write / Remote Code Execution in the User.setLanguage method in eQ-3 AG Homematic CCU2 2.29.2 and earlier allows remote attackers to write arbitrary files to the device's filesystem. eq-3 · homematic ccu2 firmware | Critical 9.8 | 31% | 1 exploit | |
| CVE-2018-6396 | SQL Injection exists in the Google Map Landkarten through 4.2.3 component for Joomla! google map landkarten project · google map landkarten | Critical 9.8 | 24% | 2 exploits | |
| CVE-2018-20841 | HooToo TripMate Titan HT-TM05 and HT-05 routers with firmware 2.000.022 and 2.000.082 allow remote command execution via shell metacharacters in the mac parameter of a protocol.csp?function=set&fname=security&opt=mac_table request. hootoo · tripmate titan ht-tm05 firmware | Critical 9.8 | 48% | 1 exploit | |
| CVE-2018-19616 | An unauthenticated user can add/edit/remove administrators because access control is implemented on the client side via a disabled attribute for a BUTTON element. rockwellautomation · powermonitor 1000 firmware | High 8.1 | 30% | 1 exploit | |
| CVE-2018-19126 | PrestaShop 1.6.x before 1.6.1.23 and 1.7.x before 1.7.4.4 allows remote attackers to execute arbitrary code via a file upload. prestashop · prestashop | Critical 9.8 | 23% | 2 exploits | |
| CVE-2018-16752 | LINK-NET LW-N605R devices with firmware 12.20.2.1486 allow Remote Code Execution via shell metacharacters in the HOST field of the ping feature at adm/systools.asp. linknet-usa · lw-n605r firmware | High 8.8 | 43% | 2 exploits | |
| CVE-2018-13415 | In Plex Media Server 1.13.2.5154, the XML parsing engine for SSDP/UPnP functionality is vulnerable to an XML External Entity Processing (XXE) attack. plex · media server | Critical 9.8 | 31% | 2 exploits | |
| CVE-2018-12054 | Arbitrary File Read exists in PHP Scripts Mall Schools Alert Management Script via the f parameter in img.php, aka absolute path traversal. schools alert management script project · schools alert management script | High 7.5 | 38% | 2 exploits | |
| CVE-2018-11094 | An issue was discovered on Intelbras NCLOUD 300 1.0 devices. intelbras · ncloud 300 firmware | Critical 9.8 | 33% | 2 exploits | |
| CVE-2017-6019 | A series of rapid requests to the device may cause it to reboot. schneider-electric · conext combox 865-1058 firmware | High 7.5 | 37% | 1 exploit | |
| CVE-2017-5815 | A Remote Code Execution vulnerability in HPE Intelligent Management Center (iMC) PLAT version 7.3 E0504P04 was found. hp · intelligent management center | Critical 9.8 | 34% | 1 exploit | |
| CVE-2017-14537 | trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php. netfortris · trixbox | Medium 6.5 | 39% | 3 exploits | |
| CVE-2016-6255 | Portable UPnP SDK (aka libupnp) before 1.6.21 allows remote attackers to write to arbitrary files in the webroot via a POST request without a registered handler. libupnp project · libupnp | High 7.5 | 27% | 1 exploit | |
| CVE-2016-4108 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 38% | 1 exploit | |
| CVE-2016-1106 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 37% | 1 exploit | |
| CVE-2016-1105 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 38% | 1 exploit | |
| CVE-2016-1104 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 40% | 1 exploit | |
| CVE-2016-1103 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 38% | 1 exploit | |
| CVE-2016-1102 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 40% | 1 exploit | |
| CVE-2016-1101 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 38% | 1 exploit | |
| CVE-2016-1096 | flash-plugin: multiple code execution issues fixed in APSB16-15 adobe · flash player | High 7.5 | 40% | 1 exploit | |
| CVE-2016-0801 | The Broadcom Wi-Fi driver in the kernel in Android 4.x before 4.4.4, 5.x before 5.1.1 LMY49G, and 6.x before 2016-02-01 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted wireless control message packets, aka internal… google · android | Critical 9.8 | 33% | 1 exploit | |
| CVE-2015-8644 | flash-plugin: multiple code execution issues fixed in APSB16-01 adobe · air | High 8.8 | 26% | 1 exploit | |
| CVE-2015-8635 | flash-plugin: multiple code execution issues fixed in APSB16-01 adobe · air | High 8.8 | 25% | 1 exploit | |
| CVE-2015-8634 | flash-plugin: multiple code execution issues fixed in APSB16-01 adobe · air | High 8.8 | 25% | 1 exploit | |
| CVE-2015-7855 | The decodenetnum function in ntpd in NTP 4.2.x before 4.2.8p4, and 4.3.x before 4.3.77 allows remote attackers to cause a denial of service (assertion failure) via a 6 or mode 7 packet containing a long data value. ntp · ntp | Medium 6.5 | 31% | 2 exploits |
Showing 601–650 of 1,413
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.