Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
1,458 vulnerabilities · highest score first
- CVE-2006-0006Critical 9.3Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap…microsoft · windows media playerEPSS50%2 exploitsPublished Feb 14, 2006
- CVE-2005-1255Critical 10.0Multiple stack-based buffer overflows in the IMAP server in IMail 8.12 and 8.13 in Ipswitch Collaboration Suite (ICS), and other versions before IMail Server 8.2 Hotfix 2, allow remote attackers to execute arbitrary code via a LOGIN command with (1) a long username argument or…ipswitch · imailEPSS43%3 exploitsPublished May 25, 2005
- CVE-2004-0200Critical 9.3Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length…microsoft · digital image proEPSS49%6 exploitsPublished Sep 28, 2004
- CVE-2003-0161Critical 10.0The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control…sendmail · sendmailEPSS39%2 exploitsPublished Apr 2, 2003
- CVE-2026-23111High 7.8kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity checkEPSS0.5%7 exploitsPublished Feb 13, 2026
- CVE-2026-18963Critical 9.1The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.build keycloak · 26.4EPSS3.2%10 exploitsPublished Aug 18, 2026
- CVE-2026-110447Critical 9.2Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208.EPSS1.2%2 exploitsPublished Oct 14, 2026
- CVE-2025-58434Critical 9.8Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeoverflowiseai · flowiseEPSS50%1 exploitPublished Sep 15, 2025
- CVE-2025-32711High 7.5Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.microsoft · 365 copilotEPSS8.0%5 exploitsPublished Jun 12, 2025
- CVE-2022-47878Critical 9.1Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as Webroot directory.jedox · jedoxEPSS36%2 exploitsPublished May 3, 2023
- CVE-2022-31188Critical 9.8Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability.cvat · computer vision annotation toolEPSS48%2 exploitsPublished Aug 1, 2022
- CVE-2022-22909High 8.8HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.digitaldruid · hoteldruidEPSS45%2 exploitsPublished Mar 3, 2022
- CVE-2022-20759High 8.8A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15.cisco · firepower threat defenseEPSS28%1 exploitPublished May 3, 2022
- CVE-2022-0848Critical 9.8OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11.part-db project · part-dbEPSS35%2 exploitsPublished Mar 7, 2022
- CVE-2021-31761Critical 9.6Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature.webmin · webminEPSS34%2 exploitsPublished Apr 26, 2021
- CVE-2020-13756Critical 9.8Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors()sabberworm · php css parserEPSS50%1 exploitPublished Mar 26, 2022
- CVE-2019-9810High 8.8Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow.mozilla · firefoxEPSS30%3 exploitsPublished Apr 26, 2019
- CVE-2019-17570Critical 9.8Insecure Deserialization in Apache XML-RPCapache · xml-rpcEPSS49%1 exploitPublished Jun 10, 2020
- CVE-2018-9126Critical 9.8The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI.zldnn · dnnarticleEPSS49%3 exploitsPublished Apr 4, 2018
- CVE-2018-13862Critical 9.8Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attackers to reset the authentication via the "/xml/system/setAttribute.xml" URL, using the GET request "?id=0&attr=protectAccess&newValue=0" (a successful attack will…trivum · webtouch setup v9 firmwareEPSS49%2 exploitsPublished Jul 17, 2018
- CVE-2018-12617High 7.5qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk.qemu · qemuEPSS25%3 exploitsPublished Jun 21, 2018
- CVE-2018-11510Critical 9.8The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter.asustor · admEPSS44%7 exploitsPublished Jun 28, 2018
- CVE-2017-11282Critical 9.8flash-plugin: multiple code execution issues fixed in APSB17-28adobe · flash playerEPSS34%2 exploitsPublished Sep 12, 2017
- CVE-2017-11281Critical 9.8flash-plugin: multiple code execution issues fixed in APSB17-28adobe · flash playerEPSS34%2 exploitsPublished Sep 12, 2017
- CVE-2016-3987Critical 9.8The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB.trendmicro · password managerEPSS22%3 exploitsPublished Apr 11, 2016
- CVE-2015-6018Critical 9.8The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter.zyxel · pmg5318-b20a firmwareEPSS21%1 exploitPublished Dec 31, 2015
- CVE-2015-3093Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-09adobe · airEPSS48%1 exploitPublished May 12, 2015
- CVE-2015-3089Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-09adobe · airEPSS48%1 exploitPublished May 12, 2015
- CVE-2013-2568Critical 9.8A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote malicious user execute arbitrary code.zavio · f3105 firmwareEPSS49%1 exploitPublished Jan 29, 2020
- CVE-2011-4106Critical 9.8TimThumb <= 1.33 - Remote File Downloadbinarymoon · timthumbEPSS23%4 exploitsPublished Jul 31, 2011
- CVE-2001-0010Critical 10.0Buffer overflow in transaction signature (TSIG) handling code in BIND 8 allows remote attackers to gain root privileges.isc · bindEPSS32%4 exploitsPublished Jan 29, 2001
- CVE-2026-89079Critical 9.8Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data FilterEPSS0.3%1 exploitPublished Oct 16, 2026
- CVE-2026-74580High 8.8Linux kernel: vhost: reset the vring metadata cache on vring reconfigurationlinux · linux kernelEPSS0.1%3 exploitsPublished Aug 21, 2026
- CVE-2019-7269Critical 9.8Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution.nortekcontrol · linear emerge 5000p firmwareEPSS40%2 exploitsPublished Jul 2, 2019
- CVE-2019-11354High 7.8The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler.ea · originEPSS23%3 exploitsPublished Apr 19, 2019
- CVE-2019-10945Critical 9.8before 3.9.5.joomla · joomla\!EPSS40%3 exploitsPublished Apr 10, 2019
- CVE-2018-17057Critical 9.8TCPDF vulnerable to attackers triggering deserialization of arbitrary datatecnick · tcpdfEPSS26%2 exploitsPublished Oct 6, 2022
- CVE-2017-16943Critical 9.8The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.exim · eximEPSS47%1 exploitPublished May 5, 2021
- CVE-2016-4338High 8.1The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via…zabbix · zabbixEPSS21%3 exploitsPublished Jan 23, 2017
- CVE-2016-4138Critical 9.8flash-plugin: multiple code execution issues fixed in APSB16-18adobe · flash playerEPSS25%2 exploitsPublished Jun 14, 2016
- CVE-2016-2233High 7.5Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number of options in a CAP LS message.hexchat project · hexchatEPSS34%3 exploitsPublished Jan 18, 2017
- CVE-2016-2148Critical 9.8Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing.busybox · busyboxEPSS27%2 exploitsPublished Feb 9, 2017
- CVE-2015-8434Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS43%1 exploitPublished Dec 8, 2015
- CVE-2015-8431Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS43%1 exploitPublished Dec 8, 2015
- CVE-2015-8430Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS43%1 exploitPublished Dec 8, 2015
- CVE-2015-8429Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS43%1 exploitPublished Dec 8, 2015
- CVE-2015-8428Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS43%1 exploitPublished Dec 8, 2015
- CVE-2015-8427Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS43%1 exploitPublished Dec 8, 2015
- CVE-2015-8426Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS43%1 exploitPublished Dec 8, 2015
- CVE-2015-8425Critical 10.0flash-plugin: multiple code execution issues fixed in APSB15-32adobe · airEPSS43%1 exploitPublished Dec 8, 2015
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2006-0006 | Heap-based buffer overflow in the bitmap processing routine in Microsoft Windows Media Player 7.1 on Windows 2000 SP4, Media Player 9 on Windows 2000 SP4 and XP SP1, and Media Player 10 on XP SP1 and SP2 allows remote attackers to execute arbitrary code via a crafted bitmap… microsoft · windows media player | Critical 9.3 | 50% | 2 exploits | |
| CVE-2005-1255 | Multiple stack-based buffer overflows in the IMAP server in IMail 8.12 and 8.13 in Ipswitch Collaboration Suite (ICS), and other versions before IMail Server 8.2 Hotfix 2, allow remote attackers to execute arbitrary code via a LOGIN command with (1) a long username argument or… ipswitch · imail | Critical 10.0 | 43% | 3 exploits | |
| CVE-2004-0200 | Buffer overflow in the JPEG (JPG) parsing engine in the Microsoft Graphic Device Interface Plus (GDI+) component, GDIPlus.dll, allows remote attackers to execute arbitrary code via a JPEG image with a small JPEG COM field length that is normalized to a large integer length… microsoft · digital image pro | Critical 9.3 | 49% | 6 exploits | |
| CVE-2003-0161 | The prescan() function in the address parser (parseaddr.c) in Sendmail before 8.12.9 does not properly handle certain conversions from char and int types, which can cause a length check to be disabled when Sendmail misinterprets an input value as a special "NOCHAR" control… sendmail · sendmail | Critical 10.0 | 39% | 2 exploits | |
| CVE-2026-23111 | kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check | High 7.8 | 0.5% | 7 exploits | |
| CVE-2026-18963 | The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. build keycloak · 26.4 | Critical 9.1 | 3.2% | 10 exploits | |
| CVE-2026-110447 | Collabora Online Built-in CODE Server before 26.4.303 (richdocumentscode), a Nextcloud app, allows remote code execution, as exploited in the wild in September and October 2026, a different vulnerability than CVE-2025-66208. | Critical 9.2 | 1.2% | 2 exploits | |
| CVE-2025-58434 | Flowise Cloud and Local Deployments have Unauthenticated Password Reset Token Disclosure that Leads to Account Takeover flowiseai · flowise | Critical 9.8 | 50% | 1 exploit | |
| CVE-2025-32711 | Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. microsoft · 365 copilot | High 7.5 | 8.0% | 5 exploits | |
| CVE-2022-47878 | Incorrect input validation for the default-storage-path in the settings page in Jedox 2020.2.5 allows remote, authenticated users to specify the location as Webroot directory. jedox · jedox | Critical 9.1 | 36% | 2 exploits | |
| CVE-2022-31188 | Versions prior to 2.0.0 were found to be subject to a Server-side request forgery (SSRF) vulnerability. cvat · computer vision annotation tool | Critical 9.8 | 48% | 2 exploits | |
| CVE-2022-22909 | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module. digitaldruid · hoteldruid | High 8.8 | 45% | 2 exploits | |
| CVE-2022-20759 | A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. cisco · firepower threat defense | High 8.8 | 28% | 1 exploit | |
| CVE-2022-0848 | OS Command Injection in GitHub repository part-db/part-db prior to 0.5.11. part-db project · part-db | Critical 9.8 | 35% | 2 exploits | |
| CVE-2021-31761 | Webmin 1.973 is affected by reflected Cross Site Scripting (XSS) to achieve Remote Command Execution through Webmin's running process feature. webmin · webmin | Critical 9.6 | 34% | 2 exploits | |
| CVE-2020-13756 | Sabberworm PHP CSS Parser Code injection vulnerability in allSelectors() sabberworm · php css parser | Critical 9.8 | 50% | 1 exploit | |
| CVE-2019-9810 | Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. mozilla · firefox | High 8.8 | 30% | 3 exploits | |
| CVE-2019-17570 | Insecure Deserialization in Apache XML-RPC apache · xml-rpc | Critical 9.8 | 49% | 1 exploit | |
| CVE-2018-9126 | The DNNArticle module 11 for DNN (formerly DotNetNuke) allows remote attackers to read the web.config file, and consequently discover database credentials, via the /GetCSS.ashx/?CP=%2fweb.config URI. zldnn · dnnarticle | Critical 9.8 | 49% | 3 exploits | |
| CVE-2018-13862 | Touchpad / Trivum WebTouch Setup V9 V2.53 build 13163 of Apr 6 2018 09:10:14 (FW 303) allow unauthorized remote attackers to reset the authentication via the "/xml/system/setAttribute.xml" URL, using the GET request "?id=0&attr=protectAccess&newValue=0" (a successful attack will… trivum · webtouch setup v9 firmware | Critical 9.8 | 49% | 2 exploits | |
| CVE-2018-12617 | qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. qemu · qemu | High 7.5 | 25% | 3 exploits | |
| CVE-2018-11510 | The ASUSTOR ADM 3.1.0.RFQ3 NAS portal suffers from an unauthenticated remote code execution vulnerability in the portal/apis/aggrecate_js.cgi file by embedding OS commands in the 'script' parameter. asustor · adm | Critical 9.8 | 44% | 7 exploits | |
| CVE-2017-11282 | flash-plugin: multiple code execution issues fixed in APSB17-28 adobe · flash player | Critical 9.8 | 34% | 2 exploits | |
| CVE-2017-11281 | flash-plugin: multiple code execution issues fixed in APSB17-28 adobe · flash player | Critical 9.8 | 34% | 2 exploits | |
| CVE-2016-3987 | The HTTP server in Trend Micro Password Manager allows remote web servers to execute arbitrary commands via the url parameter to (1) api/openUrlInDefaultBrowser or (2) api/showSB. trendmicro · password manager | Critical 9.8 | 22% | 3 exploits | |
| CVE-2015-6018 | The diagnostic-ping implementation on ZyXEL PMG5318-B20A devices with firmware before 1.00(AANC.2)C0 allows remote attackers to execute arbitrary commands via the PingIPAddr parameter. zyxel · pmg5318-b20a firmware | Critical 9.8 | 21% | 1 exploit | |
| CVE-2015-3093 | flash-plugin: multiple code execution issues fixed in APSB15-09 adobe · air | Critical 10.0 | 48% | 1 exploit | |
| CVE-2015-3089 | flash-plugin: multiple code execution issues fixed in APSB15-09 adobe · air | Critical 10.0 | 48% | 1 exploit | |
| CVE-2013-2568 | A Command Injection vulnerability exists in Zavio IP Cameras through 1.6.3 via the ap parameter to /cgi-bin/mft/wireless_mft.cgi, which could let a remote malicious user execute arbitrary code. zavio · f3105 firmware | Critical 9.8 | 49% | 1 exploit | |
| CVE-2011-4106 | TimThumb <= 1.33 - Remote File Download binarymoon · timthumb | Critical 9.8 | 23% | 4 exploits | |
| CVE-2001-0010 | Buffer overflow in transaction signature (TSIG) handling code in BIND 8 allows remote attackers to gain root privileges. isc · bind | Critical 10.0 | 32% | 4 exploits | |
| CVE-2026-89079 | Theme My Login <= 7.2.1 - Unauthenticated Privilege Escalation via 'user_pass1' POST Parameter in wp_pre_insert_user_data Filter | Critical 9.8 | 0.3% | 1 exploit | |
| CVE-2026-74580 | Linux kernel: vhost: reset the vring metadata cache on vring reconfiguration linux · linux kernel | High 8.8 | 0.1% | 3 exploits | |
| CVE-2019-7269 | Linear eMerge 50P/5000P devices allow Authenticated Command Injection with root Code Execution. nortekcontrol · linear emerge 5000p firmware | Critical 9.8 | 40% | 2 exploits | |
| CVE-2019-11354 | The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. ea · origin | High 7.8 | 23% | 3 exploits | |
| CVE-2019-10945 | before 3.9.5. joomla · joomla\! | Critical 9.8 | 40% | 3 exploits | |
| CVE-2018-17057 | TCPDF vulnerable to attackers triggering deserialization of arbitrary data tecnick · tcpdf | Critical 9.8 | 26% | 2 exploits | |
| CVE-2017-16943 | The receive_msg function in receive.c in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands. exim · exim | Critical 9.8 | 47% | 1 exploit | |
| CVE-2016-4338 | The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via… zabbix · zabbix | High 8.1 | 21% | 3 exploits | |
| CVE-2016-4138 | flash-plugin: multiple code execution issues fixed in APSB16-18 adobe · flash player | Critical 9.8 | 25% | 2 exploits | |
| CVE-2016-2233 | Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number of options in a CAP LS message. hexchat project · hexchat | High 7.5 | 34% | 3 exploits | |
| CVE-2016-2148 | Heap-based buffer overflow in the DHCP client (udhcpc) in BusyBox before 1.25.0 allows remote attackers to have unspecified impact via vectors involving OPTION_6RD parsing. busybox · busybox | Critical 9.8 | 27% | 2 exploits | |
| CVE-2015-8434 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 43% | 1 exploit | |
| CVE-2015-8431 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 43% | 1 exploit | |
| CVE-2015-8430 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 43% | 1 exploit | |
| CVE-2015-8429 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 43% | 1 exploit | |
| CVE-2015-8428 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 43% | 1 exploit | |
| CVE-2015-8427 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 43% | 1 exploit | |
| CVE-2015-8426 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 43% | 1 exploit | |
| CVE-2015-8425 | flash-plugin: multiple code execution issues fixed in APSB15-32 adobe · air | Critical 10.0 | 43% | 1 exploit |
Showing 51–100 of 1,458
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.