Vulnerability Intelligence · Watchlist
The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
Synced hourly · figures as of Oct 19, 2026
521 vulnerabilities · highest score first
- CVE-2016-4971High 8.8GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource.gnu · wgetEPSS46%4 exploitsPublished Jun 30, 2016
- CVE-2026-96889High 7.8Librsvg: use-after-free when xml includes have duplicated entitiesenterprise linux · 10EPSS0.2%3 exploitsPublished Sep 23, 2026
- CVE-2026-43499High 8.5kernel: rtmutex: Use waiter::task instead of current in remove_waiter()EPSS0.8%10 exploitsPublished May 21, 2026
- CVE-2022-30075High 8.8In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation.tp-link · archer ax50 firmwareEPSS35%3 exploitsPublished Jun 9, 2022
- CVE-2017-2930High 8.8flash-plugin: multiple code execution issues fixed in APSB17-02adobe · flash playerEPSS25%4 exploitsPublished Jan 10, 2017
- CVE-2016-0998High 8.8flash-plugin: multiple code execution issues fixed in APSB16-08adobe · airEPSS28%4 exploitsPublished Mar 10, 2016
- CVE-2026-64560High 7.8Linux kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() raceEPSS0.7%10 exploitsPublished Jul 29, 2026
- CVE-2026-107181High 8.6Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Schemetelegram · telegram desktopEPSS0.3%4 exploitsPublished Oct 7, 2026
- CVE-2021-3297High 7.8On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access.zyxel · nbg2105 firmwareEPSS21%1 exploitPublished Jan 26, 2021
- CVE-2021-1384High 7.2A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the underlying operating system as the root user.cisco · ios xeEPSS35%1 exploitPublished Mar 24, 2021
- CVE-2018-16299High 7.5The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter.localize my post project · localize my postEPSS44%3 exploitsPublished Sep 24, 2018
- CVE-2012-1803High 8.5RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing…siemens · ruggedcom rugged operating systemEPSS49%2 exploitsPublished Apr 27, 2012
- CVE-2026-23111High 7.8kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity checkEPSS0.5%7 exploitsPublished Feb 13, 2026
- CVE-2025-32711High 7.5Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network.microsoft · 365 copilotEPSS8.0%5 exploitsPublished Jun 12, 2025
- CVE-2022-22909High 8.8HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module.digitaldruid · hoteldruidEPSS45%2 exploitsPublished Mar 3, 2022
- CVE-2022-20759High 8.8A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15.cisco · firepower threat defenseEPSS28%1 exploitPublished May 3, 2022
- CVE-2019-9810High 8.8Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow.mozilla · firefoxEPSS30%3 exploitsPublished Apr 26, 2019
- CVE-2018-12617High 7.5qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk.qemu · qemuEPSS25%3 exploitsPublished Jun 21, 2018
- CVE-2026-74580High 8.8Linux kernel: vhost: reset the vring metadata cache on vring reconfigurationlinux · linux kernelEPSS0.1%3 exploitsPublished Aug 21, 2026
- CVE-2019-11354High 7.8The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler.ea · originEPSS23%3 exploitsPublished Apr 19, 2019
- CVE-2016-4338High 8.1The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via…zabbix · zabbixEPSS21%3 exploitsPublished Jan 23, 2017
- CVE-2016-2233High 7.5Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number of options in a CAP LS message.hexchat project · hexchatEPSS34%3 exploitsPublished Jan 18, 2017
- CVE-2014-9566High 7.5Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager…solarwinds · orion ip address managerEPSS48%3 exploitsPublished Mar 10, 2015
- CVE-2003-0003High 7.5Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information.microsoft · windows 2000EPSS43%2 exploitsPublished Feb 7, 2003
- CVE-2023-5146High 8.8UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical.dlink · dar-7000 firmwareEPSS32%2 exploitsPublished Sep 25, 2023
- CVE-2021-27928High 7.2mariadb-10.1 - security updategaleracluster · wsrepEPSS38%2 exploitsPublished Aug 9, 2021
- CVE-2020-35749High 7.7Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php.presstigers · simple board jobEPSS30%4 exploitsPublished Jan 15, 2021
- CVE-2019-6116High 7.8In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution.artifex · ghostscriptEPSS42%2 exploitsPublished Mar 21, 2019
- CVE-2018-1133High 8.8Moodle calculated question type allows remote code execution by Question authorsmoodle · moodleEPSS31%2 exploitsPublished May 13, 2022
- CVE-2017-2992High 8.8flash-plugin: multiple code execution issues fixed in APSB17-04adobe · flash playerEPSS33%2 exploitsPublished Feb 14, 2017
- CVE-2017-2986High 8.8flash-plugin: multiple code execution issues fixed in APSB17-04adobe · flash playerEPSS31%2 exploitsPublished Feb 14, 2017
- CVE-2016-4232High 7.5flash-plugin: multiple code execution issues fixed in APSB16-25adobe · flash playerEPSS36%2 exploitsPublished Jul 12, 2016
- CVE-2016-4231High 8.8flash-plugin: multiple code execution issues fixed in APSB16-25adobe · flash playerEPSS33%2 exploitsPublished Jul 12, 2016
- CVE-2016-4227High 8.8flash-plugin: multiple code execution issues fixed in APSB16-25adobe · flash playerEPSS33%2 exploitsPublished Jul 12, 2016
- CVE-2016-1960High 8.8Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as…mozilla · firefoxEPSS31%2 exploitsPublished Mar 13, 2016
- CVE-2016-0974High 8.8flash-plugin: multiple code execution issues fixed in APSB16-04adobe · air sdkEPSS31%2 exploitsPublished Feb 9, 2016
- CVE-2016-0971High 8.8flash-plugin: multiple code execution issues fixed in APSB16-04adobe · air sdkEPSS33%2 exploitsPublished Feb 9, 2016
- CVE-2014-9013High 8.8The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user.wpmarketplace project · wpmarketplaceEPSS47%2 exploitsPublished Nov 6, 2019
- CVE-2002-0082High 7.5The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client…apache-ssl · apache-sslEPSS30%3 exploitsPublished Feb 27, 2002
- CVE-2026-23918High 8.8Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol.apache · http serverEPSS50%1 exploitPublished May 4, 2026
- CVE-2025-49002High 8.2Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited.dataease · dataeaseEPSS50%2 exploitsPublished Jun 3, 2025
- CVE-2023-5148High 8.8UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231.dlink · dar-7000 firmwareEPSS31%2 exploitsPublished Sep 25, 2023
- CVE-2021-40875High 7.5Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure.gurock · testrailEPSS47%2 exploitsPublished Sep 22, 2021
- CVE-2021-24146High 7.5Modern Events Calendar Lite <= 5.16.4 - Unauthenticated Events Exportwebnus · modern events calendar liteEPSS31%2 exploitsPublished Jul 5, 2021
- CVE-2020-28948High 7.8Deserialization of Untrusted Data in Archive_Tardrupal · drupalEPSS47%1 exploitPublished Apr 22, 2021
- CVE-2018-8544High 8.8A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server…microsoft · windows 10EPSS48%2 exploitsPublished Nov 13, 2018
- CVE-2018-19571High 7.7GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks.gitlab · gitlabEPSS32%2 exploitsPublished Jul 10, 2019
- CVE-2018-19246High 7.5LFI in PHP-Proxy 5.1.0php-proxy · php-proxyEPSS22%3 exploitsPublished May 14, 2022
- CVE-2018-14716High 7.5SEOmatic plugin for Craft CMS SSTI Vulnerabilitynystudio107 · seomaticEPSS33%2 exploitsPublished May 13, 2022
- CVE-2018-1306High 7.5Exposure of Sensitive Information in Apache Plutoapache · plutoEPSS43%2 exploitsPublished May 14, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2016-4971 | GNU wget before 1.18 allows remote servers to write to arbitrary files by redirecting a request from HTTP to a crafted FTP resource. gnu · wget | High 8.8 | 46% | 4 exploits | |
| CVE-2026-96889 | Librsvg: use-after-free when xml includes have duplicated entities enterprise linux · 10 | High 7.8 | 0.2% | 3 exploits | |
| CVE-2026-43499 | kernel: rtmutex: Use waiter::task instead of current in remove_waiter() | High 8.5 | 0.8% | 10 exploits | |
| CVE-2022-30075 | In TP-Link Router AX50 firmware 210730 and older, import of a malicious backup file via web interface can lead to remote code execution due to improper validation. tp-link · archer ax50 firmware | High 8.8 | 35% | 3 exploits | |
| CVE-2017-2930 | flash-plugin: multiple code execution issues fixed in APSB17-02 adobe · flash player | High 8.8 | 25% | 4 exploits | |
| CVE-2016-0998 | flash-plugin: multiple code execution issues fixed in APSB16-08 adobe · air | High 8.8 | 28% | 4 exploits | |
| CVE-2026-64560 | Linux kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race | High 7.8 | 0.7% | 10 exploits | |
| CVE-2026-107181 | Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme telegram · telegram desktop | High 8.6 | 0.3% | 4 exploits | |
| CVE-2021-3297 | On Zyxel NBG2105 V1.00(AAGU.2)C0 devices, setting the login cookie to 1 provides administrator access. zyxel · nbg2105 firmware | High 7.8 | 21% | 1 exploit | |
| CVE-2021-1384 | A vulnerability in Cisco IOx application hosting environment of Cisco IOS XE Software could allow an authenticated, remote attacker to inject commands into the underlying operating system as the root user. cisco · ios xe | High 7.2 | 35% | 1 exploit | |
| CVE-2018-16299 | The Localize My Post plugin 1.0 for WordPress allows Directory Traversal via the ajax/include.php file parameter. localize my post project · localize my post | High 7.5 | 44% | 3 exploits | |
| CVE-2012-1803 | RuggedCom Rugged Operating System (ROS) 3.10.x and earlier has a factory account with a password derived from the MAC Address field in the banner, which makes it easier for remote attackers to obtain access by performing a calculation on this address value, and then establishing… siemens · ruggedcom rugged operating system | High 8.5 | 49% | 2 exploits | |
| CVE-2026-23111 | kernel: Kernel: Privilege escalation or denial of service in nf_tables via inverted element activity check | High 7.8 | 0.5% | 7 exploits | |
| CVE-2025-32711 | Ai command injection in M365 Copilot allows an unauthorized attacker to disclose information over a network. microsoft · 365 copilot | High 7.5 | 8.0% | 5 exploits | |
| CVE-2022-22909 | HotelDruid v3.0.3 was discovered to contain a remote code execution (RCE) vulnerability which is exploited via an attacker inserting a crafted payload into the name field under the Create New Room module. digitaldruid · hoteldruid | High 8.8 | 45% | 2 exploits | |
| CVE-2022-20759 | A vulnerability in the web services interface for remote access VPN features of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, but unprivileged, remote attacker to elevate privileges to level 15. cisco · firepower threat defense | High 8.8 | 28% | 1 exploit | |
| CVE-2019-9810 | Incorrect alias information in IonMonkey JIT compiler for Array.prototype.slice method may lead to missing bounds check and a buffer overflow. mozilla · firefox | High 8.8 | 30% | 3 exploits | |
| CVE-2018-12617 | qmp_guest_file_read in qga/commands-posix.c and qga/commands-win32.c in qemu-ga (aka QEMU Guest Agent) in QEMU 2.12.50 has an integer overflow causing a g_malloc0() call to trigger a segmentation fault when trying to allocate a large memory chunk. qemu · qemu | High 7.5 | 25% | 3 exploits | |
| CVE-2026-74580 | Linux kernel: vhost: reset the vring metadata cache on vring reconfiguration linux · linux kernel | High 8.8 | 0.1% | 3 exploits | |
| CVE-2019-11354 | The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. ea · origin | High 7.8 | 23% | 3 exploits | |
| CVE-2016-4338 | The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x before 2.2.13, and 3.0.x before 3.0.3, when used with a shell other than bash, allows context-dependent attackers to execute arbitrary code or SQL commands via… zabbix · zabbix | High 8.1 | 21% | 3 exploits | |
| CVE-2016-2233 | Stack-based buffer overflow in the inbound_cap_ls function in common/inbound.c in HexChat 2.10.2 allows remote IRC servers to cause a denial of service (crash) via a large number of options in a CAP LS message. hexchat project · hexchat | High 7.5 | 34% | 3 exploits | |
| CVE-2014-9566 | Multiple SQL injection vulnerabilities in the Manage Accounts page in the AccountManagement.asmx service in the Solarwinds Orion Platform 2015.1, as used in Network Performance Monitor (NPM) before 11.5, NetFlow Traffic Analyzer (NTA) before 4.1, Network Configuration Manager… solarwinds · orion ip address manager | High 7.5 | 48% | 3 exploits | |
| CVE-2003-0003 | Buffer overflow in the RPC Locator service for Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows local users to execute arbitrary code via an RPC call to the service containing certain parameter information. microsoft · windows 2000 | High 7.5 | 43% | 2 exploits | |
| CVE-2023-5146 | UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231 and classified as critical. dlink · dar-7000 firmware | High 8.8 | 32% | 2 exploits | |
| CVE-2021-27928 | mariadb-10.1 - security update galeracluster · wsrep | High 7.2 | 38% | 2 exploits | |
| CVE-2020-35749 | Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php. presstigers · simple board job | High 7.7 | 30% | 4 exploits | |
| CVE-2019-6116 | In Artifex Ghostscript through 9.26, ephemeral or transient procedures can allow access to system operators, leading to remote code execution. artifex · ghostscript | High 7.8 | 42% | 2 exploits | |
| CVE-2018-1133 | Moodle calculated question type allows remote code execution by Question authors moodle · moodle | High 8.8 | 31% | 2 exploits | |
| CVE-2017-2992 | flash-plugin: multiple code execution issues fixed in APSB17-04 adobe · flash player | High 8.8 | 33% | 2 exploits | |
| CVE-2017-2986 | flash-plugin: multiple code execution issues fixed in APSB17-04 adobe · flash player | High 8.8 | 31% | 2 exploits | |
| CVE-2016-4232 | flash-plugin: multiple code execution issues fixed in APSB16-25 adobe · flash player | High 7.5 | 36% | 2 exploits | |
| CVE-2016-4231 | flash-plugin: multiple code execution issues fixed in APSB16-25 adobe · flash player | High 8.8 | 33% | 2 exploits | |
| CVE-2016-4227 | flash-plugin: multiple code execution issues fixed in APSB16-25 adobe · flash player | High 8.8 | 33% | 2 exploits | |
| CVE-2016-1960 | Integer underflow in the nsHtml5TreeBuilder class in the HTML5 string parser in Mozilla Firefox before 45.0 and Firefox ESR 38.x before 38.7 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) by leveraging mishandling of end tags, as… mozilla · firefox | High 8.8 | 31% | 2 exploits | |
| CVE-2016-0974 | flash-plugin: multiple code execution issues fixed in APSB16-04 adobe · air sdk | High 8.8 | 31% | 2 exploits | |
| CVE-2016-0971 | flash-plugin: multiple code execution issues fixed in APSB16-04 adobe · air sdk | High 8.8 | 33% | 2 exploits | |
| CVE-2014-9013 | The ajaxinit function in wpmarketplace/libs/cart.php in the WP Marketplace plugin 2.4.0 for WordPress allows remote authenticated users to create arbitrary users and gain admin privileges via a request to wpmp_pp_ajax_call with an execution target of wp_insert_user. wpmarketplace project · wpmarketplace | High 8.8 | 47% | 2 exploits | |
| CVE-2002-0082 | The dbm and shm session cache code in mod_ssl before 2.8.7-1.3.23, and Apache-SSL before 1.3.22+1.46, does not properly initialize memory using the i2d_SSL_SESSION function, which allows remote attackers to use a buffer overflow to execute arbitrary code via a large client… apache-ssl · apache-ssl | High 7.5 | 30% | 3 exploits | |
| CVE-2026-23918 | Double Free and possible RCE vulnerability in Apache HTTP Server with the HTTP/2 protocol. apache · http server | High 8.8 | 50% | 1 exploit | |
| CVE-2025-49002 | Versions prior to version 2.10.10 have a flaw in the patch for CVE-2025-32966 that allow the patch to be bypassed through case insensitivity because INIT and RUNSCRIPT are prohibited. dataease · dataease | High 8.2 | 50% | 2 exploits | |
| CVE-2023-5148 | UNSUPPORTED WHEN ASSIGNED A vulnerability was found in D-Link DAR-7000 and DAR-8000 up to 20151231. dlink · dar-7000 firmware | High 8.8 | 31% | 2 exploits | |
| CVE-2021-40875 | Improper Access Control in Gurock TestRail versions < 7.2.0.3014 resulted in sensitive information exposure. gurock · testrail | High 7.5 | 47% | 2 exploits | |
| CVE-2021-24146 | Modern Events Calendar Lite <= 5.16.4 - Unauthenticated Events Export webnus · modern events calendar lite | High 7.5 | 31% | 2 exploits | |
| CVE-2020-28948 | Deserialization of Untrusted Data in Archive_Tar drupal · drupal | High 7.8 | 47% | 1 exploit | |
| CVE-2018-8544 | A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server… microsoft · windows 10 | High 8.8 | 48% | 2 exploits | |
| CVE-2018-19571 | GitLab CE/EE, versions 8.18 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an SSRF vulnerability in webhooks. gitlab · gitlab | High 7.7 | 32% | 2 exploits | |
| CVE-2018-19246 | LFI in PHP-Proxy 5.1.0 php-proxy · php-proxy | High 7.5 | 22% | 3 exploits | |
| CVE-2018-14716 | SEOmatic plugin for Craft CMS SSTI Vulnerability nystudio107 · seomatic | High 7.5 | 33% | 2 exploits | |
| CVE-2018-1306 | Exposure of Sensitive Information in Apache Pluto apache · pluto | High 7.5 | 43% | 2 exploits |
Showing 1–50 of 521
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.