The CVE Watchlist, Under Review.
Scored between the two publication thresholds. Each moves up the moment new exploitation evidence arrives.
- CVE-2006-1193Low 2.6Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."microsoft · exchange serverEPSS40%1 exploitPublished Jun 13, 2006
- CVE-2007-5461Low 3.5Apache Tomcat Path Traversal Vulnerabilityapache · tomcatEPSS40%2 exploitsPublished May 1, 2022
- CVE-2025-7083Low 2.1It has been classified as critical.belkin · f9k1122 firmwareEPSS46%2 exploitsPublished Jul 6, 2025
- CVE-2010-0926Low 3.5The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in…samba · sambaEPSS30%2 exploitsPublished Mar 10, 2010
- CVE-2025-9769Low 0.9The manipulation of the argument addr with the input echo 12345 > poc.txt results in command injection.dlink · di-7400g\+ firmwareEPSS29%2 exploitsPublished Sep 1, 2025
- CVE-2013-0177Low 3.5Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1)…apache · ofbizEPSS21%1 exploitPublished Jan 30, 2014
- CVE-2011-1772Low 2.6Cross-site Scripting in Apache Strutsapache · strutsEPSS33%1 exploitPublished May 17, 2022
| CVE | Title | Severity | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2006-1193 | Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing." microsoft · exchange server | Low 2.6 | 40% | 1 exploit | |
| CVE-2007-5461 | Apache Tomcat Path Traversal Vulnerability apache · tomcat | Low 3.5 | 40% | 2 exploits | |
| CVE-2025-7083 | It has been classified as critical. belkin · f9k1122 firmware | Low 2.1 | 46% | 2 exploits | |
| CVE-2010-0926 | The default configuration of smbd in Samba before 3.3.11, 3.4.x before 3.4.6, and 3.5.x before 3.5.0rc3, when a writable share exists, allows remote authenticated users to leverage a directory traversal vulnerability, and access arbitrary files, by using the symlink command in… samba · samba | Low 3.5 | 30% | 2 exploits | |
| CVE-2025-9769 | The manipulation of the argument addr with the input echo 12345 > poc.txt results in command injection. dlink · di-7400g\+ firmware | Low 0.9 | 29% | 2 exploits | |
| CVE-2013-0177 | Multiple cross-site scripting (XSS) vulnerabilities in widget/screen/ModelScreenWidget.java in Apache Open For Business Project (aka OFBiz) 10.04.x before 10.04.05, 11.04.01, and possibly 09.04.x allow remote authenticated users to inject arbitrary web script or HTML via the (1)… apache · ofbiz | Low 3.5 | 21% | 1 exploit | |
| CVE-2011-1772 | Cross-site Scripting in Apache Struts apache · struts | Low 2.6 | 33% | 1 exploit |
Note on years: years refer to the date the CVE record was published, not the year in its identifier. Some records are published or republished years later, so an older-looking ID such as a 2016 CVE can appear under a recent year.
FAQ
Common Questions.
The Known Exploited Vulnerabilities catalog is the US government list of flaws that attackers are using in real attacks. Each entry carries a due date by which federal agencies must patch, which makes it a useful priority list for everyone else too.
Known Exploited holds CVEs with confirmed exploitation. Emerging Threats holds CVEs not on that list yet, but with a high exploit forecast or a weaponized exploit. The Watchlist holds CVEs with a middling publication score that move up when new evidence arrives.
CVSS rates how bad a flaw would be if exploited, on a 0 to 10 scale. EPSS estimates how likely it is to be exploited in the next 30 days. A critical CVSS score with a tiny EPSS can often wait; a high EPSS with a known exploit should not.
CISA sets a remediation due date for every catalog entry. Overdue means that date has passed, so the flaw has been exploitable and listed for longer than the agency deadline allowed.
It shows which products and versions are affected. To know which of your own internet-facing assets run a vulnerable version, the Brandefense platform maps new CVEs against your attack surface continuously.
Which Of These Are On Your Attack Surface?
Brandefense maps every internet-facing asset you own and flags the exploited CVEs on it the hour they are listed.
About this list. Scored between the two publication thresholds. Each keeps its scores and scope, and moves up the moment new exploitation evidence arrives.