Once you have patched everything in the CISA Known Exploited Vulnerabilities catalog, the usual advice is to sort what is left by exploitation probability and work down from the top. That advice is everywhere. The list itself is not — so this page publishes it, and refreshes it daily.
Every row below is a vulnerability that the Exploit Prediction Scoring System rates as highly likely to be attacked in the next 30 days, and that CISA has not added to its catalog yet.
These are not all new. The median entry here was published 462 days ago and has carried a high exploitation forecast since, without ever being confirmed as exploited. That distance — between what the model expects and what CISA has verified — is what this page is measuring.
For the vulnerabilities we have written step-by-step fixes for, see our CVE remediation guides.
Severity and likelihood are different questions. 3 of the 44 entries below score under CVSS 7, the band most triage queues park for later. The highest is CVE-2025-53771 at CVSS 6.5 (medium) with a 99.9% exploitation probability. Those are the ones a severity-only process drops.
| Exploit probability | CVE | CVSS | Vendor | What it is | Published | Our coverage |
|---|---|---|---|---|---|---|
| 99.9% | CVE-2025-53771 | 6.5 Medium under-rated | microsoft | Improper authentication in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. | 2025-07-20 | — |
| 99.4% | CVE-2025-1974 | 9.8 Critical | — | A security issue was discovered in Kubernetes where under certain conditions, an unauthenticated attacker with access to the pod network can achieve arbitrary code execution in the context of the ingress-nginx controller. This can… | 2025-03-25 | CVE-2025-59528 – Immediate steps for Flowise remote code exe |
| 99.2% | CVE-2025-29927 | 9.1 Critical | vercel | Next.js is a React framework for building full-stack web applications. Starting in version 1.11.4 and prior to versions 12.3.5, 13.5.9, 14.2.25, and 15.2.3, it is possible to bypass authorization checks within a Next.js applicatio… | 2025-03-21 | CVE-2025-29927 – Critical Next.js Authorization Bypass – Imm |
| 97.1% | CVE-2025-4123 | 7.6 High | grafana | A cross-site scripting (XSS) vulnerability exists in Grafana caused by combining a client path traversal and open redirect. This allows attackers to redirect users to a website that hosts a frontend plugin that will execute arbitr… | 2025-05-22 | — |
| 97.1% | CVE-2025-27636 | — | — | — | — | |
| 94.2% | CVE-2026-43284 | 8.8 High | linux | In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP |
2026-05-08 | CVE-2026-43284 – Linux kernel ESP‑in‑UDP in‑place decryption |
| 92.8% | CVE-2025-34037 | 10.0 Critical | — | An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed … | 2025-06-24 | CVE-2025-59528 – Immediate steps for Flowise remote code exe |
| 90.0% | CVE-2025-1094 | 8.1 High | — | Improper neutralization of quoting syntax in PostgreSQL libpq functions PQescapeLiteral(), PQescapeIdentifier(), PQescapeString(), and PQescapeStringConn() allows a database input provider to achieve SQL injection in certain usage… | 2025-02-13 | CVE-2025-1094 – PostgreSQL libpq quoting injection – quick g |
| 89.0% | CVE-2025-66516 | — | — | — | — | |
| 87.9% | CVE-2025-32429 | — | — | — | — | |
| 86.8% | CVE-2025-34152 | 9.4 Critical | — | An unauthenticated OS command injection vulnerability exists in the Shenzhen Aitemi M300 Wi-Fi Repeater (hardware model MT02) via the 'time' parameter of the '/protocol.csp?' endpoint. The input is processed by the internal date '… | 2025-08-07 | — |
| 86.7% | CVE-2025-24799 | — | — | — | — | |
| 86.2% | CVE-2025-59528 | 10.0 Critical | flowiseai | Flowise is a drag & drop user interface to build a customized large language model flow. In version 3.0.5, Flowise is vulnerable to remote code execution. The CustomMCP node allows users to input configuration settings for connect… | 2025-09-22 | Ivanti EPMM CVE-2026-6973 RCE Under Active Exploitation |
| 84.2% | CVE-2025-47916 | — | — | — | — | |
| 82.3% | CVE-2025-1098 | — | — | — | — | |
| 82.3% | CVE-2025-49844 | 9.9 Critical | redis | Redis is an open source, in-memory database that persists on disk. Versions 8.2.1 and below allow an authenticated user to use a specially crafted Lua script to manipulate the garbage collector, trigger a use-after-free and potent… | 2025-10-03 | CVE-2025-49844 – Immediate actions for Redis administrators |
| 81.3% | CVE-2025-34300 | 10.0 Critical | — | A template injection vulnerability exists in Sawtooth Software’s Lighthouse Studio versions prior to 9.16.14 via the ciwweb.pl http://ciwweb.pl/ Perl web application. Exploitation allows an unauthenticated attacker can execute a… | 2025-07-16 | — |
| 80.9% | CVE-2025-21298 | — | — | — | — | |
| 80.0% | CVE-2025-32969 | — | — | — | — | |
| 78.9% | CVE-2025-4901 | — | — | — | — | |
| 78.4% | CVE-2025-0107 | — | — | — | — | |
| 78.4% | CVE-2025-2294 | — | — | — | — | |
| 78.2% | CVE-2026-21858 | — | — | — | — | |
| 77.5% | CVE-2025-26794 | — | — | — | — | |
| 77.5% | CVE-2025-54254 | — | — | — | — | |
| 77.0% | CVE-2025-6514 | — | — | — | — | |
| 76.2% | CVE-2025-3102 | — | — | — | — | |
| 76.1% | CVE-2025-6389 | — | — | — | — | |
| 76.1% | CVE-2025-29891 | — | — | — | — | |
| 75.8% | CVE-2025-48827 | — | — | — | — | |
| 75.6% | CVE-2026-2041 | — | — | — | — | |
| 75.4% | CVE-2026-2043 | — | — | — | — | |
| 75.3% | CVE-2025-1044 | — | — | — | — | |
| 75.2% | CVE-2025-8943 | — | — | — | — | |
| 74.8% | CVE-2025-30208 | — | — | — | — | |
| 74.7% | CVE-2025-11749 | — | — | — | — | |
| 73.6% | CVE-2026-22200 | — | — | — | — | |
| 73.3% | CVE-2025-6965 | — | — | — | — | |
| 73.2% | CVE-2025-34508 | 6.3 Medium under-rated | — | A path traversal vulnerability exists in the file dropoff functionality of ZendTo versions 6.15-7 and prior. This could allow a remote, authenticated attacker to retrieve the files of other ZendTo users, retrieve files on the hos… |
2025-06-17 | — |
| 73.0% | CVE-2025-9491 | 7.8 High | microsoft | Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Windows. User interaction is required… | 2025-08-26 | — |
| 72.7% | CVE-2025-34299 | — | — | — | — | |
| 72.7% | CVE-2025-2777 | — | — | — | — | |
| 71.4% | CVE-2025-4009 | — | — | — | — | |
| 70.1% | CVE-2025-6197 | 4.2 Medium under-rated | — | An open redirect vulnerability has been identified in Grafana OSS organization switching functionality.
Prerequisites for exploitation: – Multiple organizations must exist in the Grafana instance – Victim must be on a differen… |
2025-07-18 | — |
Sources: EPSS scores from FIRST.org, catalog membership from CISA KEV, descriptions and CVSS from NVD. Showing CVEs published in 2025 or later with an EPSS score above 70%, excluding anything already in KEV. Older vulnerabilities are left out on purpose: a high EPSS on a ten-year-old CVE reflects years of exploitation, not a forecast. Last updated 21 October 2026, 05:55 UTC.
Get this list when it changes
One email when a vulnerability enters or leaves this watchlist. No digest of things you already read, no daily noise — only the change, with the reasoning.
