CVE & Exploit Intelligence Database

Updated 4h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

337,847 CVEs tracked 53,242 with exploits 4,725 exploited in wild 1,540 CISA KEV 3,918 Nuclei templates 37,802 vendors 42,493 researchers

2,026 results Clear all

CVE-2011-3055 EPSS 0.01

Google Chrome < 17.0.963.83 - Missing Authentication

The browser native UI in Google Chrome before 17.0.963.83 does not require user confirmation before an unpacked extension installation, which allows user-assisted remote attackers to have an unspecified impact via a crafted extension.

CWE-306 Mar 22, 2012

CVE-2008-6827 7.8 HIGH 1 PoC Analysis EPSS 0.02

Symantec Altiris Deployment Solution - Missing Authentication

The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a "Shatter" style attack on the "command prompt" hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.

CWE-306 Jun 08, 2009

CVE-2009-1780 1 PoC Analysis EPSS 0.04

Frax Php Recommend < 1.3 - Missing Authentication

admin.php in Frax.dk Php Recommend 1.3 and earlier does not require authentication when the user password is changed, which allows remote attackers to gain administrative privileges via modified form_admin_user and form_admin_pass parameters.

CWE-306 May 22, 2009

CVE-2007-0956 EPSS 0.22

MIT krb5 <1.6.1 - Auth Bypass

The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a '-' character, a similar issue to CVE-2007-0882.

CWE-306 Apr 06, 2007

CVE-2004-0213 7.8 HIGH 4 PoCs Analysis EPSS 0.02

Microsoft Windows 2000 - Missing Authentication

Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.

CWE-306 Aug 06, 2004

CVE-2002-1810 7.5 HIGH EPSS 0.01

Dlink Dwl-900ap+ Firmware - Missing Authentication

D-Link DWL-900AP+ Access Point 2.1 and 2.2 allows remote attackers to access the TFTP server without authentication and read the config.img file, which contains sensitive information such as the administrative password, the WEP encryption keys, and network configuration information.

CWE-306 Dec 31, 2002