CVE & Exploit Intelligence Database
Updated 28m agoSearch and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.
337,123 CVEs tracked
53,223 with exploits
4,686 exploited in wild
1,539 CISA KEV
3,912 Nuclei templates
37,757 vendors
42,429 researchers
2 results
Clear all
CVE-2007-4481
EPSS 0.00
Blix 0.9.1-0.9.1 Rus - XSS
Cross-site scripting (XSS) vulnerability in index.php in the (1) Blix 0.9.1 and (2) Blix 0.9.1 Rus themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the PATH_INFO (PHP_SELF).
Aug 22, 2007
CVE-2007-4014
EPSS 0.02
WordPress Blix/Blixed/BlixKrieg - XSS
Cross-site scripting (XSS) vulnerability in a certain index.php installation script related to the (1) Blix 0.9.1, (2) Blixed 1.0, and (3) BlixKrieg (Blix Krieg) 2.2 themes for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter, possibly a related issue to CVE-2007-2757. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Jul 26, 2007
Investigate
Reference Indexes
CVE-2026-28391: OpenClaw Command Injection - The Day I Hacked Myself
Mar 09, 2026
Introducing FuzzForge: Autonomous Source-Code Fuzzing - Finding Bugs in nginx in 112 Minutes
Mar 08, 2026
CVE-2025-68670 Part 2: From Crash to RCE - The One That Fought Back (and Lost)
Mar 04, 2026
CVE-2025-68670: Pre-Auth xrdp Overflow - The One Where the Protocol Fought Back
Mar 04, 2026
CVE-2025-62507: Redis Stack Overflow to RCE in 68 Minutes - Then We Turned ASLR On
Mar 03, 2026
CVE-2025-15467: From OpenSSL Stack Overflow to Three ROP Chains in 64 Minutes - Introducing Stackforge
Mar 03, 2026
View all posts →
CVE-2016-15057
CRITICAL
Apache Continuum - Command Injection
CVE-2021-32824
CRITICAL
Apache Dubbo <2.6.10-2.7.10 - RCE
CVE-2023-42117
CRITICAL
Exim < 4.96.2 - Remote Code Execution
CVE-2024-31866
CRITICAL
Apache Zeppelin <0.11.1 - RCE
CVE-2024-37288
CRITICAL
Elastic Kibana - Insecure Deserialization
CVE-2024-43115
HIGH
Apache DolphinScheduler <3.2.2 - RCE
CVE-2024-45409
CRITICAL
Ruby-SAML <=1.16.0 - Auth Bypass
CVE-2024-56143
HIGH
Strapi < 5.5.2 - IDOR
CVE-2025-10622
HIGH
Red Hat Satellite - Command Injection
CVE-2025-11539
CRITICAL
Grafana Image Renderer - RCE
View all labs →
CVE-2026-1603
Ivanti Endpoint Manager < 2024 - Authentication Bypass
CVE-2023-43000
macOS Ventura <13.5-iPadOS <16.6-Safari <16.6 - Use After Free
CVE-2021-30952
tvOS <15.2 - RCE
CVE-2021-22681
Rockwell Automation Studio 5000 <21 - Path Traversal
CVE-2026-22719
VMware Aria Operations - Command Injection
CVE-2026-25108
FileZen - Command Injection
CVE-2026-22769
Dell RecoverPoint <6.0.3.1 HF1 - Auth Bypass
CVE-2021-22175
Gitlab < 13.6.7 - SSRF
CVE-2024-7694
Teamt5 Threatsonar Anti-ransomware < 3.5.0 - Unrestricted File Upload
CVE-2020-7796
Zimbra Collaboration Suite <8.8.15 Patch 7 - SSRF
CVE-2026-21525
Microsoft Windows 10 1607 < 10.0.14393.8868 - NULL Pointer Dereference
CVE-2026-21519
Microsoft Windows 10 1607 < 10.0.14393.8868 - Type Confusion