Latest Vulnerabilities with Public Exploits

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

365,974 CVEs tracked 55,116 with exploits 5,107 exploited in wild 1,647 CISA KEV 4,228 Nuclei templates 56,054 vendors 48,789 researchers
55,116 results Clear all
CVE-2009-3659 1 PoC Analysis EPSS 0.01
BS Counter 2.5.3 - SQL Injection via Page Parameter
SQL injection vulnerability in file/stats.php in BS Counter 2.5.3 allows remote attackers to execute arbitrary SQL commands via the page parameter.
CWE-89 Oct 11, 2009 STIX 2.1
CVE-2009-3574 1 PoC Analysis EPSS 0.05
Tuniac 090517c - Buffer Overflow via .pls Playlist File1 Argument
Tuniac 090517c allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a long File1 argument in a .pls playlist file, possibly a buffer overflow.
CWE-119 Oct 06, 2009 STIX 2.1
CVE-2009-3545 1 PoC Analysis EPSS 0.02
DataWizard Technologies FtpXQ FTP Server 3.0 - Authenticated Denial of Service via Long ABOR Command
DataWizard Technologies FtpXQ FTP Server 3.0 allows remote authenticated users to cause a denial of service (crash) via a long ABOR command.
CWE-20 Oct 05, 2009 STIX 2.1
CVE-2009-3365 1 PoC Analysis EPSS 0.02
Aurora CMS 1.0.2 - Remote Code Execution via AURORA_MODULES_FOLDER Parameter
PHP remote file inclusion vulnerability in add-ons/modules/sysmanager/plugins/install.plugin.php in Aurora CMS 1.0.2 allows remote attackers to execute arbitrary PHP code via a URL in the AURORA_MODULES_FOLDER parameter.
CWE-94 Sep 24, 2009 STIX 2.1
CVE-2009-3342 1 PoC Analysis EPSS 0.01
AlphaUserPoints 1.5.2 - SQL Injection via Username2Points Parameter
SQL injection vulnerability in frontend/assets/ajax/checkusername.php in the AlphaUserPoints (com_alphauserpoints) component 1.5.2 for Joomla! allows remote attackers to execute arbitrary SQL commands via the username2points parameter.
CWE-89 Sep 24, 2009 STIX 2.1
CVE-2009-3338 1 PoC Analysis EPSS 0.06
EffectMatrix Magic Morph 1.95b - Stack-Based Buffer Overflow via .mor File
Stack-based buffer overflow in EffectMatrix (E.M.) Magic Morph 1.95b allows remote attackers to execute arbitrary code via a long string in a .mor file.
CWE-119 Sep 24, 2009 STIX 2.1
CVE-2009-3336 1 PoC Analysis EPSS 0.01
PHP Pro Bid - SQL Injection via auction_id Parameter
SQL injection vulnerability in auction_details.php in PHP Pro Bid allows remote attackers to execute arbitrary SQL commands via the auction_id parameter.
CWE-89 Sep 24, 2009 STIX 2.1
CVE-2009-3335 1 PoC Analysis EPSS 0.01
TurtuShout 0.11 - SQL Injection via Name Field
SQL injection vulnerability in the TurtuShout component 0.11 for Joomla! allows remote attackers to execute arbitrary SQL commands via the Name field.
CWE-89 Sep 24, 2009 STIX 2.1
CVE-2009-3271 1 PoC Analysis EPSS 0.04
Apple Safari on iPhone OS 3.0.1 - Denial of Service via Long tel: URL in IFRAME SRC Attribute
Apple Safari on iPhone OS 3.0.1 allows remote attackers to cause a denial of service (application crash) via a long tel: URL in the SRC attribute of an IFRAME element.
CWE-20 Sep 21, 2009 STIX 2.1
CVE-2009-3544 1 PoC Analysis EPSS 0.03
Xerver HTTP Server 4.32 - Exposure of Sensitive Information via ::$DATA Suffix
Xerver HTTP Server 4.32 allows remote attackers to obtain the source code for a web page via an HTTP request with the addition of ::$DATA after the HTML file name.
CWE-200 Oct 05, 2009 STIX 2.1
CVE-2009-3368 1 PoC Analysis EPSS 0.02
com_hbssearch - Cross-Site Scripting via Adult Parameter
Cross-site scripting (XSS) vulnerability in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allows remote attackers to inject arbitrary web script or HTML via the adult parameter in a showhoteldetails action to index.php.
CWE-79 Sep 24, 2009 STIX 2.1
CVE-2009-3362 1 PoC Analysis EPSS 0.03
SZNews 2.7 - Remote Code Execution via printnews.php3 id Parameter
PHP remote file inclusion vulnerability in printnews.php3 in SZNews 2.7 allows remote attackers to execute arbitrary PHP code via a URL in the id parameter.
CWE-94 Sep 24, 2009 STIX 2.1
CVE-2009-3361 1 PoC Analysis EPSS 0.01
PHP-IPNMonitor - SQL Injection via maincat_id Parameter
SQL injection vulnerability in index.php in PHP-IPNMonitor allows remote attackers to execute arbitrary SQL commands via the maincat_id parameter.
CWE-89 Sep 24, 2009 STIX 2.1
CVE-2009-3359 2 PoCs Analysis EPSS 0.02
Match Agency BiZ 1.0 - Cross-Site Scripting via Important Parameter or PID Parameter
Multiple cross-site scripting (XSS) vulnerabilities in Match Agency BiZ 1.0 allow remote attackers to inject arbitrary web script or HTML via the (1) important parameter to edit_profile.php and (2) pid parameter to report.php.
CWE-79 Sep 24, 2009 STIX 2.1
CVE-2009-3357 1 PoC Analysis EPSS 0.01
com_hbssearch - SQL Injection via h_id, id, or rid Parameters
Multiple SQL injection vulnerabilities in the Hotel Booking Reservation System (aka HBS or com_hbssearch) component for Joomla! allow remote attackers to execute arbitrary SQL commands via the (1) h_id, (2) id, and (3) rid parameters to longDesc.php, and the h_id parameter to (4) detail.php, (5) detail1.php, (6) detail2.php, (7) detail3.php, (8) detail4.php, (9) detail5.php, (10) detail6.php, (11) detail7.php, and (12) detail8.php, different vectors than CVE-2008-5865, CVE-2008-5874, and CVE-2008-5875.
CWE-89 Sep 24, 2009 STIX 2.1
CVE-2009-3356 1 PoC Analysis EPSS 0.01
Image voting 1.0 - SQL Injection via Show Parameter
SQL injection vulnerability in index.php in Image voting 1.0 allows remote attackers to execute arbitrary SQL commands via the show parameter.
CWE-89 Sep 24, 2009 STIX 2.1
CVE-2009-3349 1 PoC Analysis EPSS 0.02
Datavore Gyro 5.0 - SQL Injection via cid Parameter in Home Component
SQL injection vulnerability in Datavore Gyro 5.0 allows remote attackers to execute arbitrary SQL commands via the cid parameter in a cat action to the home component.
CWE-89 Sep 24, 2009 STIX 2.1
CVE-2009-3348 1 PoC Analysis EPSS 0.01
Datavore Gyro 5.0 - Cross-Site Scripting via Home Component cid Parameter
Cross-site scripting (XSS) vulnerability in Datavore Gyro 5.0 allows remote attackers to inject arbitrary web script or HTML via the cid parameter in a cat action to the home component.
CWE-79 Sep 24, 2009 STIX 2.1
CVE-2009-3322 1 PoC Analysis EPSS 0.03
Siemens Gigaset SE361 WLAN Router - Denial of Service via TCP Packet Flood to Port 1723
The Siemens Gigaset SE361 WLAN router allows remote attackers to cause a denial of service (device reboot) via a flood of crafted TCP packets to port 1723.
Sep 23, 2009 STIX 2.1
CVE-2009-2937 1 PoC Analysis EPSS 0.05
Planet and Planet Venus - Cross-Site Scripting via IMG SRC Attribute
Cross-site scripting (XSS) vulnerability in Planet 2.0 and Planet Venus allows remote attackers to inject arbitrary web script or HTML via the SRC attribute of an IMG element in a feed.
CWE-79 Sep 18, 2009 STIX 2.1

Investigate

Critical + Public Exploits Exploited in Wild + PoC High EPSS (>=0.7) + PoC With Nuclei Templates Latest CVEs with Public Exploits

Ecosystems

Linux Maven Packagist PyPI npm Go ecosystem RubyGems crates.io NuGet Hex SwiftURL GitHub Actions

Reference Indexes

Exploit Database Researchers Vendors CWE Categories

Recent Blog Posts

CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp
May 17, 2026
Hermes Agent with EIP Harness: The Vulnerability Research Assistant That Also Runs Your Pipelines
May 13, 2026
CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
May 01, 2026
EIP STIX 2.1 / TAXII 2.1 Feed: Exploit Intelligence for Your Stack
Apr 29, 2026
CVE-2026-35414: Three Bugs, One Commit, and Two More Nobody Mentioned
Apr 03, 2026
WP Google Map Plugin - Three Weak Links, One Critical Chain
Mar 29, 2026
 View all posts →

CVEForge Labs

CVE-2026-45829 CRITICAL
ChromaDB >=1.0.0 - Unauthenticated Remote Code Execution via Malicious Model Repository
CVE-2026-42859 HIGH
Neat VNC: Buffer overflow due to oversized RSA public keys
CVE-2026-3296 CRITICAL
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
CVE-2026-34980 HIGH
OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
CVE-2026-35414 MEDIUM
OpenSSH < 10.3 - Always-Incorrect Control Flow Implementation in Authorized Keys Principals Handling
CVE-2026-33765 CRITICAL
Pi-hole Web <6.0 savesettings.php - Command Injection
CVE-2026-4105 MEDIUM
Red Hat Enterprise Linux 10 - Improper Access Control via systemd-machined RegisterMachine D-Bus Method
CVE-2026-30861 CRITICAL
WeKnora 0.2.5-0.2.9 - Unauthenticated Remote Code Execution via MCP stdio Configuration Validation Bypass
CVE-2026-30860 CRITICAL
WeKnora <0.2.12 - RCE via SQL Injection
CVE-2026-28391 CRITICAL
OpenClaw <2026.2.2 - Command Injection
 View all labs →

KEV Gaps

CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
 CVE-2023-4346
KNX Connection Authorization - Device Lockout Denial of Service
 CVE-2026-56155
Microsoft Windows 10 Version 1607 - Active Directory Federation Services Elevation of Privilege Vulnerability
 CVE-2026-12569
PTC Windchill PDMLink and FlexPLM - Deserialization Remote Code Execution
 CVE-2026-34910
Ubiquiti INC UniFi OS Server - Improper Input Validation
 CVE-2026-34909
Ubiquiti INC UniFi OS Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CVE-2026-48027
Compromised Nx Console version 18.95.0
 CVE-2026-8398
DAEMON Tools Lite 12.5.0.2421-12.5.0.2434 - Embedded Malicious Code in Trojanized Installer
 CVE-2009-1537
Microsoft DirectX 7.0-9.0c - Remote Code Execution via QuickTime Movie Parser Filter
 CVE-2026-6973
Ivanti Endpoint Manager Mobile < 12.6.1.1, < 12.7.0.1, < 12.8.0.1 - Authenticated Remote Code Execution
 CVE-2025-29635
D-Link DIR-823X 240126 and 240802 - Authenticated Remote Command Execution via /goform/set_prohibiting
 CVE-2024-57728
SimpleHelp < 5.5.8 - Authenticated Path Traversal and Arbitrary File Write via Zip Slip