Latest Vulnerabilities with Public Exploits

Updated 2h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

351,998 CVEs tracked 54,214 with exploits 4,985 exploited in wild 1,602 CISA KEV 4,138 Nuclei templates 54,529 vendors 46,792 researchers
54,214 results Clear all
CVE-2008-5003 1 PoC Analysis EPSS 0.00
Shahrood - SQL Injection via id Parameter
SQL injection vulnerability in ndetail.php in Shahrood allows remote attackers to execute arbitrary SQL commands via the id parameter.
CWE-89 Nov 10, 2008 STIX 2.1
CVE-2008-4900 2 PoCs Analysis EPSS 0.01
YourFreeWorld Classifieds Blaster Script - SQL Injection via tr.php id Parameter
SQL injection vulnerability in tr.php in YourFreeWorld Classifieds Blaster Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CWE-89 Nov 04, 2008 STIX 2.1
CVE-2008-4885 2 PoCs Analysis EPSS 0.01
YourFreeWorld Scrolling Text Ads Script - SQL Injection via id Parameter
SQL injection vulnerability in tr1.php in YourFreeWorld Scrolling Text Ads Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CWE-89 Nov 04, 2008 STIX 2.1
CVE-2008-3749 2 PoCs Analysis EPSS 0.01
YourFreeWorld Banner Mgr < - SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Banner Management Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CWE-89 Aug 21, 2008 STIX 2.1
CVE-2008-3750 1 PoC Analysis EPSS 0.00
YourFreeWorld URL Rotator Script - SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld URL Rotator Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CWE-89 Aug 21, 2008 STIX 2.1
CVE-2008-3751 1 PoC Analysis EPSS 0.01
YourFreeWorld Short Url & Url Tracker Script - SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Short Url & Url Tracker Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CWE-89 Aug 21, 2008 STIX 2.1
CVE-2008-3755 1 PoC Analysis EPSS 0.01
YourFreeWorld Classifieds Script - SQL Injection
SQL injection vulnerability in view.php in YourFreeWorld Classifieds Script allows remote attackers to execute arbitrary SQL commands via the category parameter.
CWE-89 Aug 21, 2008 STIX 2.1
CVE-2008-3756 1 PoC Analysis EPSS 0.01
YourFreeWorld Viral Marketing Script - SQL Injection
SQL injection vulnerability in tr.php in YourFreeWorld Viral Marketing Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CWE-89 Aug 21, 2008 STIX 2.1
CVE-2008-3757 1 PoC Analysis EPSS 0.01
YourFreeWorld Forced Matrix Script - SQL Injection
SQL injection vulnerability in tr1.php in YourFreeWorld Forced Matrix Script allows remote attackers to execute arbitrary SQL commands via the id parameter.
CWE-89 Aug 21, 2008 STIX 2.1
CVE-2008-0175 1 PoC Analysis EPSS 0.35
GE Fanuc Proficy Real-Time Information Portal < 2.6 - Remote Code Execution via Unrestricted File Upload
Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory.
Jan 29, 2008 STIX 2.1
CVE-2008-6927 1 PoC Analysis EPSS 0.04
cPanel - Cross-Site Scripting via Fantastico De Luxe Module Parameters
Multiple cross-site scripting (XSS) vulnerabilities in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allow remote attackers to inject arbitrary web script or HTML via the (1) localapp, (2) updatedir, (3) scriptpath_show, (4) domain_show, (5) thispage, (6) thisapp, and (7) currentversion parameters in an Upgrade action.
CWE-79 Aug 10, 2009 STIX 2.1
CVE-2008-6926 1 PoC Analysis EPSS 0.06
Fantastico De Luxe Module for cPanel - Path Traversal and Arbitrary File Execution via scriptpath_show Parameter
Directory traversal vulnerability in autoinstall4imagesgalleryupgrade.php in the Fantastico De Luxe Module for cPanel allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the scriptpath_show parameter in a GoAhead action. NOTE: this issue only crosses privilege boundaries when security settings such as disable_functions and safe_mode are active, since exploitation requires uploading of executable code to a home directory.
CWE-22 Aug 10, 2009 STIX 2.1
CVE-2008-6867 1 PoC Analysis EPSS 0.00
Scripts For Sites EZ Career - SQL Injection via Topic Parameter
SQL injection vulnerability in content.php in Scripts For Sites (SFS) EZ Career allows remote attackers to execute arbitrary SQL commands via the topic parameter.
CWE-89 Jul 14, 2009 STIX 2.1
CVE-2008-6864 1 PoC Analysis EPSS 0.00
Absolute Live Support .NET 5.1 - Unauthenticated Authentication Bypass via Cookie Manipulation
Xigla Software Absolute Live Support .NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CWE-287 Jul 14, 2009 STIX 2.1
CVE-2008-6863 1 PoC Analysis EPSS 0.00
Xigla Absolute Form Processor .NET 4.0 - Unauthenticated Authentication Bypass via Cookie Manipulation
Xigla Software Absolute Form Processor .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CWE-287 Jul 14, 2009 STIX 2.1
CVE-2008-6862 1 PoC Analysis EPSS 0.00
Absolute Content Rotator 6.0 - Unauthenticated Authentication Bypass via Cookie Manipulation
Absolute Content Rotator 6.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CWE-287 Jul 14, 2009 STIX 2.1
CVE-2008-6861 1 PoC Analysis EPSS 0.00
Xigla Absolute Newsletter 6.0 and 6.1 - Unauthenticated Authentication Bypass via Cookie Manipulation
Xigla Software Absolute Newsletter 6.0 and 6.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CWE-287 Jul 14, 2009 STIX 2.1
CVE-2008-6859 1 PoC Analysis EPSS 0.00
Absolute Control Panel XE 1.5 - Unauthenticated Authentication Bypass via Cookie Manipulation
Xigla Software Absolute Control Panel XE 1.5 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CWE-287 Jul 14, 2009 STIX 2.1
CVE-2008-6858 1 PoC Analysis EPSS 0.00
Absolute Banner Manager .NET 4.0 - Unauthenticated Authentication Bypass via Cookie Manipulation
Absolute Banner Manager .NET 4.0 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CWE-287 Jul 14, 2009 STIX 2.1
CVE-2008-6856 1 PoC Analysis EPSS 0.00
Absolute News Manager.NET 5.1 - Unauthenticated Authentication Bypass via Cookie Manipulation
Xigla Software Absolute News Manager.NET 5.1 allows remote attackers to bypass authentication and gain administrative access by setting a cookie to a certain value.
CWE-287 Jul 14, 2009 STIX 2.1

Investigate

Critical + Public Exploits Exploited in Wild + PoC High EPSS (>=0.7) + PoC With Nuclei Templates Latest CVEs with Public Exploits

Ecosystems

Linux Maven Packagist PyPI npm Go ecosystem RubyGems crates.io NuGet Hex SwiftURL GitHub Actions

Reference Indexes

Exploit Database Researchers Vendors CWE Categories

Recent Blog Posts

CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp
May 17, 2026
Hermes Agent with EIP Harness: The Vulnerability Research Assistant That Also Runs Your Pipelines
May 13, 2026
CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
May 01, 2026
EIP STIX 2.1 / TAXII 2.1 Feed: Exploit Intelligence for Your Stack
Apr 29, 2026
CVE-2026-35414: Three Bugs, One Commit, and Two More Nobody Mentioned
Apr 03, 2026
WP Google Map Plugin - Three Weak Links, One Critical Chain
Mar 29, 2026
 View all posts →

CVEForge Labs

CVE-2026-45829 CRITICAL
ChromaDB >=1.0.0 - Unauthenticated Remote Code Execution via Malicious Model Repository
CVE-2026-42859 HIGH
Neat VNC: Buffer overflow due to oversized RSA public keys
CVE-2026-3296 CRITICAL
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
CVE-2026-34980 HIGH
OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
CVE-2026-35414 MEDIUM
OpenSSH < 10.3 - Always-Incorrect Control Flow Implementation in Authorized Keys Principals Handling
CVE-2026-33765 CRITICAL
Pi-hole Web Interface has a Command Injection Vulnerability
CVE-2026-4105 MEDIUM
Red Hat Enterprise Linux 10 - Improper Access Control via systemd-machined RegisterMachine D-Bus Method
CVE-2026-30861 CRITICAL
WeKnora 0.2.5-0.2.9 - Unauthenticated Remote Code Execution via MCP stdio Configuration Validation Bypass
CVE-2026-30860 CRITICAL
WeKnora <0.2.12 - RCE via SQL Injection
CVE-2026-28391 CRITICAL
OpenClaw <2026.2.2 - Command Injection
 View all labs →

KEV Gaps

CVE-2026-45498
Microsoft Defender Denial of Service Vulnerability
 CVE-2009-1537
Microsoft DirectX 7.0-9.0c - Remote Code Execution via QuickTime Movie Parser Filter
 CVE-2026-6973
Ivanti Endpoint Manager Mobile < 12.6.1.1, < 12.7.0.1, < 12.8.0.1 - Authenticated Remote Code Execution
 CVE-2025-29635
D-Link DIR-823X 240126 and 240802 - Authenticated Remote Command Execution via /goform/set_prohibiting
 CVE-2024-57728
SimpleHelp < 5.5.8 - Authenticated Path Traversal and Arbitrary File Write via Zip Slip
 CVE-2024-57726
SimpleHelp < 5.5.8 - Missing Authorization for API Key Creation
 CVE-2026-20133
Cisco Catalyst SD-WAN Manager - Info Disclosure
 CVE-2026-20128
Cisco Catalyst SD-WAN Manager - Privilege Escalation
 CVE-2026-20122
Cisco Catalyst SD-WAN Manager - Path Traversal
 CVE-2025-32975
Quest KACE SMA <14.1.101 - Auth Bypass
 CVE-2025-48700
Zimbra Collaboration Suite 8.8.15, 9.0, 10.0-10.1 - Stored Cross-Site Scripting via Crafted Email HTML Content
 CVE-2025-2749
Kentico Xperience < 13.0.178 - Authenticated Remote Code Execution via Staging Sync Server File Upload