Latest Vulnerabilities with Public Exploits

Updated 5h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

351,807 CVEs tracked 54,180 with exploits 4,984 exploited in wild 1,602 CISA KEV 4,130 Nuclei templates 54,492 vendors 46,756 researchers
54,180 results Clear all
CVE-2008-1872 1 PoC Analysis EPSS 0.01
Comdev News Publisher 4.1.2 - SQL Injection
SQL injection vulnerability in home.news.php in Comdev News Publisher 4.1.2 allows remote attackers to execute arbitrary SQL commands via the arcmonth parameter. NOTE: some of these details are obtained from third party information.
CWE-89 Apr 17, 2008 STIX 2.1
CVE-2008-1873 1 PoC Analysis EPSS 0.00
NukeET 3.2 and 3.4 - Authenticated Cross-Site Scripting via Private Message STYLE Attribute
Cross-site scripting (XSS) vulnerability in the private message feature in Nuke ET 3.2 and 3.4, when using Internet Explorer, allows remote authenticated users to inject arbitrary web script or HTML via a CSS property in the STYLE attribute of a DIV element in the mensaje parameter. NOTE: some of these details are obtained from third party information.
CWE-79 Apr 17, 2008 STIX 2.1
CVE-2008-1874 1 PoC Analysis EPSS 0.00
xpoze_pro < 3.05 - Authenticated SQL Injection via reed Parameter
SQL injection vulnerability in account/user/mail.html in Xpoze Pro 3.05 and earlier allows remote authenticated users to execute arbitrary SQL commands via the reed parameter.
CWE-89 Apr 17, 2008 STIX 2.1
CVE-2008-1875 1 PoC Analysis EPSS 0.01
Terong PHP Photo Gallery 1.0 - SQL Injection
SQL injection vulnerability in index.php in Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 allows remote attackers to execute arbitrary SQL commands via the photo_id parameter.
CWE-89 Apr 17, 2008 STIX 2.1
CVE-2008-1854 1 PoC Analysis EPSS 0.03
SmarterMail 5.0.2999 - Denial of Service via Long HTTP Request
Unspecified vulnerability in SmarterMail Web Server (SMWebSvr.exe) in SmarterMail 5.0.2999 allows remote attackers to cause a denial of service (service termination) via a long HTTP (1) GET, (2) HEAD, (3) PUT, (4) POST, or (5) TRACE request. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
Apr 16, 2008 STIX 2.1
CVE-2008-1787 1 PoC Analysis EPSS 0.00
Poplar Gedcom Viewer 2.0 - Cross-Site Scripting via Text and UL Parameters
Multiple cross-site scripting (XSS) vulnerabilities in index.php in Poplar Gedcom Viewer 2.0 allow remote attackers to inject arbitrary web script or HTML via the (1) text and (2) ul parameters. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CWE-79 Apr 15, 2008 STIX 2.1
CVE-2008-1798 1 PoC Analysis EPSS 0.04
Dragoon 0.1 - Path Traversal via cal[lng] Parameter
Directory traversal vulnerability in forum/kietu/libs/calendrier.php in Dragoon 0.1 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the cal[lng] parameter.
CWE-22 Apr 15, 2008 STIX 2.1
CVE-2008-1799 1 PoC Analysis EPSS 0.04
sabros.us 1.75 - Path Traversal via thumbnails.php img Parameter
Directory traversal vulnerability in thumbnails.php in sabros.us 1.75 allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter.
CWE-22 Apr 15, 2008 STIX 2.1
CVE-2008-1757 1 PoC Analysis EPSS 0.00
KwsPHP 1.0 - Cross-Site Scripting via ConcoursPhoto VIEW Parameter
Cross-site scripting (XSS) vulnerability in index.php in the ConcoursPhoto module for KwsPHP 1.0 allows remote attackers to inject arbitrary web script or HTML via the VIEW parameter.
CWE-79 Apr 12, 2008 STIX 2.1
CVE-2008-1760 1 PoC Analysis EPSS 0.06
blogator-script < 1.00 - Remote Code Execution via incl_page Parameter
Multiple PHP remote file inclusion vulnerabilities in Blogator-script before 1.01 allow remote attackers to execute arbitrary PHP code via a URL in the incl_page parameter in (1) struct_admin.php, (2) struct_admin_blog.php, and (3) struct_main.php in _blogadata/include.
CWE-94 Apr 12, 2008 STIX 2.1
CVE-2008-1763 1 PoC Analysis EPSS 0.01
Blogator-script 0.95 - SQL Injection
SQL injection vulnerability in _blogadata/include/sond_result.php in Blogator-script 0.95 allows remote attackers to execute arbitrary SQL commands via the id_art parameter.
CWE-89 Apr 12, 2008 STIX 2.1
CVE-2008-1711 1 PoC Analysis EPSS 0.05
Terong PHP Photo Gallery 1.0 - Info Disclosure
Terong PHP Photo Gallery (aka Advanced Web Photo Gallery) 1.0 stores passwords in cleartext in a MySQL database, which allows context-dependent attackers to obtain sensitive information.
CWE-310 Apr 09, 2008 STIX 2.1
CVE-2008-0310 1 PoC Analysis EPSS 0.00
SCO UnixWare 7.1.4 - Local Path Traversal via PKGINST Environment Variable
Directory traversal vulnerability in pkgadd in SCO UnixWare 7.1.4 before p534589 allows local users to create or append to arbitrary files via ".." sequences in an unspecified environment variable, probably PKGINST.
CWE-22 Apr 07, 2008 STIX 2.1
CVE-2008-1343 1 PoC Analysis EPSS 0.00
SCO UnixWare 7.1.4 - Path Traversal
Directory traversal vulnerability in (1) pkgadd and (2) pkgrm in SCO UnixWare 7.1.4 allows local users to gain privileges via unknown vectors.
CWE-22 Mar 17, 2008 STIX 2.1
CVE-2008-6519 1 PoC Analysis EPSS 0.10
Xitami 2.2a-2.5c2 - Remote Code Execution via Format String in LRWP Request
Format string vulnerability in Xitami Web Server 2.2a through 2.5c2, and possibly other versions, allows remote attackers to cause a denial of service (daemon crash) and possibly execute arbitrary code via format string specifiers in a Long Running Web Process (LRWP) request, which triggers incorrect logging code involving the sendfmt function in the SMT kernel.
CWE-134 Mar 25, 2009 STIX 2.1
CVE-2008-6479 1 PoC Analysis EPSS 0.02
Parallels Virtuozzo 25.4.swsoft - Cross-Site Request Forgery in VZPP Password Change
Cross-site request forgery (CSRF) vulnerability in the "change password" feature in the VZPP web interface for Parallels Virtuozzo 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to modify the password via a link or IMG tag to vz/cp/pwd.
CWE-352 Mar 16, 2009 STIX 2.1
CVE-2008-6478 1 PoC Analysis EPSS 0.02
Parallels Virtuozzo Containers - Cross-Site Request Forgery in VZPP File Manager
Cross-site request forgery (CSRF) vulnerability in the file manager in the VZPP web interface for Parallels Virtuozzo 365.6.swsoft (build 4.0.0-365.6.swsoft) and 25.4.swsoft (build 3.0.0-25.4.swsoft) allows remote attackers to create and delete arbitrary files as the administrator via a link or IMG tag to (1) create-file and (2) list-control in vz/cp/vzdir/infrman/envs/files/; or modify system configuration via the path parameter to vz/cp/vzdir/infrman/envs/files/index.
CWE-352 Mar 16, 2009 STIX 2.1
CVE-2008-6211 7 PoCs Analysis EPSS 0.00
mcgallery 1.1 - Cross-Site Scripting via lang Parameter
Multiple cross-site scripting (XSS) vulnerabilities in PhpForums.net mcGallery 1.1 allow remote attackers to inject arbitrary web script or HTML via the lang parameter to (1) admin.php, (2) index.php, (3) sess.php, (4) stats.php, (5) detail.php, (6) resize.php, and (7) show.php. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.
CWE-79 Feb 20, 2009 STIX 2.1
CVE-2008-6197 1 PoC Analysis EPSS 0.00
KwsPHP galerie_module - SQL Injection via id_gal Parameter
SQL injection vulnerability in index.php in the galerie module for KwsPHP 1.3.456 allows remote attackers to execute arbitrary SQL commands via the id_gal parameter in a gal action.
CWE-89 Feb 20, 2009 STIX 2.1
CVE-2008-4777 1 PoC Analysis EPSS 0.00
Joomlearn LMS (com_lms) - SQL Injection via cat Parameter
SQL injection vulnerability in the Showroom Joomlearn LMS (com_lms) component for Joomla! and Mambo allows remote attackers to execute arbitrary SQL commands via the cat parameter in a showTests task.
CWE-89 Oct 29, 2008 STIX 2.1

Investigate

Critical + Public Exploits Exploited in Wild + PoC High EPSS (>=0.7) + PoC With Nuclei Templates Latest CVEs with Public Exploits

Ecosystems

Linux Maven Packagist PyPI npm Go ecosystem RubyGems crates.io NuGet Hex SwiftURL GitHub Actions

Reference Indexes

Exploit Database Researchers Vendors CWE Categories

Recent Blog Posts

CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp
May 17, 2026
Hermes Agent with EIP Harness: The Vulnerability Research Assistant That Also Runs Your Pipelines
May 13, 2026
CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
May 01, 2026
EIP STIX 2.1 / TAXII 2.1 Feed: Exploit Intelligence for Your Stack
Apr 29, 2026
CVE-2026-35414: Three Bugs, One Commit, and Two More Nobody Mentioned
Apr 03, 2026
WP Google Map Plugin - Three Weak Links, One Critical Chain
Mar 29, 2026
 View all posts →

CVEForge Labs

CVE-2026-45829 CRITICAL
ChromaDB >=1.0.0 - Unauthenticated Remote Code Execution via Malicious Model Repository
CVE-2026-42859 HIGH
Neat VNC: Buffer overflow due to oversized RSA public keys
CVE-2026-3296 CRITICAL
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
CVE-2026-34980 HIGH
OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
CVE-2026-35414 MEDIUM
OpenSSH < 10.3 - Always-Incorrect Control Flow Implementation in Authorized Keys Principals Handling
CVE-2026-33765 CRITICAL
Pi-hole Web Interface has a Command Injection Vulnerability
CVE-2026-4105 MEDIUM
Red Hat Enterprise Linux 10 - Improper Access Control via systemd-machined RegisterMachine D-Bus Method
CVE-2026-30861 CRITICAL
WeKnora 0.2.5-0.2.9 - Unauthenticated Remote Code Execution via MCP stdio Configuration Validation Bypass
CVE-2026-30860 CRITICAL
WeKnora <0.2.12 - RCE via SQL Injection
CVE-2026-28391 CRITICAL
OpenClaw <2026.2.2 - Command Injection
 View all labs →

KEV Gaps

CVE-2026-45498
Microsoft Defender Denial of Service Vulnerability
 CVE-2009-1537
Microsoft DirectX 7.0-9.0c - Remote Code Execution via QuickTime Movie Parser Filter
 CVE-2026-6973
Ivanti Endpoint Manager Mobile < 12.6.1.1, < 12.7.0.1, < 12.8.0.1 - Authenticated Remote Code Execution
 CVE-2025-29635
D-Link DIR-823X 240126 and 240802 - Authenticated Remote Command Execution via /goform/set_prohibiting
 CVE-2024-57728
SimpleHelp < 5.5.8 - Authenticated Path Traversal and Arbitrary File Write via Zip Slip
 CVE-2024-57726
SimpleHelp < 5.5.8 - Missing Authorization for API Key Creation
 CVE-2026-20133
Cisco Catalyst SD-WAN Manager - Info Disclosure
 CVE-2026-20128
Cisco Catalyst SD-WAN Manager - Privilege Escalation
 CVE-2026-20122
Cisco Catalyst SD-WAN Manager - Path Traversal
 CVE-2025-32975
Quest KACE SMA <14.1.101 - Auth Bypass
 CVE-2025-48700
Zimbra Collaboration Suite 8.8.15, 9.0, 10.0-10.1 - Stored Cross-Site Scripting via Crafted Email HTML Content
 CVE-2025-2749
Kentico Xperience < 13.0.178 - Authenticated Remote Code Execution via Staging Sync Server File Upload