Latest Vulnerabilities with Public Exploits

Updated 3h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

368,760 CVEs tracked 55,204 with exploits 5,124 exploited in wild 1,653 CISA KEV 4,251 Nuclei templates 56,180 vendors 49,153 researchers
55,204 results Clear all
CVE-2008-3669 1 PoC Analysis EPSS 0.01
ZeeScripts Reviews Opinions Rating Posting Engine Web-Site PHP Script - SQL Injection via ItemID Parameter
SQL injection vulnerability in comments.php in ZeeScripts Reviews Opinions Rating Posting Engine Web-Site PHP Script (aka ZeeReviews) allows remote attackers to execute arbitrary SQL commands via the ItemID parameter.
CWE-89 Aug 13, 2008 STIX 2.1
CVE-2008-3670 1 PoC Analysis EPSS 0.01
Article Friendly Pro - SQL Injection
SQL injection vulnerability in authordetail.php in Article Friendly Pro allows remote attackers to execute arbitrary SQL commands via the autid parameter.
CWE-89 Aug 13, 2008 STIX 2.1
CVE-2008-3673 1 PoC Analysis EPSS 0.01
PozScripts Classified Ads - SQL Injection
SQL injection vulnerability in browsecats.php in PozScripts Classified Ads allows remote attackers to execute arbitrary SQL commands via the cid parameter, a different vector than CVE-2008-3672.
CWE-89 Aug 13, 2008 STIX 2.1
CVE-2008-3674 1 PoC Analysis EPSS 0.01
PozScripts TubeGuru - SQL Injection
SQL injection vulnerability in ugroups.php in PozScripts TubeGuru Video Sharing Script allows remote attackers to execute arbitrary SQL commands via the UID parameter.
CWE-89 Aug 13, 2008 STIX 2.1
CVE-2008-3649 1 PoC Analysis EPSS 0.01
Article Friendly Standard - SQL Injection
SQL injection vulnerability in categorydetail.php in Article Friendly Standard allows remote attackers to execute arbitrary SQL commands via the Cat parameter.
CWE-89 Aug 13, 2008 STIX 2.1
CVE-2008-3452 1 PoC Analysis EPSS 0.01
eNdonesia Calendar module - SQL Injection via loc_id Parameter
SQL injection vulnerability in the Calendar module in eNdonesia 8.4 allows remote attackers to execute arbitrary SQL commands via the loc_id parameter in a list_events action to mod.php.
CWE-89 Aug 04, 2008 STIX 2.1
CVE-2008-3454 1 PoC Analysis EPSS 0.03
JnSHosts PHP Hosting Directory 2.0 - Auth Bypass
JnSHosts PHP Hosting Directory 2.0 allows remote attackers to bypass authentication and gain administrative access by setting the "adm" cookie value to 1.
CWE-264 Aug 04, 2008 STIX 2.1
CVE-2008-3409 1 PoC Analysis EPSS 0.11
Unreal Tournament 3 <1.3beta4 - Buffer Overflow
Buffer overflow in Unreal Tournament 3 1.3beta4 and earlier allows remote attackers to cause a denial of service (memory corruption and daemon crash) or possibly execute arbitrary code via a UDP packet containing a large value in a certain size field, followed by a data string of that size, aka attack 1 in ut3mendo.c.
CWE-119 Jul 31, 2008 STIX 2.1
CVE-2008-3396 1 PoC Analysis EPSS 0.08
Unreal Tournament 2004 <= 3369 - Denial of Service via Malformed Packet Sequence
Unreal Tournament 2004 (UT2004) 3369 and earlier allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a certain sequence of malformed packets.
CWE-20 Jul 31, 2008 STIX 2.1
CVE-2008-3401 1 PoC Analysis EPSS 0.03
HIOX Random Ad 1.3 - Remote Code Execution via hm Parameter
PHP remote file inclusion vulnerability in hioxRandomAd.php in HIOX Random Ad (HRA) 1.3 allows remote attackers to execute arbitrary PHP code via a URL in the hm parameter.
CWE-94 Jul 31, 2008 STIX 2.1
CVE-2008-3402 1 PoC Analysis EPSS 0.03
HIOX Browser Statistics 2.0 - Remote Code Execution via hm Parameter
Multiple PHP remote file inclusion vulnerabilities in HIOX Browser Statistics (HBS) 2.0 allow remote attackers to execute arbitrary PHP code via a URL in the hm parameter to (1) hioxupdate.php and (2) hioxstats.php.
CWE-94 Jul 31, 2008 STIX 2.1
CVE-2008-3404 1 PoC Analysis EPSS 0.02
MJGuest 6.8 GT - Cross-Site Scripting via Link Parameter
Cross-site scripting (XSS) vulnerability in guestbook.js.php in MJGuest 6.8 GT allows remote attackers to inject arbitrary web script or HTML via the link parameter.
CWE-79 Jul 31, 2008 STIX 2.1
CVE-2008-3405 1 PoC Analysis EPSS 0.02
nzFotolog 0.4.1 - Path Traversal via Action File Parameter
Directory traversal vulnerability in index.php in Ricardo Amaral nzFotolog 0.4.1 allows remote attackers to include and execute arbitrary local files via directory traversal sequences in the action_file parameter.
CWE-22 Jul 31, 2008 STIX 2.1
CVE-2008-3455 1 PoC Analysis EPSS 0.04
JnSHosts PHP Hosting Directory 2.0 - RCE
PHP remote file inclusion vulnerability in include/admin.php in JnSHosts PHP Hosting Directory 2.0 allows remote attackers to execute arbitrary PHP code via a URL in the rd parameter.
CWE-94 Aug 04, 2008 STIX 2.1
CVE-2008-3430 1 PoC Analysis EPSS 0.06
CoVideoWindow.ocx 5.0.907.1 - Buffer Overflow
Buffer overflow in the CoVideoWindow.ocx ActiveX control 5.0.907.1 in Eyeball MessengerSDK, as used in products such as SiOL Komunikator 1.3, allows remote attackers to execute arbitrary code via a large argument supplied to the BGColor method. NOTE: this might only be a vulnerability in certain insecure configurations of Internet Explorer.
CWE-119 Jul 31, 2008 STIX 2.1
CVE-2008-3390 1 PoC Analysis EPSS 0.02
Minishowcase Image Gallery <09b136 - Path Traversal
Directory traversal vulnerability in libraries/general.init.php in Minishowcase Image Gallery 09b136, when register_globals is enabled, allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the lang parameter.
CWE-22 Jul 31, 2008 STIX 2.1
CVE-2008-3374 1 PoC Analysis EPSS 0.02
Gregarius < 0.5.4 - SQL Injection via rsargs Array Parameter
SQL injection vulnerability in ajax.php in Gregarius 0.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the rsargs array parameter in an __exp__getFeedContent action.
CWE-89 Jul 30, 2008 STIX 2.1
CVE-2008-7084 1 PoC Analysis EPSS 0.03
Velocity Security Management System - Path Traversal via URI
Directory traversal vulnerability in the web server 1.0 in Velocity Security Management System allows remote attackers to read arbitrary files via a .. (dot dot) in the URI.
CWE-22 Aug 26, 2009 STIX 2.1
CVE-2008-3419 1 PoC Analysis EPSS 0.01
Youtuber Clone - SQL Injection via UID Parameter
SQL injection vulnerability in ugroups.php in Youtuber Clone allows remote attackers to execute arbitrary SQL commands via the UID parameter.
CWE-89 Jul 31, 2008 STIX 2.1
CVE-2008-3391 2 PoCs Analysis EPSS 0.02
Web Wiz Forum 9.5 - Cross-Site Scripting via Mode Parameter
Multiple cross-site scripting (XSS) vulnerabilities in Web Wiz Forum 9.5 allow remote attackers to inject arbitrary web script or HTML via the mode parameter to (1) admin_group_details.asp and (2) admin_category_details.asp.
CWE-79 Jul 31, 2008 STIX 2.1

Investigate

Critical + Public Exploits Exploited in Wild + PoC High EPSS (>=0.7) + PoC With Nuclei Templates Latest CVEs with Public Exploits

Ecosystems

Linux Maven Packagist PyPI npm Go ecosystem RubyGems crates.io NuGet Hex SwiftURL GitHub Actions

Reference Indexes

Exploit Database Researchers Vendors CWE Categories

Recent Blog Posts

CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp
May 17, 2026
Hermes Agent with EIP Harness: The Vulnerability Research Assistant That Also Runs Your Pipelines
May 13, 2026
CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
May 01, 2026
EIP STIX 2.1 / TAXII 2.1 Feed: Exploit Intelligence for Your Stack
Apr 29, 2026
CVE-2026-35414: Three Bugs, One Commit, and Two More Nobody Mentioned
Apr 03, 2026
WP Google Map Plugin - Three Weak Links, One Critical Chain
Mar 29, 2026
 View all posts →

CVEForge Labs

CVE-2026-45829 CRITICAL
ChromaDB >=1.0.0 - Unauthenticated Remote Code Execution via Malicious Model Repository
CVE-2026-42859 HIGH
Neat VNC: Buffer overflow due to oversized RSA public keys
CVE-2026-3296 CRITICAL
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
CVE-2026-34980 HIGH
OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
CVE-2026-35414 MEDIUM
OpenSSH < 10.3 - Always-Incorrect Control Flow Implementation in Authorized Keys Principals Handling
CVE-2026-33765 CRITICAL
Pi-hole Web <6.0 savesettings.php - Command Injection
CVE-2026-4105 MEDIUM
Red Hat Enterprise Linux 10 - Improper Access Control via systemd-machined RegisterMachine D-Bus Method
CVE-2026-30861 CRITICAL
WeKnora 0.2.5-0.2.9 - Unauthenticated Remote Code Execution via MCP stdio Configuration Validation Bypass
CVE-2026-30860 CRITICAL
WeKnora <0.2.12 - RCE via SQL Injection
CVE-2026-28391 CRITICAL
OpenClaw <2026.2.2 - Command Injection
 View all labs →

KEV Gaps

CVE-2021-27137
Dd-wrt < 45724 - Stack-based Buffer Overflow
 CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
 CVE-2023-4346
KNX Connection Authorization - Device Lockout Denial of Service
 CVE-2026-56155
Microsoft Windows 10 Version 1607 - Active Directory Federation Services Elevation of Privilege Vulnerability
 CVE-2026-12569
PTC Windchill PDMLink and FlexPLM - Deserialization Remote Code Execution
 CVE-2026-34910
Ubiquiti INC UniFi OS Server - Improper Input Validation
 CVE-2026-34909
Ubiquiti INC UniFi OS Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CVE-2026-48027
Compromised Nx Console version 18.95.0
 CVE-2026-8398
DAEMON Tools Lite 12.5.0.2421-12.5.0.2434 - Embedded Malicious Code in Trojanized Installer
 CVE-2009-1537
Microsoft DirectX 7.0-9.0c - Remote Code Execution via QuickTime Movie Parser Filter
 CVE-2026-6973
Ivanti Endpoint Manager Mobile < 12.6.1.1, < 12.7.0.1, < 12.8.0.1 - Authenticated Remote Code Execution
 CVE-2025-29635
D-Link DIR-823X 240126 and 240802 - Authenticated Remote Command Execution via /goform/set_prohibiting