Latest Vulnerabilities with Public Exploits

Updated 21m ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

351,424 CVEs tracked 54,118 with exploits 4,976 exploited in wild 1,599 CISA KEV 4,128 Nuclei templates 54,385 vendors 46,649 researchers
54,118 results Clear all
CVE-2006-4906 1 PoC Analysis EPSS 0.01
More.groupware 0.74 - SQL Injection
SQL injection vulnerability in modules/calendar/week.php in More.groupware 0.74 allows remote attackers to execute arbitrary SQL commands via the new_calendarid parameter.
Sep 21, 2006 STIX 2.1
CVE-2006-4968 1 PoC Analysis EPSS 0.08
PNphpBB 1.2g - RCE
PHP remote file inclusion vulnerability in includes/functions_admin.php in PNphpBB 1.2g allows remote attackers to execute arbitrary PHP code via a URL in the phpbb_root_path parameter.
Sep 25, 2006 STIX 2.1
CVE-2006-4917 1 PoC Analysis EPSS 0.02
PT News 1.7.8 - XSS
Cross-site scripting (XSS) vulnerability in search.php in PT News 1.7.8 allows remote attackers to inject arbitrary web script or HTML via the pgname parameter.
Sep 21, 2006 STIX 2.1
CVE-2006-4913 1 PoC Analysis EPSS 0.06
AlstraSoft E-friends 4.85 - Path Traversal
Directory traversal vulnerability in chat/getStartOptions.php in AlstraSoft E-friends 4.85 allows remote attackers to include arbitrary local files and possibly execute arbitrary code via a .. (dot dot) sequence and trailing null (%00) byte in the lang parameter, as demonstrated by injecting PHP code into a log file.
Sep 21, 2006 STIX 2.1
CVE-2006-4894 1 PoC Analysis EPSS 0.01
iDevSpot NixieAffiliate <1.9 - XSS
Cross-site scripting (XSS) vulnerability in forms/lostpassword.php in iDevSpot NixieAffiliate 1.9 and earlier allows remote attackers to inject arbitrary web script or HTML via the error parameter.
Sep 19, 2006 STIX 2.1
CVE-2006-4871 1 PoC Analysis EPSS 0.01
EShoppingPro 1.0 - SQL Injection
SQL injection vulnerability in search_run.asp in Keyvan1 (aka Keyvan Janghorbani) EShoppingPro 1.0 allows remote attackers to execute arbitrary SQL commands via the order parameter.
Sep 19, 2006 STIX 2.1
CVE-2006-4872 1 PoC Analysis EPSS 0.01
ECardPro 2.0 - SQL Injection
SQL injection vulnerability in search.asp in Keyvan1 (aka Keyvan Janghorbani) ECardPro 2.0 allows remote attackers to execute arbitrary SQL commands via the keyword parameter.
Sep 19, 2006 STIX 2.1
CVE-2006-4973 1 PoC Analysis EPSS 0.01
DotNetNuke <3.3.5-4.3.5 - XSS
Cross-site scripting (XSS) vulnerability in Default.aspx in Perpetual Motion Interactive Systems DotNetNuke before 3.3.5, and 4.x before 4.3.5, allows remote attackers to inject arbitrary HTML via the error parameter.
Sep 25, 2006 STIX 2.1
CVE-2006-4891 1 PoC Analysis EPSS 0.02
Techno Dreams Articles & Papers Package <2.0 - SQL Injection
SQL injection vulnerability in ArticlesTableview.asp in Techno Dreams Articles & Papers Package 2.0 and earlier allows remote attackers to execute arbitrary SQL commands via the key parameter.
Sep 19, 2006 STIX 2.1
CVE-2006-4892 1 PoC Analysis EPSS 0.02
Techno Dreams FAQ Manager Package 1.0 - SQL Injection
SQL injection vulnerability in faqview.asp in Techno Dreams FAQ Manager Package 1.0 allows remote attackers to execute arbitrary SQL commands via the key parameter.
Sep 19, 2006 STIX 2.1
CVE-2006-4897 1 PoC Analysis EPSS 0.06
CMtextS <1.0 - Info Disclosure
CMtextS 1.0 and earlier stores users_logins/admin.txt under the web document root with insufficient access control, which allows remote attackers to obtain the administrator password.
Sep 19, 2006 STIX 2.1
CVE-2006-4882 1 PoC Analysis EPSS 0.01
Julian Roberts Charon Cart 3 - SQL Injection
SQL injection vulnerability in Review.asp in Julian Roberts Charon Cart 3 allows remote attackers to execute arbitrary SQL commands via the ProductID parameter.
Sep 19, 2006 STIX 2.1
CVE-2006-4849 1 PoC Analysis EPSS 0.11
MobilePublisherPHP <1.5 RC2 - RCE
PHP remote file inclusion vulnerability in header.php in MobilePublisherPHP 1.5 RC2 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the abspath parameter.
Sep 19, 2006 STIX 2.1
CVE-2006-4852 1 PoC Analysis EPSS 0.02
QuadComm Q-Shop <3.5 - SQL Injection
SQL injection vulnerability in browse.asp in QuadComm Q-Shop 3.5 allows remote attackers to execute arbitrary SQL commands via the OrderBy parameter.
Sep 19, 2006 STIX 2.1
CVE-2006-4612 2 PoCs Analysis EPSS 0.01
ZIXForum 1.12 - SQL Injection
SQL injection vulnerability in ReplyNew.asp in ZIXForum 1.12 allows remote attackers to execute arbitrary SQL commands via the RepId parameter.
Sep 07, 2006 STIX 2.1
CVE-2006-5254 1 PoC Analysis EPSS 0.05
Mark Van Bellen Detailed User Registration <4.1 - RCE
PHP remote file inclusion vulnerability in registration_detailed.inc.php in Mark Van Bellen Detailed User Registration (com_registration_detailed), aka regdetailed, 4.1 and earlier allows remote attackers to execute arbitrary PHP code via a URL in the mosConfig_absolute_path parameter.
Oct 12, 2006 STIX 2.1
CVE-2006-4977 1 PoC Analysis EPSS 0.14
Walter Beschmout PhpQuiz <1.2 - Unrestricted File Upload
Multiple unrestricted file upload vulnerabilities in (1) back/upload_img.php and (2) admin/upload_img.php in Walter Beschmout PhpQuiz 1.2 and earlier allow remote attackers to upload arbitrary PHP code to the phpquiz/img_quiz folder via the (a) upload, (b) ok_update, (c) image, and (d) path parameters, possibly requiring directory traversal sequences in the path parameter.
Sep 25, 2006 STIX 2.1
CVE-2006-4978 1 PoC Analysis EPSS 0.03
Walter Beschmout PhpQuiz <1.2 - SQL Injection
Multiple SQL injection vulnerabilities in Walter Beschmout PhpQuiz 1.2 and earlier allow remote attackers to execute arbitrary SQL commands via (1) the univers parameter in score.php and (2) the quiz_id parameter in home.php, accessed through the front/ URI.
Sep 25, 2006 STIX 2.1
CVE-2006-4979 1 PoC Analysis EPSS 0.14
Walter Beschmout PhpQuiz <1.2 - Code Injection
Direct static code injection vulnerability in cfgphpquiz/install.php in Walter Beschmout PhpQuiz 1.2 and earlier allows remote attackers to inject arbitrary PHP code in config.inc.php via modified configuration settings.
Sep 25, 2006 STIX 2.1
CVE-2006-4890 1 PoC Analysis EPSS 0.09
UNAK-CMS <1.5 - RCE
Multiple PHP remote file inclusion vulnerabilities in UNAK-CMS 1.5 and earlier allow remote attackers to execute arbitrary PHP code via a URL in the dirroot parameter to (1) fckeditor/editor/filemanager/browser/default/connectors/php/connector.php or (2) fckeditor/editor/dialog/fck_link.php.
Sep 19, 2006 STIX 2.1

Investigate

Critical + Public Exploits Exploited in Wild + PoC High EPSS (>=0.7) + PoC With Nuclei Templates Latest CVEs with Public Exploits

Ecosystems

Linux Maven Packagist PyPI npm Go ecosystem RubyGems crates.io NuGet Hex SwiftURL GitHub Actions

Reference Indexes

Exploit Database Researchers Vendors CWE Categories

Recent Blog Posts

CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp
May 17, 2026
Hermes Agent with EIP Harness: The Vulnerability Research Assistant That Also Runs Your Pipelines
May 13, 2026
CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
May 01, 2026
EIP STIX 2.1 / TAXII 2.1 Feed: Exploit Intelligence for Your Stack
Apr 29, 2026
CVE-2026-35414: Three Bugs, One Commit, and Two More Nobody Mentioned
Apr 03, 2026
WP Google Map Plugin - Three Weak Links, One Critical Chain
Mar 29, 2026
 View all posts →

CVEForge Labs

CVE-2026-45829 CRITICAL
ChromaDB - Improper Control of Generation of Code ('Code Injection')
CVE-2026-42859 HIGH
Neat VNC: Buffer overflow due to oversized RSA public keys
CVE-2026-3296 CRITICAL
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
CVE-2026-34980 HIGH
OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
CVE-2026-35414 MEDIUM
OpenSSH <10.3 - Auth Bypass
CVE-2026-33765 CRITICAL
Pi-hole Web Interface has a Command Injection Vulnerability
CVE-2026-4105 MEDIUM
systemd - Privilege Escalation
CVE-2026-30861 CRITICAL
WeKnora 0.2.5-0.2.10 - RCE
CVE-2026-30860 CRITICAL
WeKnora <0.2.12 - RCE via SQL Injection
CVE-2026-28391 CRITICAL
OpenClaw <2026.2.2 - Command Injection
 View all labs →

KEV Gaps

CVE-2026-45498
Microsoft Defender Denial of Service Vulnerability
 CVE-2026-41091
Microsoft Defender Elevation of Privilege Vulnerability
 CVE-2009-1537
Microsoft DirectX <9.0c - RCE
 CVE-2026-6973
Ivanti Endpoint Manager Mobile - Improper Input Validation
 CVE-2025-29635
Dlink Dir-823x Firmware - Command Injection
 CVE-2024-57728
Simple-help Simplehelp < 5.5.8 - Symlink Following
 CVE-2024-57726
Simple-help Simplehelp < 5.5.8 - Missing Authorization
 CVE-2026-20133
Cisco Catalyst SD-WAN Manager - Info Disclosure
 CVE-2026-20128
Cisco Catalyst SD-WAN Manager - Privilege Escalation
 CVE-2026-20122
Cisco Catalyst SD-WAN Manager - Path Traversal
 CVE-2025-32975
Quest KACE SMA <14.1.101 - Auth Bypass
 CVE-2025-48700
Zimbra Collaboration <10.1 - XSS