Latest Vulnerabilities with Public Exploits

Updated 4h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

371,364 CVEs tracked 55,318 with exploits 5,151 exploited in wild 1,656 CISA KEV 4,275 Nuclei templates 56,393 vendors 49,532 researchers
55,318 results Clear all
CVE-2005-1196 1 PoC Analysis EPSS 0.02
phpBB Knowledge Base module - SQL Injection via cat Parameter
SQL injection vulnerability in kb.php in the Knowledge Base module for phpBB allows remote attackers to obtain sensitive information and execute SQL commands via the cat parameter.
May 02, 2005 STIX 2.1
CVE-2005-1134 1 PoC Analysis EPSS 0.02
Serendipity <= 0.8 - SQL Injection via url_id or entry_id Parameters
SQL injection vulnerability in exit.php for Serendipity 0.8 and earlier allows remote attackers to execute arbitrary SQL commands via the (1) url_id or (2) entry_id parameters.
Apr 13, 2005 STIX 2.1
CVE-2005-0553 1 PoC Analysis EPSS 0.51
Microsoft Internet Explorer <6 - Code Injection
Race condition in the memory management routines in the DHTML object processor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a malicious web page or HTML e-mail, aka "DHTML Object Memory Corruption Vulnerability".
May 02, 2005 STIX 2.1
CVE-2005-0554 1 PoC Analysis EPSS 0.58
Microsoft Internet Explorer 5.01, 5.5, 6 - Buffer Overflow via Long Hostname URL
Buffer overflow in the URL processor of Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a URL with a long hostname, aka "URL Parsing Memory Corruption Vulnerability."
May 02, 2005 STIX 2.1
CVE-2005-1105 1 PoC Analysis EPSS 0.06
JavaMail 1.3.2 - Directory Traversal and Arbitrary File Write via Content-Disposition Filename
Directory traversal vulnerability in the MimeBodyPart.getFileName method in JavaMail 1.3.2 allows remote attackers to write arbitrary files via a .. (dot dot) in the filename in the Content-Disposition header.
May 02, 2005 STIX 2.1
CVE-2005-1188 1 PoC Analysis EPSS 0.04
Comersus Cart 3.90-4.51 - Cross-Site Scripting via curPage Parameter
Cross-site scripting (XSS) vulnerability in comersus_searchItem.asp in Comersus 3.90 to 4.51 allows remote attackers to inject arbitrary web script or HTML via the curPage parameter.
May 02, 2005 STIX 2.1
CVE-2005-0555 1 PoC Analysis EPSS 0.58
Microsoft Internet Explorer 5.01, 5.5, 6 - Remote Code Execution via Crafted Content Advisor File
Buffer overflow in the Content Advisor in Microsoft Internet Explorer 5.01, 5.5, and 6 allows remote attackers to execute arbitrary code via a crafted Content Advisor file, aka "Content Advisor Memory Corruption Vulnerability."
Apr 12, 2005 STIX 2.1
CVE-2005-1077 1 PoC Analysis EPSS 0.02
XAMPP 1.4.x - Cross-Site Scripting via cds.php, Guestbook-EN.pl, or phonebook.php
Multiple cross-site scripting (XSS) vulnerabilities in XAMPP 1.4.x allow remote attackers to inject arbitrary web script or HTML via (1) cds.php, (2) Guestbook-EN.pl, or (3) phonebook.php.
Apr 12, 2005 STIX 2.1
CVE-2005-1078 1 PoC Analysis EPSS 0.05
XAMPP 1.4.x - Default Credential Vulnerability
XAMPP 1.4.x has multiple default or null passwords, which allows attackers to gain privileges.
Apr 12, 2005 STIX 2.1
CVE-2005-1130 1 PoC Analysis EPSS 0.02
Pinnacle Cart - Cross-Site Scripting via index.php pg Parameter
Cross-site scripting (XSS) vulnerability in index.php in Pinnacle Cart allows remote attackers to inject arbitrary web script or HTML via the pg parameter.
Apr 12, 2005 STIX 2.1
CVE-2005-0404 1 PoC Analysis EPSS 0.03
KMail 1.7.1 in KDE 3.3.2 - Email Spoofing via HTML Formatted Email
KMail 1.7.1 in KDE 3.3.2 allows remote attackers to spoof email information, such as whether the email has been digitally signed or encrypted, via HTML formatted email.
May 02, 2005 STIX 2.1
CVE-2005-1051 1 PoC Analysis EPSS 0.02
PunBB 1.2.4 - Authenticated SQL Injection via Profile ID Parameter
SQL injection vulnerability in profile.php in PunBB 1.2.4 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a change_email action.
May 02, 2005 STIX 2.1
CVE-2005-1053 2 PoCs Analysis EPSS 0.04
ModernBill < 4.3.0 - Cross-Site Scripting via orderwiz.php c_code or aid Parameters
Multiple cross-site scripting (XSS) vulnerabilities in orderwiz.php in ModernBill 4.3.0 and earlier allow remote attackers to inject arbitrary web script or HTML via the (1) c_code or (2) aid parameters.
May 02, 2005 STIX 2.1
CVE-2005-1076 1 PoC Analysis EPSS 0.01
WebCT Campus Edition 4.1 - Stored Cross-Site Scripting via Discussion Board Message Field
Cross-site scripting (XSS) vulnerability in the discussion board functionality for WebCT Campus Edition 4.1 allows remote attackers to inject arbitrary web script or HTML via the message field.
May 02, 2005 STIX 2.1
CVE-2005-1079 1 PoC Analysis EPSS 0.01
zOOm Media Gallery 2.1.2 - SQL Injection
SQL injection vulnerability in index.php for zOOm Media Gallery 2.1.2 allows remote attackers to execute arbitrary SQL commands via the catid parameter.
May 02, 2005 STIX 2.1
CVE-2005-1071 1 PoC Analysis EPSS 0.01
JPortal Web Portal 2.3.1 - SQL Injection
SQL injection vulnerability in banner.inc.php in JPortal Web Portal 2.3.1 allows remote attackers to execute arbitrary SQL commands via the haslo parameter.
Apr 12, 2005 STIX 2.1
CVE-2005-1070 1 PoC Analysis EPSS 0.01
Invision Power Board <1.3.1 - SQL Injection
SQL injection vulnerability in index.php in Invision Power Board 1.3.1 Final and earlier allows remote attackers to execute arbitrary SQL commands via the st parameter.
Apr 11, 2005 STIX 2.1
CVE-2005-1054 1 PoC Analysis EPSS 0.04
ModernBill < 4.3.0 - Remote File Inclusion via DIR Parameter
PHP remote file inclusion vulnerability in news.php in ModernBill 4.3.0 and earlier allows remote attackers to execute arbitrary PHP code by modifying the DIR parameter to reference a URL on a remote web server that contains the code.
May 02, 2005 STIX 2.1
CVE-2005-1073 1 PoC Analysis EPSS 0.08
RadScripts RadBids Gold 2 - Path Traversal
Directory traversal vulnerability in index.php for RadScripts RadBids Gold 2 allows remote attackers to read arbitrary files via the read parameter.
May 02, 2005 STIX 2.1
CVE-2005-1074 1 PoC Analysis EPSS 0.01
RadScripts RadBids Gold 2 - SQL Injection
SQL injection vulnerability in index.php for RadScripts RadBids Gold 2 allows remote attackers to execute arbitrary SQL commands via the mode parameter.
May 02, 2005 STIX 2.1

Investigate

Critical + Public Exploits Exploited in Wild + PoC High EPSS (>=0.7) + PoC With Nuclei Templates Latest CVEs with Public Exploits

Ecosystems

Linux Maven Packagist PyPI npm Go ecosystem RubyGems crates.io NuGet Hex SwiftURL GitHub Actions

Reference Indexes

Exploit Database Researchers Vendors CWE Categories

Recent Blog Posts

CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp
May 17, 2026
Hermes Agent with EIP Harness: The Vulnerability Research Assistant That Also Runs Your Pipelines
May 13, 2026
CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
May 01, 2026
EIP STIX 2.1 / TAXII 2.1 Feed: Exploit Intelligence for Your Stack
Apr 29, 2026
CVE-2026-35414: Three Bugs, One Commit, and Two More Nobody Mentioned
Apr 03, 2026
WP Google Map Plugin - Three Weak Links, One Critical Chain
Mar 29, 2026
 View all posts →

CVEForge Labs

CVE-2026-45829 CRITICAL
ChromaDB >=1.0.0 - Unauthenticated Remote Code Execution via Malicious Model Repository
CVE-2026-42859 HIGH
Neat VNC: Buffer overflow due to oversized RSA public keys
CVE-2026-3296 CRITICAL
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
CVE-2026-34980 HIGH
OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
CVE-2026-35414 MEDIUM
OpenSSH < 10.3 - Always-Incorrect Control Flow Implementation in Authorized Keys Principals Handling
CVE-2026-33765 CRITICAL
Pi-hole Web <6.0 savesettings.php - Command Injection
CVE-2026-4105 MEDIUM
Red Hat Enterprise Linux 10 - Improper Access Control via systemd-machined RegisterMachine D-Bus Method
CVE-2026-30861 CRITICAL
WeKnora 0.2.5-0.2.9 - Unauthenticated Remote Code Execution via MCP stdio Configuration Validation Bypass
CVE-2026-30860 CRITICAL
WeKnora <0.2.12 - RCE via SQL Injection
CVE-2026-28391 CRITICAL
OpenClaw <2026.2.2 - Command Injection
 View all labs →

KEV Gaps

CVE-2026-20316
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
 CVE-2026-16812
VeloCloud Orchestrator OS Command Injection
 CVE-2025-68686
Fortinet FortiOS <7.6.1 - Info Disclosure
 CVE-2021-27137
Dd-wrt < 45724 - Stack-based Buffer Overflow
 CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
 CVE-2023-4346
KNX Connection Authorization - Device Lockout Denial of Service
 CVE-2026-56155
Microsoft Windows 10 Version 1607 - Active Directory Federation Services Elevation of Privilege Vulnerability
 CVE-2026-12569
PTC Windchill PDMLink and FlexPLM - Deserialization Remote Code Execution
 CVE-2026-34910
Ubiquiti INC UniFi OS Server - Improper Input Validation
 CVE-2026-34909
Ubiquiti INC UniFi OS Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CVE-2026-48027
Compromised Nx Console version 18.95.0
 CVE-2026-8398
DAEMON Tools Lite 12.5.0.2421-12.5.0.2434 - Embedded Malicious Code in Trojanized Installer