Latest Vulnerabilities with Public Exploits

Updated 11m ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

372,637 CVEs tracked 55,489 with exploits 5,167 exploited in wild 1,661 CISA KEV 4,282 Nuclei templates 56,504 vendors 49,927 researchers
55,489 results Clear all
Online News Portal 1.0 - 'Multiple' Stored Cross-Site Scripting
STIX 2.1
Online News Portal 1.0 - 'name' SQL Injection
STIX 2.1
Profiling System for Human Resource Management 1.0 - Remote Code Execution (Unauthenticated)
STIX 2.1
Eclipse Mosquitto MQTT broker 2.0.9 - 'mosquitto' Unquoted Service Path
STIX 2.1
rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated) (1)
STIX 2.1
Alphaware E-Commerce System 1.0 - Unauthenicated Remote Code Execution (File Upload + SQL injection)
STIX 2.1
Sonlogger 4.2.3.3 - SuperAdmin Account Creation / Information Disclosure
STIX 2.1
rConfig 3.9.6 - 'path' Local File Inclusion (Authenticated)
STIX 2.1
QNAP QVR Client 5.0.0.13230 - 'QVRService' Unquoted Service Path
STIX 2.1
Monitoring System (Dashboard) 1.0 - 'uname' SQL Injection
STIX 2.1
Monitoring System (Dashboard) 1.0 - File Upload RCE (Authenticated)
STIX 2.1
MyBB OUGC Feedback Plugin 1.8.22 - Cross-Site Scripting
STIX 2.1
GLPI 9.5.3 - 'fromtype' Unsafe Reflection
STIX 2.1
Hotel and Lodge Management System 1.0 - Remote Code Execution (Unauthenticated)
STIX 2.1
Web Based Quiz System 1.0 - 'eid' Union Based Sql Injection (Authenticated)
STIX 2.1
Local Services Search Engine Management System (LSSMES) 1.0 - 'name' Persistent Cross-Site Scripting (XSS)
STIX 2.1
Local Services Search Engine Management System (LSSMES) 1.0 - Blind & Error based SQL injection (Authenticated)
STIX 2.1
Covid-19 Contact Tracing System 1.0 - Remote Code Execution (Unauthenticated)
STIX 2.1
Online Catering Reservation System 1.0 - Remote Code Execution (Unauthenticated)
STIX 2.1
Remote Desktop Web Access - Authentication Timing Attack (Metasploit Module)
STIX 2.1

Investigate

Critical + Public Exploits Exploited in Wild + PoC High EPSS (>=0.7) + PoC With Nuclei Templates Latest CVEs with Public Exploits

Ecosystems

Linux Maven Packagist PyPI npm Go ecosystem RubyGems crates.io NuGet Hex SwiftURL GitHub Actions

Reference Indexes

Exploit Database Researchers Vendors CWE Categories

Recent Blog Posts

CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp
May 17, 2026
Hermes Agent with EIP Harness: The Vulnerability Research Assistant That Also Runs Your Pipelines
May 13, 2026
CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
May 01, 2026
EIP STIX 2.1 / TAXII 2.1 Feed: Exploit Intelligence for Your Stack
Apr 29, 2026
CVE-2026-35414: Three Bugs, One Commit, and Two More Nobody Mentioned
Apr 03, 2026
WP Google Map Plugin - Three Weak Links, One Critical Chain
Mar 29, 2026
 View all posts →

CVEForge Labs

CVE-2026-45829 CRITICAL
ChromaDB >=1.0.0 - Unauthenticated Remote Code Execution via Malicious Model Repository
CVE-2026-42859 HIGH
Neat VNC: Buffer overflow due to oversized RSA public keys
CVE-2026-3296 CRITICAL
Everest Forms <= 3.4.3 - Unauthenticated PHP Object Injection via Form Entry Metadata
CVE-2026-34980 HIGH
OpenPrinting CUPS: Shared PostScript queue lets anonymous Print-Job requests reach `lp` code execution over the network
CVE-2026-35414 MEDIUM
OpenSSH < 10.3 - Always-Incorrect Control Flow Implementation in Authorized Keys Principals Handling
CVE-2026-33765 CRITICAL
Pi-hole Web <6.0 savesettings.php - Command Injection
CVE-2026-4105 MEDIUM
Red Hat Enterprise Linux 10 - Improper Access Control via systemd-machined RegisterMachine D-Bus Method
CVE-2026-30861 CRITICAL
WeKnora 0.2.5-0.2.9 - Unauthenticated Remote Code Execution via MCP stdio Configuration Validation Bypass
CVE-2026-30860 CRITICAL
WeKnora <0.2.12 - RCE via SQL Injection
CVE-2026-28391 CRITICAL
OpenClaw <2026.2.2 - Command Injection
 View all labs →

KEV Gaps

CVE-2026-20316
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
 CVE-2026-16812
VeloCloud Orchestrator OS Command Injection
 CVE-2025-68686
Fortinet FortiOS <7.6.1 - Info Disclosure
 CVE-2021-27137
Dd-wrt < 45724 - Stack-based Buffer Overflow
 CVE-2026-58644
Microsoft SharePoint Remote Code Execution Vulnerability
 CVE-2023-4346
KNX Connection Authorization - Device Lockout Denial of Service
 CVE-2026-56155
Microsoft Windows 10 Version 1607 - Active Directory Federation Services Elevation of Privilege Vulnerability
 CVE-2026-12569
PTC Windchill PDMLink and FlexPLM - Deserialization Remote Code Execution
 CVE-2026-34910
Ubiquiti INC UniFi OS Server - Improper Input Validation
 CVE-2026-34909
Ubiquiti INC UniFi OS Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CVE-2026-48027
Compromised Nx Console version 18.95.0
 CVE-2026-8398
DAEMON Tools Lite 12.5.0.2421-12.5.0.2434 - Embedded Malicious Code in Trojanized Installer