Latest Vulnerabilities with Public Exploits

Updated 4h ago

Search and track vulnerabilities with real-time exploit intelligence. Cross-reference CVEs against public exploits from ExploitDB, Metasploit, GitHub, and Nuclei — with CVSS and EPSS scoring, CISA KEV monitoring, and AI-powered exploit analysis.

375,578 CVEs tracked 55,632 with exploits 5,186 exploited in wild 1,665 CISA KEV 4,314 Nuclei templates 56,763 vendors 50,350 researchers
55,632 results Clear all
WordPress Plugin Menu Creator 1.1.7 - SQL Injection
STIX 2.1
Code Widgets DataBound Collapsible Menu - 'main.asp' SQL Injection
STIX 2.1
Code Widgets DataBound Index Style Menu - 'category.asp' SQL Injection
STIX 2.1
Code Widgets Multiple Question - Multiple Choice Online Questionnaire SQL Injections
STIX 2.1
Code Widgets Online Job Application - 'admin.asp' Multiple SQL Injections
STIX 2.1
Contrexx ShopSystem 2.2 SP3 - 'catId' Blind SQL Injection
STIX 2.1
Joomla! Component JoomTouch 1.0.2 - Local File Inclusion
STIX 2.1
phpWebSite - 'page_id' Cross-Site Scripting
STIX 2.1
SoftwareDEP Classified Script 2.5 - SQL Injection (1)
STIX 2.1
WordPress Plugin Contus HD FLV Player 1.3 - SQL Injection
STIX 2.1
WordPress Plugin Easy Contact Form Lite 1.0.7 - SQL Injection
STIX 2.1
WordPress Plugin Fast Secure Contact Form 3.0.3.1 - 'index.php' Cross-Site Scripting
STIX 2.1
WordPress Plugin File Groups 1.1.2 - SQL Injection
STIX 2.1
WordPress Plugin OdiHost NewsLetter 1.0 - SQL Injection
STIX 2.1
WordPress Plugin Symposium 0.64 - SQL Injection
STIX 2.1
WordPress Plugin WP-Stats-Dashboard 2.6.5.1 - Multiple Cross-Site Scripting Vulnerabilities
STIX 2.1
Notepad++ NppFTP Plugin - 'LIST' Remote Heap Overflow (PoC)
STIX 2.1
StudioLine Photo Basic 3.70.34.0 - 'NMSDVDXU.dll' ActiveX Control Arbitrary File Overwrite
STIX 2.1
SurgeFTP 23b6 - Multiple Cross-Site Scripting Vulnerabilities
STIX 2.1
Sagem Router Fast 3304/3464/3504 - Telnet Authentication Bypass
STIX 2.1

Investigate

Critical + Public Exploits Exploited in Wild + PoC High EPSS (>=0.7) + PoC With Nuclei Templates Latest CVEs with Public Exploits

Ecosystems

Linux Maven Packagist PyPI npm Go ecosystem RubyGems crates.io NuGet Hex SwiftURL GitHub Actions

Reference Indexes

Exploit Database Researchers Vendors CWE Categories

Recent Blog Posts

CVE-2026-41702: Forty-Seven Microseconds in /var/run/vmware/cnx-tmp
May 17, 2026
Hermes Agent with EIP Harness: The Vulnerability Research Assistant That Also Runs Your Pipelines
May 13, 2026
CVE-2026-41940: cPanel & WHM Pre-Auth RCE - Two Write Paths, One Filter
May 01, 2026
EIP STIX 2.1 / TAXII 2.1 Feed: Exploit Intelligence for Your Stack
Apr 29, 2026
CVE-2026-35414: Three Bugs, One Commit, and Two More Nobody Mentioned
Apr 03, 2026
WP Google Map Plugin - Three Weak Links, One Critical Chain
Mar 29, 2026
 View all posts →

CVEForge Labs

CVE-2026-67285 CRITICAL
Joomla Extension - joomshaper.com - Unauthenticated arbitrary local PHP file inclusion in SP Page Builder < 6.8.0
CVE-2026-66914 CRITICAL
Joomla Extension - seblod.com - Unauthenticated path traversal in SEBLOD < 3.30.0, < 4.7.0, < 6.0.1
CVE-2026-43631 HIGH
llama.cpp b7492–b9060 Use-After-Free RCE via llama-server
CVE-2026-54159 CRITICAL
PrestaShop ps_facetedsearch < 4.0.4 - Unauthenticated PHP Object Injection
CVE-2026-44181 CRITICAL
Jupyter Enterprise Gateway: Jinja2 Template Server Side Template Injection results in Remote Code Execution
CVE-2026-46339 CRITICAL
9Router: Unauthenticated Remote Code Execution via unprotected MCP custom plugin routes
CVE-2026-62242 HIGH
Spring Boot Admin Server < 4.1.2 SSRF via Unauthenticated Instance Registration
CVE-2026-53488 HIGH
containerd CRI plugin: — image-config `LABEL` flows to restart-monitor `binary://` logger: host-root command execution from an image pull
CVE-2026-45829 CRITICAL
ChromaDB >=1.0.0 - Unauthenticated Remote Code Execution via Malicious Model Repository
CVE-2026-42859 HIGH
Neat VNC: Buffer overflow due to oversized RSA public keys
 View all labs →

KEV Gaps

CVE-2026-20349
Cisco Secure Firewall Adaptive Security Appliance and Secure Firewall Threat Defense Software Remote Access SSL VPN Denial of Service Vulnerability
 CVE-2026-20316
Cisco Secure Firewall Management Center Software Static Credential Vulnerability
 CVE-2026-16812
VeloCloud Orchestrator OS Command Injection
 CVE-2025-68686
Fortinet FortiOS <7.6.1 - Info Disclosure
 CVE-2021-27137
Dd-wrt < 45724 - Stack-based Buffer Overflow
 CVE-2023-4346
KNX Connection Authorization - Device Lockout Denial of Service
 CVE-2026-56155
Microsoft Windows 10 Version 1607 - Active Directory Federation Services Elevation of Privilege Vulnerability
 CVE-2026-12569
PTC Windchill PDMLink and FlexPLM - Deserialization Remote Code Execution
 CVE-2026-34909
Ubiquiti INC UniFi OS Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
 CVE-2026-48027
Compromised Nx Console version 18.95.0
 CVE-2026-8398
DAEMON Tools Lite 12.5.0.2421-12.5.0.2434 - Embedded Malicious Code in Trojanized Installer
 CVE-2009-1537
Microsoft DirectX 7.0-9.0c - Remote Code Execution via QuickTime Movie Parser Filter