The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-122673: Wpmet ShopEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wpmet ShopEngine…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-112205: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Bruteforce Protection Bypass in the login functionalityN/A6.9 MediumN/ANov 9, 2026
CVE-2026-112204: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Reflected XSS in the /index.php endpointN/A5.1 MediumN/ANov 9, 2026
CVE-2026-110469: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/upload.php endpointN/A10.0 CriticalN/ANov 9, 2026
CVE-2026-110468: Fundacja Widzialni WidzialniCMS: WidzialniCMS is vulnerable to Unrestricted File Upload in the /panel/controllers/save_photo.php endpointN/A10.0 CriticalN/ANov 9, 2026
CVE-2026-124684: Samsung Open Source Escargot: Use after free vulnerability in Samsung Open Source Escargot allows Pointer Manipulation5.1 MediumN/AN/ANov 9, 2026
CVE-2026-121629: Red Hat: A flaw was found in GStreamer's adaptive streaming demuxers (HLS, DASH, MSS)7.5 HighN/AN/ANov 9, 2026
CVE-2026-118468: CompuGroup Medical: XML parsers process attacker-influenced update manifests or network responses with external entity resolution enabled,…N/A7.2 HighN/ANov 9, 2026
CVE-2026-118467: CompuGroup Medical: Shared telemetry and logging components store or transmit patient and doctor identifiers, clinical information, and…N/A4.3 MediumN/ANov 9, 2026
CVE-2026-118465: CompuGroup Medical: Shared components expose hard-coded Access, workgroup, CCBasic, DBISAM, and related database credentials that are…N/A5.8 MediumN/ANov 9, 2026
CVE-2026-118464: CompuGroup Medical: Shared cryptographic services use fixed vendor-wide secrets, deterministic IVs, null salts, and reversible…N/A5.8 MediumN/ANov 9, 2026
CVE-2026-118462: CompuGroup Medical: Update components download and execute code without proper authenticity verification, relying on ignored hashes or…N/A9.2 CriticalN/ANov 9, 2026
CVE-2026-118461: CompuGroup Medical: The shared client accepts caller-controlled doctor identifiers for read and write operations without requiring…N/A8.0 HighN/ANov 9, 2026
CVE-2026-118460: CompuGroup Medical: Embedded private keys protected by a shared password can be used to sign practitioner assertions for arbitrary…N/A8.0 HighN/ANov 9, 2026
CVE-2026-118459: CompuGroup Medical: A time-derived emergency password can be derived from publicly available application code, enabling authentication…N/A6.3 MediumN/ANov 9, 2026
CVE-2026-118458: CompuGroup Medical: The shared AIS login routing selects a production-shipped test DAO and plaintext comparison for the H and V application…N/A8.1 HighN/ANov 9, 2026
CVE-2026-118450: CompuGroup Medical Venere: Venere is installed outside Program Files and loads/registers unsigned components from locations where an unprivileged…N/A5.9 MediumN/ANov 9, 2026
CVE-2026-112172: CompuGroup Medical: CGM XDent and XMedical expose PHP synchronization endpoints that allow unauthenticated attackers to manipulate session…N/A8.1 HighN/ANov 9, 2026
CVE-2026-94434: TÜBİTAK BİLGEM Software Technologies Research Institute Pardus Boot Repair: Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in TÜBİTAK…8.8 HighN/AN/ANov 9, 2026
CVE-2026-120854: iubenda: Allocation of Resources Without Limits or Throttling vulnerability in iubenda iubenda iubenda-cookie-law-solution…7.5 HighN/AN/ANov 9, 2026
CVE-2026-120856: Rymera Web Co Invoice Gateway for WooCommerce – Invoice Payment Gateway: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rymera Web Co…7.1 HighN/AN/ANov 9, 2026
CVE-2026-118798: CompuGroup Medical Wingesfar: Multiple sensitive authentication data, including credentials, OAuth-related secrets, session information, and…N/A4.4 MediumN/ANov 9, 2026
CVE-2026-118795: CompuGroup Medical: Administrative roles and module permissions are stored in mutable local database fields, allowing privilege escalation…N/A5.9 MediumN/ANov 9, 2026
CVE-2026-124621: kongxin-github Java_Library_Management_System: A vulnerability was determined in kongxin-github Java_Library_Management_System up to…7.4 High2.1 LowN/ANov 9, 2026
CVE-2026-124591: n/a Bahleel: A vulnerability was detected in Bahleel 0.1.0/0.1.15.5 Medium5.1 MediumN/ANov 9, 2026
226-250 of 427771
‹›