The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121405: FreeRDP: FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-89295: Eclipse Foundation Eclipse Mnestix: In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the…N/AN/AN/ANov 3, 2026
CVE-2026-85035: zephyrproject zephyr: The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in…8.8 HighN/AN/ANov 3, 2026
CVE-2026-85034: zephyrproject zephyr: The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or…6.7 MediumN/AN/ANov 3, 2026
CVE-2026-85033: zephyrproject zephyr: The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a…4.6 MediumN/AN/ANov 3, 2026
CVE-2026-85032: zephyrproject zephyr: The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system…4.8 MediumN/AN/ANov 3, 2026
CVE-2026-120572: Mozilla Firefox: Incorrect boundary conditions in the Layout: Block and Inline component8.8 HighN/AN/ANov 3, 2026
CVE-2026-119742: Nagios Enterprises, LLC Nagios XI: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-119179: MongoDB Node.js Driver: A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the…7.0 High8.3 HighN/ANov 3, 2026
CVE-2026-76124: BuddyBoss BuddyBoss App: The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…8.8 HighN/AN/ANov 3, 2026
CVE-2026-65160: NVIDIA: NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero5.5 MediumN/AN/ANov 3, 2026
CVE-2026-121458: CoreBunch Instatic: Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-108060: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108059: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108058: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108057: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108056: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108055: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108054: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108053: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108052: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108051: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108050: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108049: AM System ALO Suite: Clickjacking vulnerability in the Alosuite web applicationN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108048: AM System ALO Suite: Vulnerability due to a lack of request limits in Alosuite’s password recovery functionalityN/A6.9 MediumN/ANov 3, 2026
226-250 of 528356
‹›