The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119238: Lenovo XiangBangbang Application: A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local…3.3 Low4.8 MediumN/ANov 11, 2026
CVE-2026-119237: Facebook proxygen: In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been…N/AN/AN/ANov 11, 2026
CVE-2026-119236: Facebook mvfst: An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS…N/AN/AN/ANov 11, 2026
CVE-2026-119235: Facebook proxygen: proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the…N/AN/AN/ANov 11, 2026
CVE-2026-119234: Facebook mvfst: mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a…N/AN/AN/ANov 11, 2026
CVE-2026-119233: Facebook proxygen: proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or…N/AN/AN/ANov 11, 2026
CVE-2026-116633: Lenovo: A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an…7.1 High6.9 MediumN/ANov 11, 2026
CVE-2026-110697: Red Hat: A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled…9.9 CriticalN/AN/ANov 11, 2026
CVE-2026-64855: hitoshyamamoto soapbar: soapbar is a SOAP library for Python — client, server, and WSDL handling8.2 HighN/AN/ANov 11, 2026
CVE-2026-124686: Progress Software Kendo UI for jQuery: In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-115819: The GNU C Library glibc: Calling the wide scanf family of functions (swscanf, fwscanf, wscanf, vswscanf, vfwscanf and vwscanf) with a %s or %[…4.8 MediumN/AN/ANov 11, 2026
CVE-2026-105440: Extreme Networks Switch Engine (EXOS): Missing authorization in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an…6.5 Medium8.3 HighN/ANov 11, 2026
CVE-2026-100290: The GNU C Library glibc: The regcomp and regexec functions in the GNU C Library version 2.3 to version 2.44 may read freed memory and free the…3.7 LowN/AN/ANov 11, 2026
CVE-2026-89326: Apache Software Foundation Apache XML Graphics Batik: Origin Validation Error vulnerability in Apache XML Graphics Batik: the external resource same-origin check does not…N/AN/AN/ANov 11, 2026
CVE-2026-85632: Sipay Electronic Money and Payment Services Inc. WooCommerce Virtual POS Module: Missing authentication for critical function and Improper validation of integrity check value vulnerability in Sipay…9.1 CriticalN/AN/ANov 11, 2026
CVE-2026-82014: Grafana: Any authenticated user, including a Viewer, could change the preferences of any team, such as its home dashboard, theme…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-71395: Apache Software Foundation Apache XML Graphics FOP: unsafe deserialization in hyphenation loading vulnerability in Apache XML Graphics FOPN/AN/AN/ANov 11, 2026
CVE-2026-44929: Apache Software Foundation Apache XML Graphics Batik: Server-Side Request Forgery (SSRF) vulnerability in Apache XML Graphics BatikN/AN/AN/ANov 11, 2026
CVE-2026-14242: Grafana: A user with the Editor role could delete, move, push or pull Git Sync managed resources in folders where they only had…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-13721: Grafana: A user with edit access to one folder could modify, move or delete Git Sync provisioned resources in folders where they…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-126325: PTC: A critical remote code execution (RCE) vulnerability has been reported in PTC Windchill and PTC FlexPLM9.0 Critical9.2 CriticalN/ANov 11, 2026
CVE-2026-123710: Red Hat: A flaw was found in Red Hat Quay9.8 CriticalN/AN/ANov 11, 2026
CVE-2026-119618: Apache Software Foundation Apache HTTP Server: Concurrent Execution using Shared Resource with Improper Synchronization vulnerability in Apache HTTP Server's…N/AN/AN/ANov 11, 2026
CVE-2026-111024: Grafana: A user with the Viewer or Editor role could bypass folder permissions on Git Sync managed resources through the…7.1 HighN/AN/ANov 11, 2026
CVE-2026-111000: Grafana: A user with the Editor role who can edit a folder can move it, through the folders resource API, under a folder they…7.1 HighN/AN/ANov 11, 2026
226-250 of 511254