The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126387: n8n-io n8n: n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126386: n8n-io n8n: n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect…4.7 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126385: n8n-io n8n: n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the…7.7 High4.8 MediumN/ANov 13, 2026
CVE-2026-126384: n8n-io n8n: n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 bundles a GraphicsMagick version…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-126383: n8n-io n8n: n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection…8.2 High5.3 MediumN/ANov 13, 2026
CVE-2026-126382: n8n-io n8n: n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that…5.4 Medium6.3 MediumN/ANov 13, 2026
CVE-2026-126381: n8n-io n8n: n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector…6.3 Medium4.9 MediumN/ANov 13, 2026
CVE-2026-126380: givanz Vvveb: Vvveb before 1.0.9.0 contains a denylist bypass in system/traits/media.php where '.phar' is misconfigured with a…9.1 Critical9.4 CriticalN/ANov 13, 2026
CVE-2026-126379: givanz Vvveb: Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass…7.6 High8.3 HighN/ANov 13, 2026
CVE-2026-126378: givanz Vvveb: Vvveb through 1.0.8.6 contains a file upload vulnerability in the theme installer validFile() function that uses…9.1 Critical9.4 CriticalN/ANov 13, 2026
CVE-2026-126377: givanz Vvveb: Vvveb before 1.0.9.0 contains an authentication bypass vulnerability in generateCookie() in system/user/user.php that…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-126376: givanz Vvveb: Vvveb 1.0.8.4 through 1.0.8.6 contains an incomplete authorization fix that allows low-privilege authors and vendors to…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126375: givanz Vvveb: Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename,…8.1 High7.2 HighN/ANov 13, 2026
CVE-2026-126374: givanz Vvveb: Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126373: givanz Vvveb: Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126372: givanz Vvveb: Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126371: givanz Vvveb: Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126370: givanz Vvveb: Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126369: givanz Vvveb: Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126323: givanz Vvveb: Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126322: openemr: OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126321: Finsys dockhand: Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to…8.3 High7.2 HighN/ANov 13, 2026
CVE-2026-126320: Finsys dockhand: Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126319: Finsys dockhand: Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126318: redaxo core: REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the…4.3 Medium5.3 MediumN/ANov 13, 2026
226-250 of 428292