The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-106020: Johnson Controls EasyIO Neo IO Manager and Tools Installer: Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and…N/A8.6 HighN/ANov 6, 2026
CVE-2026-106019: Johnson Controls: Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of…N/A8.8 HighN/ANov 6, 2026
CVE-2026-123675: OpenBMB Internet of Agents: A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a8.3 High5.5 MediumN/ANov 6, 2026
CVE-2026-123785: fluxbox: Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows…5.5 Medium6.8 MediumN/ANov 6, 2026
CVE-2026-123783: Skyvern-AI skyvern: Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by…8.8 High8.7 HighN/ANov 6, 2026
CVE-2026-123624: zhimaAi chatwiki: ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to…5.4 Medium5.3 MediumN/ANov 6, 2026
CVE-2026-123621: webmin usermin: Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote…8.8 High8.6 HighN/ANov 6, 2026
CVE-2026-123619: lektor: Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that…6.8 Medium5.9 MediumN/ANov 6, 2026
CVE-2026-123617: openwhyd: Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate…5.3 Medium6.9 MediumN/ANov 6, 2026
CVE-2026-123487: parse-community parse-server: Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular…7.5 High8.7 HighN/ANov 6, 2026
CVE-2026-123485: sgoudelis ground-station: Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as…6.5 Medium7.1 HighN/ANov 6, 2026
CVE-2026-53980: charmbracelet wish: Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that…8.1 High8.6 HighN/ANov 6, 2026
CVE-2026-119170: Python Software Foundation CPython: There was a regression in how FIPS algorithms were enforced for the hashlib moduleN/A8.2 HighN/ANov 6, 2026
CVE-2026-5345: HCL Software HCL AION: HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web…3.7 LowN/AN/ANov 6, 2026
CVE-2026-35113: HCL Software HCL AION: HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure,…4.8 MediumN/AN/ANov 6, 2026
CVE-2026-35112: HCL Software HCL AION: HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure,…4.2 MediumN/AN/ANov 6, 2026
CVE-2026-35111: HCL Software HCL AION: HCL AION is affected by a vulnerability where the Cross-Origin-Resource-Policy (CORP) header was missing or insecure,…4.8 MediumN/AN/ANov 6, 2026
CVE-2026-35110: HCL Software HCL AION: HCL AION is affected by a vulnerability where encrypted (HTTPS) communication was not enforced for all requests5.4 MediumN/AN/ANov 6, 2026
CVE-2026-35109: HCL Software HCL AION: HCL AION is affected by a vulnerability where pages served over HTTPS could be cached by the browser or intermediate…3.7 LowN/AN/ANov 6, 2026
CVE-2026-35107: HCL Software HCL AION: HCL AION is affected by an open redirect vulnerability in the user menu of the GenAI web interface (UserMenu component)4.7 MediumN/AN/ANov 6, 2026
CVE-2026-35106: HCL Software HCL AION: HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface…4.7 MediumN/AN/ANov 6, 2026
CVE-2026-35105: HCL Software HCL AION: HCL AION is affected by an open redirect vulnerability in the session-handling logic of the GenAI web interface…4.7 MediumN/AN/ANov 6, 2026
CVE-2026-35104: HCL Software HCL AION: HCL AION is affected by an open redirect vulnerability on the user registration page (Signup component)4.7 MediumN/AN/ANov 6, 2026
CVE-2026-35103: HCL Software HCL AION: HCL AION is affected by an open redirect vulnerability on the role assignment pending page (RoleAssignPending component)4.7 MediumN/AN/ANov 6, 2026
CVE-2026-35102: HCL Software HCL AION: HCL AION is affected by an open redirect vulnerability in the navigation bar of the GenAI web interface (Navbar…4.7 MediumN/AN/ANov 6, 2026
226-250 of 425038
‹›