The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-128333: knadh listmonk: listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP…7.4 High9.1 CriticalN/ANov 13, 2026
CVE-2026-128332: knadh listmonk: Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to…7.4 High9.1 CriticalN/ANov 13, 2026
CVE-2026-128330: miniflux: Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2026-128329: dokploy: Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to…7.7 High8.3 HighN/ANov 13, 2026
CVE-2026-128328: dokploy: Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to…5.0 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-128242: actix: actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128241: libexpat project libexpat: The xmlwf tool in libexpat through 2.10.0 contains a symlink following vulnerability because -d output mode opens files…4.4 Medium4.1 MediumN/ANov 13, 2026
CVE-2026-128240: gpac: GPAC through 26.07.0 contains a use-after-free vulnerability in gf_sg_proto_del() in src/scenegraph/vrml_proto.c…5.5 Medium6.8 MediumN/ANov 13, 2026
CVE-2026-128239: gpac: GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers…5.5 Medium6.8 MediumN/ANov 13, 2026
CVE-2026-128238: secdev scapy: Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128237: secdev scapy: Scapy before 2.8.0 contains a denial of service vulnerability in BER_num_dec() and BERcodec_OID.do_dec() that allows…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128053: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a reflected cross-site scripting…4.7 Medium2.3 LowN/ANov 13, 2026
CVE-2026-128052: OpenMage magento-lts: OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization…2.7 Low5.1 MediumN/ANov 13, 2026
CVE-2026-128049: OpenMage magento-lts: OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery…9.0 Critical9.4 CriticalN/ANov 13, 2026
CVE-2026-128048: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted…4.9 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128047: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-128045: OpenMage magento-lts: OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128044: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a…7.7 High8.7 HighN/ANov 13, 2026
CVE-2026-128043: OpenMage magento-lts: OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery…3.1 Low2.3 LowN/ANov 13, 2026
CVE-2026-128041: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type…8.0 High8.8 HighN/ANov 13, 2026
CVE-2026-128040: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting…6.1 Medium8.4 HighN/ANov 13, 2026
CVE-2026-128033: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-128031: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization…3.8 Low5.1 MediumN/ANov 13, 2026
CVE-2026-128030: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration…5.9 Medium7.4 HighN/ANov 13, 2026
CVE-2026-128029: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting…4.7 Medium2.3 LowN/ANov 13, 2026
226-250 of 532044