The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-126566: SemanticMediaWiki: Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in…7.1 High7.1 HighN/ANov 11, 2026
CVE-2026-126565: SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126564: SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126563: SemanticMediaWiki: Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in…6.1 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126562: SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126561: SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the…7.1 High7.1 HighN/ANov 11, 2026
CVE-2026-126560: SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126559: SemanticMediaWiki: Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in…4.8 Medium4.8 MediumN/ANov 11, 2026
CVE-2026-116645: LimeSurvey LimeSurvey Community Edition: LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and…N/A7.1 HighN/ANov 11, 2026
CVE-2026-126546: Rakuten Viber Viber for iOS: Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126545: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126544: WWBN AVideo: WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126543: WWBN AVideo: WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that…7.5 High8.7 HighN/ANov 11, 2026
CVE-2026-126542: WWBN AVideo: WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to…9.8 Critical9.3 CriticalN/ANov 11, 2026
CVE-2026-126541: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows…8.1 High8.6 HighN/ANov 11, 2026
CVE-2026-126539: directus: Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip…8.1 High9.2 CriticalN/ANov 11, 2026
CVE-2026-126499: jellyfin: Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST…7.4 High8.3 HighN/ANov 11, 2026
CVE-2026-126498: Musing Studio WriteFreely: WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126497: LibreCAD: LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw…7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-126496: 1Panel-dev CordysCRM: 1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126495: emqx MQTTX: MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject…6.1 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126188: rails: Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record…3.7 LowN/AN/ANov 11, 2026
CVE-2026-20183: Cisco Cisco Identity Services Engine Software: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an…4.3 MediumN/AN/ANov 10, 2026
CVE-2026-126261: Fortinet FortiManager: A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager…9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-126187: react: React is a JavaScript library for building user interfacesN/A9.5 CriticalN/ANov 10, 2026
251-275 of 511254