The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-107241: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…7.6 HighN/AN/ANov 10, 2026
CVE-2026-107240: Versa VOS: The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the…7.6 HighN/AN/ANov 10, 2026
CVE-2026-125406: ettercap: Ettercap through 0.8.4.1 contains a stack buffer underwrite vulnerability in the telnet dissector in…8.8 High8.7 HighN/ANov 10, 2026
CVE-2026-125405: ettercap: Ettercap through 0.8.4.1 contains an out-of-bounds read vulnerability in Parse_NTLM_Auth() in src/dissectors/ec_http.c…8.1 High7.2 HighN/ANov 10, 2026
CVE-2026-125404: ettercap: Ettercap through 0.8.4.1 contains an integer underflow in ccmp_decrypt() in src/ec_encryption_ccmp.c that subtracts the…7.5 High7.7 HighN/ANov 10, 2026
CVE-2026-125403: ettercap: Ettercap through 0.8.4.1 contains an out-of-bounds read and size_t underflow vulnerability in sslw_remove_sts() in…8.1 High7.2 HighN/ANov 10, 2026
CVE-2026-125402: ettercap: Ettercap through 0.8.4.1 contains a heap out-of-bounds read vulnerability in sslw_get_clienthello_sni() in…8.1 High7.2 HighN/ANov 10, 2026
CVE-2026-125401: ettercap: Ettercap through 0.8.4.1 contains a heap buffer overflow vulnerability in gg_get_version() in src/dissectors/ec_gg.c…8.1 High7.2 HighN/ANov 10, 2026
CVE-2026-125400: ettercap: Ettercap through 0.8.4.1 contains a use-after-free vulnerability in func_pcre() in src/ec_filter.c that reads the PCRE2…8.8 High8.7 HighN/ANov 10, 2026
CVE-2026-125399: FluxionNetwork fluxion: Fluxion before 6.39 contains an OS command injection vulnerability in the fluxion.sh target scanner, which decodes…8.0 High8.6 HighN/ANov 10, 2026
CVE-2026-125398: CoreBunch Instatic: Instatic before 0.0.21 contains an authorization bypass vulnerability in handleRowAuthor that allows authenticated…7.1 High7.1 HighN/ANov 10, 2026
CVE-2026-125397: nocobase: NocoBase plugin-ai 2.1.0 through 2.2.41 contains an authorization bypass vulnerability in getAccessibleAIEmployee()…7.1 High7.1 HighN/ANov 10, 2026
CVE-2026-125396: ArtifexSoftware ghostpdl: Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps,…7.8 High8.5 HighN/ANov 10, 2026
CVE-2026-125395: ampache: Ampache before 8.4.0 contains a stored cross-site scripting vulnerability that allows users with upload rights to…5.4 Medium5.1 MediumN/ANov 10, 2026
CVE-2026-125394: FreeRDP: FreeRDP before 3.33.0 contains a heap use-after-free vulnerability in update_gdi_patblt(), update_gdi_polygon_cb() and…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125393: MailEnable MailEnable Enterprise Premium: MailEnable Enterprise Premium before 10.62 contains a heap overflow vulnerability in the IMAP X-FB-FETCH command that…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125392: webmin: Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS…5.4 Medium5.1 MediumN/ANov 10, 2026
CVE-2026-125391: webmin: Webmin through 2.670 contains an OS command injection vulnerability in samba/save_euser.cgi that allows authenticated…7.2 High8.6 HighN/ANov 10, 2026
CVE-2026-125390: Intermesh Group-Office: Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains an arbitrary local file read vulnerability in…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125389: Intermesh Group-Office: Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a stored cross-site scripting vulnerability in…6.1 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125388: Intermesh Group-Office: Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125387: faveosuite faveo-helpdesk: Faveo Helpdesk through 2.0.3 contains an authorization bypass vulnerability in TicketController that allows…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125386: moyangzhan langchain4j-aideepin: langchain4j-aideepin through 3.32.0 contains an insecure direct object reference vulnerability in…5.3 Medium6.0 MediumN/ANov 10, 2026
CVE-2026-125385: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS before 10.20261109 contains a path traversal vulnerability that allows authenticated users to read…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125384: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers…9.8 Critical9.3 CriticalN/ANov 10, 2026
276-300 of 427771
‹›