The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-125383: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS (Asp.Net-Core-Inventory-Order-Management-System) before 10.20261109 contains an authentication bypass…9.8 Critical9.3 CriticalN/ANov 10, 2026
CVE-2026-125382: RamonSilva20 mapos: Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows…7.2 High8.6 HighN/ANov 10, 2026
CVE-2026-125381: gcpaas DataRoom: DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role…5.3 Medium6.0 MediumN/ANov 10, 2026
CVE-2026-125380: gcpaas DataRoom: DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125379: movim: Movim through 0.35.5 contains an authorization bypass vulnerability in Post::ajaxGetPost that allows authenticated…3.1 Low2.3 LowN/ANov 10, 2026
CVE-2026-125378: PowerDNS-Admin: PowerDNS-Admin before 2026.11.0 contains a missing authorization vulnerability in the apply_records handler for…4.3 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125377: pig-mesh pig: Pig before 4.1.2 contains a missing authorization vulnerability in SysClientController that allows authenticated users…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125376: Mereithhh vanblog: VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read…5.3 Medium6.9 MediumN/ANov 10, 2026
CVE-2026-125375: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing authorization vulnerability in the project_doc_sort and manage_project_doc_sort…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125374: krayin laravel-crm: Krayin CRM before 2.2.8 contains a broken object level authorization vulnerability in Lead TagController attach and…4.3 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125373: ietf-tools datatracker: IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125372: getrebuild rebuild: REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and…4.3 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125371: tinyproxy: Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that…4.8 Medium6.3 MediumN/ANov 10, 2026
CVE-2026-125370: kubero-dev kubero: Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers…9.8 Critical9.3 CriticalN/ANov 10, 2026
CVE-2026-125369: fsinfuhh Bitpoll: Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers…5.3 Medium6.9 MediumN/ANov 10, 2026
CVE-2026-125368: YeQing17-2026 OmniAgent: OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that…7.5 High7.7 HighN/ANov 10, 2026
CVE-2026-125367: picosh pico: Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125366: asciimoo omnom: Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125365: harung1993 dollardollar: DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125364: frab: frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant…8.1 High8.6 HighN/ANov 10, 2026
CVE-2026-125363: SecOps-7 MikroDash: MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125362: haiwen seahub: Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch…3.1 Low2.3 LowN/ANov 10, 2026
CVE-2026-125361: Tencent BrowserSkill: Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to…6.3 Medium7.2 HighN/ANov 10, 2026
CVE-2026-125360: Southclaws storyden: Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant…7.2 High8.6 HighN/ANov 10, 2026
CVE-2026-125359: fancydirty mediary-scout: Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated…4.3 Medium5.3 MediumN/ANov 10, 2026
301-325 of 427771
‹›