The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-124485: openemr: OpenEMR before 8.3.0 contains an authorization bypass vulnerability in the patient portal onsitedocuments API that…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124484: openemr: OpenEMR before 8.4.0 contains a missing authorization vulnerability in portal onsite-document APIs that allows any…8.8 High8.7 High0%Nov 8, 2026
CVE-2026-124482: openemr: OpenEMR before 8.4.0 contains an authorization bypass allowing low-privileged SMART standalone-launch users to bind…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124481: openemr: OpenEMR before 8.4.0 contains an improper authorization vulnerability in Rainforest patient portal payments that trusts…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124480: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows low-privileged authenticated users to…8.8 High8.7 High0%Nov 8, 2026
CVE-2026-124479: openemr: OpenEMR before 8.4.0 contains an arbitrary local file read vulnerability in REST document download, where the…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124478: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in the addRecall action of…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124477: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability that allows low-privileged authenticated users to…8.8 High8.7 High0%Nov 8, 2026
CVE-2026-124476: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference in portal/lib/paylib.php, which writes the…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124474: meeting-room-booking-system mrbs-code: MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-124473: openemr: OpenEMR before 8.3.0 contains a broken object-level authorization vulnerability in the SOAP note update API, which does…7.1 High7.1 High0%Nov 8, 2026
CVE-2026-124472: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_patient_note.php that…8.1 High8.6 High0%Nov 8, 2026
CVE-2026-124471: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in interface/billing/sl_eob_invoice.php that allows…8.1 High8.6 High0%Nov 8, 2026
CVE-2026-124469: openemr: OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Fee Sheet drug-inventory lookup…9.9 Critical9.4 Critical0%Nov 8, 2026
CVE-2026-124468: openemr: OpenEMR before 8.3.0 contains an SQL injection vulnerability in the Standard REST API patient insurance and employer…7.1 High7.1 High0%Nov 8, 2026
CVE-2026-124467: openemr: OpenEMR before 8.4.0 contains a local file inclusion in the ESign router (library/ESign/Router.php), which passes the…8.8 High8.7 High0%Nov 8, 2026
CVE-2026-124466: openemr: OpenEMR before 8.4.0 contains a server-side request forgery vulnerability that allows unauthenticated attackers to make…7.2 High6.9 Medium0%Nov 8, 2026
CVE-2026-124465: Trendyol kafka-konsumer: Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124464: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability that allows patient-scoped SMART tokens to read…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124463: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability that allows authenticated users with CAMOS…8.7 High9.3 Critical0%Nov 8, 2026
CVE-2026-124462: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query()…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124460: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124459: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save…8.1 High8.6 High0%Nov 8, 2026
CVE-2026-124458: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124456: openemr: OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the…7.1 High7.1 High0%Nov 8, 2026
301-325 of 423560
‹›