The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121576: AtlasAiDev MCP Server for WordPress: Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub…8.8 HighN/AN/ANov 9, 2026
CVE-2026-122664: VideoWhisper.com Broadcast Live Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com…7.1 HighN/AN/ANov 9, 2026
CVE-2026-123482: Crocoblock JetFormBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…7.1 HighN/AN/ANov 9, 2026
CVE-2026-121612: WPZOOM WPBruiser {no- Captcha anti-Spam}: Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication…4.3 MediumN/AN/ANov 9, 2026
CVE-2026-115340: Progress Software WS_FTP Server: Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session…7.1 HighN/AN/ANov 9, 2026
CVE-2026-115339: Progress Software WS_FTP Server: Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an…7.5 HighN/AN/ANov 9, 2026
CVE-2026-115341: Progress Software WS_FTP Server: Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions…7.7 HighN/AN/ANov 9, 2026
CVE-2026-115337: Progress Software WS_FTP Server: Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with…6.3 MediumN/AN/ANov 9, 2026
CVE-2026-115336: Progress Software WS_FTP Server: Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-115338: Progress Software WS_FTP Server: Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network…8.1 HighN/AN/ANov 9, 2026
CVE-2026-112165: laservideo lasergest: The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"),…N/A6.9 MediumN/ANov 9, 2026
CVE-2026-121690: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privilegesN/AN/AN/ANov 9, 2026
CVE-2026-121689: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure…N/AN/AN/ANov 9, 2026
CVE-2026-121688: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanismN/AN/AN/ANov 9, 2026
CVE-2026-121687: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed…N/AN/AN/ANov 9, 2026
CVE-2026-121686: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code…N/AN/AN/ANov 9, 2026
CVE-2026-121685: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentialsN/AN/AN/ANov 9, 2026
CVE-2026-114594: Sandisk Sandisk Dashboard: A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated…N/A5.4 MediumN/ANov 9, 2026
CVE-2026-112164: laservideo lasergest: The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV,…N/A6.6 MediumN/ANov 9, 2026
CVE-2026-103906: am_automatic_machines am_club: Use of hard-coded MQTT credentials in the AM CLUB mobile application allows an authenticated attacker to connect to the…N/A7.8 HighN/ANov 9, 2026
CVE-2026-124683: Eclipse Foundation Eclipse Langium: Eclipse Langium versions 3.2.0 through 4.4.0 contain an inefficient algorithmic complexity issue (CWE-407) in the…N/A8.7 HighN/ANov 9, 2026
CVE-2026-118492: Eclipse Foundation Eclipse Langium: In Eclipse Langium versions 3.0.0 and later, the langium-sprotty package does not HTML-escape diagnostic messages…N/A2.0 LowN/ANov 9, 2026
CVE-2025-10248: OpenText Filr: XSS Vulnerability in OpenText Filr Appliance versions upto 25.1.2 could allow an authenticated user to upload a…N/A7.2 HighN/ANov 9, 2026
CVE-2026-119474: HAVELSAN Inc. Liman Render Engine: Incorrect Permission Assignment for Critical Resource vulnerability in HAVELSAN Inc7.8 HighN/AN/ANov 9, 2026
CVE-2026-124959: Spotify, hnswlib: The loadIndex function in nmslib hnswlib and Spotify Voyager does not verify that the element count in a serialized…N/AN/AN/ANov 9, 2026
301-325 of 427771
‹›