The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120434: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120433: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120432: Netpbm: Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120431: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120430: owen2345 Camaleon CMS: Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController…5.4 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120428: Chaitin PandaWiki: PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 MediumN/ANov 2, 2026
CVE-2026-120427: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated…4.3 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120426: OpenCSG CSGHub: OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve…7.5 High8.7 HighN/ANov 2, 2026
CVE-2026-120425: munafio Chatify: Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that…6.5 Medium7.1 HighN/ANov 2, 2026
CVE-2026-120318: Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing…7.2 High8.6 HighN/ANov 2, 2026
CVE-2026-118052: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without…N/A6.8 MediumN/ANov 2, 2026
CVE-2025-71450: benhoyt inih: inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to…3.3 Low4.8 MediumN/ANov 2, 2026
CVE-2025-62819: n/a: Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via…N/AN/AN/ANov 2, 2026
CVE-2026-120461: dromara Jpom: Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves…8.8 High8.7 HighN/ANov 2, 2026
CVE-2026-120429: owen2345 Camaleon CMS: Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows…7.1 High7.1 HighN/ANov 2, 2026
CVE-2026-74993: Starnet Computer and Network Systems Inventory Tracking Application: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer…7.5 HighN/AN/ANov 2, 2026
CVE-2026-120463: sassanix Warracker: Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an…6.5 Medium6.0 MediumN/ANov 2, 2026
CVE-2026-114364: Apache Software Foundation Apache Syncope: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-111959: Apache Software Foundation Apache Arrow Rust: Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1,…N/AN/AN/ANov 2, 2026
CVE-2026-102802: regularlabs.com: Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles…N/A8.9 HighN/ANov 2, 2026
CVE-2026-103419: joomshaper.com Helix Ultimate extension for Joomla: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.N/A8.6 HighN/ANov 2, 2026
CVE-2026-103420: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5N/A7.2 HighN/ANov 2, 2026
CVE-2026-105600: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5N/A8.6 HighN/ANov 2, 2026
CVE-2026-105601: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5N/A5.3 MediumN/ANov 2, 2026
CVE-2026-105602: joomshaper.com Helix Ultimate extension for Joomla: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate <…N/A8.6 HighN/ANov 2, 2026
301-325 of 574114
‹›