The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-75487: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-61418: Dell SmartFabric OS10 Software: Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability7.5 HighN/AN/ANov 13, 2026
CVE-2026-61417: Dell SmartFabric OS10 Software: Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability6.5 MediumN/AN/ANov 13, 2026
CVE-2026-128348: exceljs: ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2026-128347: exceljs: ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128346: exceljs: ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128345: exceljs: ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128344: exceljs: ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128343: exceljs: exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128342: exceljs: ExcelJS through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128341: exceljs: ExcelJS through 4.4.0 contains a resource exhaustion vulnerability in data-validations-xform.js that allows attackers…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128340: exceljs: ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128339: exceljs: ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128338: exceljs: exceljs through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128337: exceljs: ExcelJS through 4.4.0 contains a prototype pollution vulnerability in mergeConditionalFormattings that allows attackers…7.0 High8.3 HighN/ANov 13, 2026
CVE-2026-128336: exceljs: ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to…4.8 Medium6.3 MediumN/ANov 13, 2026
CVE-2026-128335: Contao: Contao 4.6.0 before 5.3.54, 5.4.0-RC1 before 5.7.17, and 6.0.0-RC1 before 6.0.6 fails to invalidate existing user…3.7 Low2.1 LowN/ANov 13, 2026
CVE-2026-128334: knadh listmonk: listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated…4.8 Medium6.3 MediumN/ANov 13, 2026
CVE-2026-128333: knadh listmonk: listmonk 6.0.0 before 7.0.0-beta.2 contains an authentication bypass vulnerability in doResetPassword that skips TOTP…7.4 High9.1 CriticalN/ANov 13, 2026
CVE-2026-128332: knadh listmonk: Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to…7.4 High9.1 CriticalN/ANov 13, 2026
CVE-2026-128331: miniflux: Miniflux before 2.3.5 contains an unverified password change vulnerability that allows holders of a signed-in session…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-128330: miniflux: Miniflux before 2.3.5 contains an insufficient session expiration vulnerability that allows attackers to retain account…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2026-128329: dokploy: Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to…7.7 High8.3 HighN/ANov 13, 2026
CVE-2026-128328: dokploy: Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to…5.0 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-128242: actix: actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in…7.5 High8.7 HighN/ANov 13, 2026
301-325 of 532044