The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-125367: picosh pico: Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125366: asciimoo omnom: Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125365: harung1993 dollardollar: DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125364: frab: frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant…8.1 High8.6 HighN/ANov 10, 2026
CVE-2026-125363: SecOps-7 MikroDash: MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125362: haiwen seahub: Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch…3.1 Low2.3 LowN/ANov 10, 2026
CVE-2026-125361: Tencent BrowserSkill: Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to…6.3 Medium7.2 HighN/ANov 10, 2026
CVE-2026-125360: Southclaws storyden: Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant…7.2 High8.6 HighN/ANov 10, 2026
CVE-2026-125359: fancydirty mediary-scout: Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated…4.3 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125358: rehan-remade universal-modder: Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation…8.1 High7.2 HighN/ANov 10, 2026
CVE-2026-125357: munin-monitoring munin: Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of…5.3 Medium6.9 MediumN/ANov 10, 2026
CVE-2026-125078: SourceCodester Smart Attendance System with QR Code Scanner: A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.06.3 Medium2.1 LowN/ANov 10, 2026
CVE-2026-125077: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.04.3 Medium2.1 LowN/ANov 10, 2026
CVE-2026-125076: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High5.5 MediumN/ANov 10, 2026
CVE-2026-117477: GMO Prime Strategy Co., Ltd.: KUSANAGI provided by GMO Prime Strategy Co., Ltd6.1 Medium5.1 MediumN/ANov 10, 2026
CVE-2026-125075: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High6.9 MediumN/ANov 9, 2026
CVE-2026-115934: craftcms cms: An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search,…9.8 Critical9.3 CriticalN/ANov 9, 2026
CVE-2026-125074: SourceCodester Smart Attendance System with QR Code Scanner: A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High6.9 MediumN/ANov 9, 2026
CVE-2026-125120: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment9.8 CriticalN/AN/ANov 9, 2026
CVE-2026-125119: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment7.5 HighN/AN/ANov 9, 2026
CVE-2026-125118: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment6.5 MediumN/AN/ANov 9, 2026
CVE-2026-124035: Amazon amazon-braket-schemas: Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote…7.1 High7.5 HighN/ANov 9, 2026
CVE-2026-124034: AWS amazon-braket-sdk: Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a…6.4 Medium5.9 MediumN/ANov 9, 2026
CVE-2026-125117: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment8.2 HighN/AN/ANov 9, 2026
CVE-2026-125116: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment4.8 MediumN/AN/ANov 9, 2026
326-350 of 419424