The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125659: eMudhra emBridge: This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpointsN/A2.1 LowN/ANov 13, 2026
CVE-2026-123338: Apache Software Foundation Apache DataSketches C++: Out-of-bounds Write vulnerability in Apache DataSketches C++N/AN/AN/ANov 13, 2026
CVE-2026-123274: Apache Software Foundation Apache DataSketches C++: Out-of-bounds Write vulnerability in Apache DataSketches C++N/AN/AN/ANov 13, 2026
CVE-2026-112182: OpenKM OpenKM Community Edition: Unauthorization vulnerability in the management of workflow definitions in OpenKM Community EditionN/A8.7 HighN/ANov 13, 2026
CVE-2026-109904: X.Org: A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X…N/A6.9 MediumN/ANov 13, 2026
CVE-2026-109903: X.Org: A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before…7.8 HighN/AN/ANov 13, 2026
CVE-2026-75578: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-75577: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-75576: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-75495: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-75494: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to…7.4 High8.3 HighN/ANov 13, 2026
CVE-2026-75493: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-75492: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains an unauthenticated stack buffer overflow vulnerability in the stun_client TR-111 UDP…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-75491: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains an authentication bypass vulnerability in the Mosquitto plugin auth_plugin_jwt.so…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-75490: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-75489: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart…6.8 Medium6.1 MediumN/ANov 13, 2026
CVE-2026-75488: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in the CWMP client that allows a malicious ACS…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-75487: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-61418: Dell SmartFabric OS10 Software: Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Incorrect Authorization vulnerability7.5 HighN/AN/ANov 13, 2026
CVE-2026-61417: Dell SmartFabric OS10 Software: Dell SmartFabric OS10 Software, versions prior to 10.6.0.10, contains an Improper Access Control vulnerability6.5 MediumN/AN/ANov 13, 2026
CVE-2026-128348: exceljs: ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2026-128347: exceljs: ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128346: exceljs: ExcelJS through 4.4.0 contains a resource leak vulnerability in the streaming WorkbookReader.parse that leaves…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128345: exceljs: ExcelJS through 4.4.0 contains a regular expression denial of service vulnerability in slideFormula in…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128344: exceljs: ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by…7.5 High8.7 HighN/ANov 13, 2026
326-350 of 532044