The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-124427: craftcms cms: Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients…9.8 Critical9.3 Critical0%Nov 8, 2026
CVE-2026-124426: craftcms cms: Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers…5.3 Medium6.9 Medium0%Nov 8, 2026
CVE-2026-124425: parse-community parse-server: Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure…3.1 Low2.3 Low0%Nov 8, 2026
CVE-2026-124424: WWBN AVideo: WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid…7.1 High7.1 High0%Nov 8, 2026
CVE-2026-124331: Jinher OA: A vulnerability was identified in Jinher OA C67.3 High5.5 Medium0%Nov 8, 2026
CVE-2026-124330: FlowCI flow-core-x: A vulnerability was determined in FlowCI flow-core-x up to 1.23.495.0 Medium1.3 Low0%Nov 8, 2026
CVE-2026-124491: JiHong88 suneditor: SunEditor before 3.4.0 contains a stored cross-site scripting vulnerability in the FileUpload plugin create() method…6.4 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-124487: openemr: OpenEMR before 8.4.0 contains an improper authorization vulnerability in the non-patient POST…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124483: openemr: OpenEMR before 8.4.0 contains an incorrect authorization vulnerability because the prescription REST API routes check…8.3 High8.7 High0%Nov 8, 2026
CVE-2026-124475: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows…7.1 High7.1 High0%Nov 8, 2026
CVE-2026-124470: openemr: OpenEMR before 8.3.0 contains a broken object level authorization vulnerability in…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-124461: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any…8.1 High8.6 High0%Nov 8, 2026
CVE-2026-124457: openemr: OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows…7.6 High7.2 High0%Nov 8, 2026
CVE-2026-124452: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that…5.4 Medium5.1 Medium0%Nov 8, 2026
CVE-2026-124448: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where…7.6 High8.6 High0%Nov 8, 2026
CVE-2026-124329: FlowCI flow-core-x: A vulnerability was found in FlowCI flow-core-x up to 1.23.495.0 Medium1.3 Low0%Nov 8, 2026
CVE-2026-124328: FlowCI flow-core-x: A vulnerability has been found in FlowCI flow-core-x up to 1.23.497.4 High2.1 Low0%Nov 8, 2026
CVE-2026-124326: DataLinkDC Dinky: A flaw has been found in DataLinkDC Dinky up to 1.2.55.4 Medium2.1 Low0%Nov 8, 2026
CVE-2026-97195: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not sanitize a persisted field definition before emitting…3.5 LowN/A0%Nov 8, 2026
CVE-2026-97194: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not perform a read-permission check when it renders and…2.7 LowN/A0%Nov 8, 2026
CVE-2026-97193: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not verify that a user is allowed to edit the target object…2.7 LowN/A0%Nov 8, 2026
CVE-2026-97192: Unknown Secure Custom Fields: The Secure Custom Fields WordPress plugin before 6.9.8 does not re-apply its field-group location rules when persisting…2.7 LowN/A0%Nov 8, 2026
CVE-2026-96963: Unknown Pie Register: The Pie Register WordPress plugin through 3.8.4.15 does not perform an authorisation check in one of its AJAX actions,…2.7 LowN/A0%Nov 8, 2026
CVE-2026-96961: Unknown Pie Register: The Pie Register WordPress plugin through 3.8.4.15 does not perform any capability, nonce or authentication check on…6.5 MediumN/A0%Nov 8, 2026
CVE-2026-85344: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.57.7212 does not perform any authorization check on an AJAX…4.3 MediumN/A0%Nov 8, 2026
351-375 of 422082
‹›