The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-116845: netbox-community netbox: NetBox from 2.9.0 before 4.7.4 contains a broken access control vulnerability in BulkComponentCreateView that allows…5.4 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-63418: monitoring-plugins: Monitoring Plugins is a suite of plugins for monitoring applications7.0 HighN/AN/ANov 3, 2026
CVE-2026-63436: zeroturnaround zt-zip: zt-zip is a Java library that provides convenience methods for ZIP archive manipulation6.1 MediumN/AN/ANov 3, 2026
CVE-2026-44267: enspirit elo: Elo is a purely functional expression language for no-code tools9.8 CriticalN/AN/ANov 3, 2026
CVE-2026-44265: enspirit elo: Elo is a purely functional expression language for no-code tools7.4 HighN/AN/ANov 3, 2026
CVE-2026-39777: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-39743: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-38601: n/a: A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user,…N/AN/AN/ANov 3, 2026
CVE-2026-38595: n/a: An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a…N/AN/AN/ANov 3, 2026
CVE-2026-28336: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of…9.9 CriticalN/AN/ANov 3, 2026
CVE-2026-28335: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution8.4 HighN/AN/ANov 3, 2026
CVE-2026-28327: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability8.2 HighN/AN/ANov 3, 2026
CVE-2026-121604: wlroots: wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that…3.3 Low4.8 MediumN/ANov 3, 2026
CVE-2026-121602: solanum-ircd solanum: Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server…6.5 Medium8.5 HighN/ANov 3, 2026
CVE-2026-121588: texlyre: TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute…6.1 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121587: coollabsio coolify: Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121262: phpMyAdmin SQL-Parser: A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.15.3 Medium5.5 MediumN/ANov 3, 2026
CVE-2026-121261: phpMyAdmin ShapeFile: A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.14.3 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121259: Red Hat: A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad6.5 MediumN/AN/ANov 3, 2026
CVE-2026-120846: Uncanny Owl Uncanny Automator: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-120843: Barn2 Plugins Posts Table with Search & Sort: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-119675: MongoDB Database Tools: MongoDB Database Tools mongorestore inconsistently handles the system.buckets8.6 High5.2 MediumN/ANov 3, 2026
CVE-2026-119674: MongoDB Database Tools: MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the…3.7 Low2.1 LowN/ANov 3, 2026
CVE-2026-119673: MongoDB Database Tools: MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for…2.8 Low1.0 LowN/ANov 3, 2026
CVE-2026-119672: MongoDB Database Tools: MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for get_id when…4.8 Medium5.9 MediumN/ANov 3, 2026
401-425 of 528356
‹›