The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-124742: Red Hat: A flaw was found in BusyBox5.5 MediumN/AN/ANov 11, 2026
CVE-2026-124738: Red Hat: A flaw was found in BusyBox5.3 MediumN/AN/ANov 11, 2026
CVE-2026-90993: Apache Software Foundation Apache XML Graphics Batik: XXE vulnerability in Apache XML Graphics BatikN/AN/AN/ANov 11, 2026
CVE-2026-124253: codepeople Calculated Fields Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople…7.1 HighN/AN/ANov 11, 2026
CVE-2026-123478: Meow Apps AI Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI…7.1 HighN/AN/ANov 11, 2026
CVE-2026-111792: Apache Software Foundation Apache XML Graphics Batik: Uncontrolled Recursion vulnerability in Apache XML Graphics BatikN/AN/AN/ANov 11, 2026
CVE-2026-78287: STAGGS: Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code…10.0 CriticalN/AN/ANov 11, 2026
CVE-2026-118965: Checkmk GmbH Checkmk: Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an…N/A9.4 CriticalN/ANov 11, 2026
CVE-2026-120495: Checkmk GmbH Checkmk: Path traversal in the Synthetic Monitoring "Robotmk" test service of Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL)…N/A9.4 CriticalN/ANov 11, 2026
CVE-2026-121374: Checkmk GmbH Checkmk: Argument injection in the Kubernetes special agent in Checkmk <2.5.0p19, <2.4.0p40, and 2.3.0 (EOL) allows a user with…N/A9.4 CriticalN/ANov 11, 2026
CVE-2026-124741: Red Hat: A flaw was found in BusyBox7.6 HighN/AN/ANov 11, 2026
CVE-2026-124739: Red Hat: A flaw was found in BusyBox7.5 HighN/AN/ANov 11, 2026
CVE-2026-124257: wordplus BP Better Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124256: CodeRockz Delivery &amp; Pickup Date Time for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodeRockz…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124250: AyeCode Ltd GeoDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd…7.1 HighN/AN/ANov 11, 2026
CVE-2026-112174: Local privilege escalation vulnerability in Iperius Backup 8.8.3, due to insufficient separation between the graphical…N/A9.3 CriticalN/ANov 11, 2026
CVE-2026-124737: Red Hat: A flaw was found in BusyBox7.5 HighN/AN/ANov 11, 2026
CVE-2026-18769: Exposed IOCTL with Insufficient Access Control7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-18768: Exposed IOCTL with Insufficient Access Control7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-18767: Exposed IOCTL with Insufficient Access Control7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-126626: Overly Restrictive Account Lockout Mechanism5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126625: Incorrect Default Permissions6.7 MediumN/AN/ANov 11, 2026
CVE-2026-126624: Unverified Ownership7.3 HighN/AN/ANov 11, 2026
CVE-2026-126623: Inefficient Algorithmic Complexity7.5 HighN/AN/ANov 11, 2026
CVE-2026-126622: Incorrect Default Permissions7.3 HighN/AN/ANov 11, 2026
401-425 of 511254