The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2023-54423: OpenMage magento-lts: OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG…7.5 High8.3 HighN/ANov 13, 2026
CVE-2025-71462: diced zipline: Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute…6.1 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-75489: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mt_wifi Smart…6.8 Medium6.1 MediumN/ANov 13, 2026
CVE-2026-75493: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a stack buffer overflow vulnerability in an obuspa getter for the TR-098…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-75577: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-126274: nocodb: NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to…8.7 High9.3 CriticalN/ANov 13, 2026
CVE-2026-126282: nocodb: NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts…8.0 High8.6 HighN/ANov 13, 2026
CVE-2026-126290: nocodb: NocoDB before 2026.07.0 contains an information disclosure vulnerability in base-integrations.service.ts that allows…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126302: nltk: NLTK from 3.9.4 before 3.10.4 contains a symlink following vulnerability in nltk.sem.chat80.sql_query() that bypasses…3.3 Low4.8 MediumN/ANov 13, 2026
CVE-2026-126306: espocrm: EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows…8.0 High8.6 HighN/ANov 13, 2026
CVE-2026-126310: openbao: OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to…8.7 High7.0 HighN/ANov 13, 2026
CVE-2026-126314: frappe hrms: Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126317: frappe hrms: Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126318: redaxo core: REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126322: openemr: OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126371: givanz Vvveb: Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126375: givanz Vvveb: Vvveb through 1.0.8.6 contains a missing authorization vulnerability that allows low-privilege vendors to rename,…8.1 High7.2 HighN/ANov 13, 2026
CVE-2026-126379: givanz Vvveb: Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass…7.6 High8.3 HighN/ANov 13, 2026
CVE-2026-126383: n8n-io n8n: n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection…8.2 High5.3 MediumN/ANov 13, 2026
CVE-2026-126387: n8n-io n8n: n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126391: n8n-io n8n: n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-126396: vllm-project vllm: vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126399: vllm-project vllm: vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126403: coder: Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before…6.5 Medium8.5 HighN/ANov 13, 2026
CVE-2026-126407: bytecodealliance wasmtime: Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host…4.8 Medium5.9 MediumN/ANov 13, 2026
426-450 of 532044