The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-117477: GMO Prime Strategy Co., Ltd.: KUSANAGI provided by GMO Prime Strategy Co., Ltd6.1 Medium5.1 Medium0%Nov 10, 2026
CVE-2026-125396: ArtifexSoftware ghostpdl: Ghostscript before 10.08.0 contains a -dSAFER bypass vulnerability in the .putgstringcopy procedure in gs_fonts.ps,…7.8 High8.5 High0%Nov 9, 2026
CVE-2026-125392: webmin: Webmin through 2.670 contains a stored cross-site scripting vulnerability in bind8/edit_recs.cgi that outputs raw DNS…5.4 Medium5.1 Medium0%Nov 9, 2026
CVE-2026-125388: Intermesh Group-Office: Intermesh Group-Office before 6.8.181, 25.0.116, and 26.0.58 contains a missing authorization vulnerability that allows…6.5 Medium7.1 High0%Nov 9, 2026
CVE-2026-125384: go2ismail Asp.Net-Core-Inventory-Order-Management-System: INDOTALENT WHMS before 10.20261109 contains a default credentials vulnerability that allows unauthenticated attackers…9.8 Critical9.3 Critical0%Nov 9, 2026
CVE-2026-125380: gcpaas DataRoom: DataRoom through 3.0.0 contains an incorrect authorization vulnerability in DatasetController.runTest that allows…6.5 Medium7.1 High0%Nov 9, 2026
CVE-2026-125376: Mereithhh vanblog: VanBlog through 0.54.0 contains an information disclosure vulnerability that allows unauthenticated attackers to read…5.3 Medium6.9 Medium0%Nov 9, 2026
CVE-2026-125372: getrebuild rebuild: REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and…4.3 Medium5.3 Medium0%Nov 9, 2026
CVE-2026-125368: YeQing17-2026 OmniAgent: OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that…7.5 High7.7 High0%Nov 9, 2026
CVE-2026-125364: frab: frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant…8.1 High8.6 High0%Nov 9, 2026
CVE-2026-125360: Southclaws storyden: Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant…7.2 High8.6 High0%Nov 9, 2026
CVE-2026-125075: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High6.9 Medium0%Nov 9, 2026
CVE-2026-115934: craftcms cms: An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search,…9.8 Critical9.3 Critical0%Nov 9, 2026
CVE-2026-125074: SourceCodester Smart Attendance System with QR Code Scanner: A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High6.9 Medium0%Nov 9, 2026
CVE-2026-125120: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment9.8 CriticalN/A1%Nov 9, 2026
CVE-2026-125119: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment7.5 HighN/A1%Nov 9, 2026
CVE-2026-125118: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment6.5 MediumN/A0%Nov 9, 2026
CVE-2026-124035: Amazon amazon-braket-schemas: Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote…7.1 High7.5 High1%Nov 9, 2026
CVE-2026-124034: AWS amazon-braket-sdk: Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a…6.4 Medium5.9 Medium0%Nov 9, 2026
CVE-2026-125117: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment8.2 HighN/A1%Nov 9, 2026
CVE-2026-125116: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment4.8 MediumN/A0%Nov 9, 2026
CVE-2026-115864: Memory Allocation with Excessive Size ValueN/AN/A0%Nov 9, 2026
CVE-2026-113970: Undefined Security Weakness8.8 HighN/A0%Nov 9, 2026
CVE-2026-125115: novuhq, @novu: Novu provides an API for sending notifications through multiple channels6.8 MediumN/A0%Nov 9, 2026
CVE-2026-125114: novuhq novu: Novu provides an API for sending notifications through multiple channelsN/A8.3 High0%Nov 9, 2026
451-475 of 517528