The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126439: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126438: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/patient_file/rules/patient_data.php…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126437: openemr: OpenEMR before 8.5.0 contains an authorization bypass vulnerability in portal/lib/download_template.php that allows any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126435: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126434: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in interface/forms/procedure_order/common.php that…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126433: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/drugs/dispense_drug.php, which…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126431: openemr: OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination…6.8 Medium7.6 HighN/ANov 13, 2026
CVE-2026-126430: openemr: OpenEMR before 8.5.0 contains an sql injection vulnerability that allows any authenticated core user to inject SQL by…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126429: openemr: OpenEMR before 8.5.0 passes authenticated user-controlled HTML from the doc_lib.php content parameter to mPDF, which…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126427: openemr: OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam…4.6 Medium4.3 MediumN/ANov 13, 2026
CVE-2026-126426: openemr: OpenEMR 5.0.2 before 8.5.0 contains a missing authentication vulnerability in mfa_registrations.php and mfa_u2f.php…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126425: openemr: OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in which History layout field identifiers saved…7.2 High4.6 MediumN/ANov 13, 2026
CVE-2026-126423: openemr: OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126422: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/lists_touch.php that allows…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126421: openemr: OpenEMR before 8.5.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users with…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126419: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126418: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php,…6.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126417: openemr: OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126415: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126414: frappe hrms: Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126413: frappe hrms: Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126411: frappe hrms: Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126410: bytecodealliance wasmtime: Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a…6.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126409: bytecodealliance wasmtime: Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion…2.0 Low1.8 LowN/ANov 13, 2026
CVE-2026-125659: eMudhra emBridge: This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpointsN/A2.1 LowN/ANov 13, 2026
451-475 of 532044