The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126411: frappe hrms: Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126415: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126416: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126419: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126423: openemr: OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126427: openemr: OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam…4.6 Medium4.3 MediumN/ANov 13, 2026
CVE-2026-126431: openemr: OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination…6.8 Medium7.6 HighN/ANov 13, 2026
CVE-2026-126435: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126439: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126443: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-116509: expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-126447: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126451: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript…7.3 High8.5 HighN/ANov 13, 2026
CVE-2026-126455: openemr: OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal,…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126460: openemr: OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126464: openemr: OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126468: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126472: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that allows any…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126476: openemr: OpenEMR before 8.5.0 contains a reflected cross-site scripting vulnerability in the Application module's auto-suggest…6.1 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126480: openemr: OpenEMR before 8.5.0 contains an sql injection vulnerability in CcrTable::insertApprovedData() that allows…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126484: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in printed_fee_sheet.php that allows…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126488: openemr: OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal OnsiteDocument.Query endpoint, where…7.7 High8.3 HighN/ANov 13, 2026
CVE-2026-126492: openemr: OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126937: diced zipline: Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-126941: diced zipline: Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read…6.8 Medium8.2 HighN/ANov 13, 2026
451-475 of 532044