The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120316: http4k: http4k before 6.62.0.0-ee contains a path traversal vulnerability in ThymeleafTemplates Caching and HotReload that…5.9 Medium8.2 HighN/ANov 2, 2026
CVE-2026-120315: lobehub chat: LobeHub Chat from 1.84.26 before 2.1.49 contains a path traversal vulnerability that allows authenticated users to…8.8 High8.7 HighN/ANov 2, 2026
CVE-2026-120314: Jovancoding Network-AI: Network-AI from 5.14.0 before 5.15.5 contains a missing authentication vulnerability in the A2AServer class that allows…7.3 High6.9 MediumN/ANov 2, 2026
CVE-2026-120313: Jovancoding Network-AI: Network-AI before 5.15.5 contains a path traversal vulnerability in InputSanitizer.sanitizePath() that allows attackers…7.5 High8.7 HighN/ANov 2, 2026
CVE-2026-120312: Jovancoding Network-AI: Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in AgentVCR that allows attackers…8.8 High8.7 HighN/ANov 2, 2026
CVE-2026-120311: Jovancoding Network-AI: Network-AI from 5.13.4 before 5.15.5 contains a path traversal vulnerability in FileJobStore that allows attackers to…8.8 High8.7 HighN/ANov 2, 2026
CVE-2026-120310: parse-community parse-server: Parse Server before 8.6.109 and 9.0.0 before 9.10.6-alpha.1 returns stored field values in object update responses…3.1 Low2.3 LowN/ANov 2, 2026
CVE-2026-120309: nuxt: Nuxt from 4.6.0 before 4.6.2 contains a route parameter confusion vulnerability in getRouterParam and getRouterParams…3.7 Low6.3 MediumN/ANov 2, 2026
CVE-2026-120323: samanhappy MCPHub: A security flaw has been discovered in samanhappy MCPHub up to 1.0.45/1.1.74.3 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120322: Termix-SSH Termix: A vulnerability was identified in Termix-SSH Termix up to 2.9.29.9 Critical8.6 HighN/ANov 2, 2026
CVE-2026-120320: jxxghp MoviePilot: A vulnerability was determined in jxxghp MoviePilot up to 3.1.24.7 Medium2.0 LowN/ANov 2, 2026
CVE-2026-120319: Sanluan PublicCMS: A vulnerability was found in Sanluan PublicCMS 4.x/5.x/6.x6.3 Medium2.1 LowN/ANov 2, 2026
CVE-2026-120283: Linksys E8450: A vulnerability was identified in Linksys E8450 1.2.00.36051610.0 Critical9.3 CriticalN/ANov 2, 2026
CVE-2026-120282: WAVLINK WN536AX6-A: A vulnerability was determined in WAVLINK WN536AX6-A V2605079.9 Critical8.6 HighN/ANov 2, 2026
CVE-2026-120281: WAVLINK WN536AX6-A: A vulnerability was found in WAVLINK WN536AX6-A V26050710.0 Critical9.3 CriticalN/ANov 2, 2026
CVE-2026-120280: WAVLINK WN536AX6-A: A vulnerability has been found in WAVLINK WN536AX6-A V26050710.0 Critical9.3 CriticalN/ANov 2, 2026
CVE-2026-120279: WAVLINK WN536AX6-A: A flaw has been found in WAVLINK WN536AX6-A V26050710.0 Critical9.3 CriticalN/ANov 2, 2026
CVE-2026-120278: WAVLINK WN536AX6-A: A vulnerability was detected in WAVLINK WN536AX6-A V260507_2.0.05.3 Medium5.5 MediumN/ANov 2, 2026
CVE-2026-120277: WAVLINK WN536AX6-A: A security vulnerability has been detected in WAVLINK WN536AX6-A V260507_2.0.010.0 Critical9.3 CriticalN/ANov 2, 2026
CVE-2026-120276: WAVLINK WN536AX6-A: A weakness has been identified in WAVLINK WN536AX6-A V260507_2.0.010.0 Critical9.3 CriticalN/ANov 2, 2026
CVE-2026-95863: Apache Software Foundation Apache Wicket: Improper neutralization of input during web page generation in Apache WicketN/A7.6 HighN/ANov 1, 2026
CVE-2026-87718: Apache Software Foundation Apache Wicket: Apache Wicket 10.10.0, 10.11.0 and 9.24.0 do not set the Content-Security-Policy headers on a page whose render request…N/A2.3 LowN/ANov 1, 2026
CVE-2026-84231: Apache Software Foundation Apache Wicket: Improper neutralization of input during web page generation in Apache WicketN/A7.4 HighN/ANov 1, 2026
CVE-2026-84177: Apache Software Foundation Apache Wicket: Incorrect behavior order in Apache Wicket: a file path is validated before the framework appends the attributes that…N/A6.3 MediumN/ANov 1, 2026
CVE-2026-84172: Apache Software Foundation Apache Wicket: Files accessible to external parties in Apache WicketN/A6.3 MediumN/ANov 1, 2026
451-475 of 574114
‹›