The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126379: givanz Vvveb: Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass…7.6 High8.3 HighN/ANov 13, 2026
CVE-2026-126383: n8n-io n8n: n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection…8.2 High5.3 MediumN/ANov 13, 2026
CVE-2026-126387: n8n-io n8n: n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126391: n8n-io n8n: n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-126396: vllm-project vllm: vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126399: vllm-project vllm: vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126403: coder: Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before…6.5 Medium8.5 HighN/ANov 13, 2026
CVE-2026-126407: bytecodealliance wasmtime: Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host…4.8 Medium5.9 MediumN/ANov 13, 2026
CVE-2026-126411: frappe hrms: Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126415: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126416: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126419: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126423: openemr: OpenEMR before 8.5.0 contains a denial of service vulnerability in four ZIP upload paths that read uncompressed entries…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126427: openemr: OpenEMR before 8.5.0 contains a session expiration vulnerability that prevents automatic logoff because the Eye Exam…4.6 Medium4.3 MediumN/ANov 13, 2026
CVE-2026-126431: openemr: OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows authenticated Carecoordination…6.8 Medium7.6 HighN/ANov 13, 2026
CVE-2026-126435: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/order_manifest.php, which…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126439: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in ccdaservice/ccda_gateway.php that fails to…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126443: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in dynamic_finder_ajax.php that allows…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-116509: expresstech Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker: The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to generic SQL…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-126447: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in trusted-messages-ajax.php that allows any…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126451: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows portal patients to run JavaScript…7.3 High8.5 HighN/ANov 13, 2026
CVE-2026-126455: openemr: OpenEMR before 8.5.0 contains multiple missing authorization and SQL injection defects across report, portal,…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126460: openemr: OpenEMR before 8.5.0 contains a persistent SQL injection vulnerability in SLEOB::slInvoiceNumber(), where the CLP01…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126464: openemr: OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126468: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows any authenticated low-privilege user to…8.8 High8.7 HighN/ANov 13, 2026
451-475 of 532044