The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-120227: WAVLINK WN701AE: A vulnerability was detected in WAVLINK WN701AE M01AE_V2601059.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-120226: Hangzhou Xiongmai Technology P2PAPI.dll: A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows3.3 Low1.9 LowN/ANov 1, 2026
CVE-2026-120225: Oray Pugongying X5 Pro: A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.19.1 Critical8.5 HighN/ANov 1, 2026
CVE-2026-120224: Oray Pugongying X5 Pro: A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.19.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-13575: CRLF InjectionN/AN/AN/ANov 1, 2026
CVE-2026-120223: Oray Pugongying X5 Pro: A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.13.1 Low1.3 LowN/ANov 1, 2026
CVE-2026-119627: Gitea: The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a…N/AN/AN/ANov 1, 2026
CVE-2026-119625: Gitea: The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scopeN/AN/AN/ANov 1, 2026
CVE-2026-119533: Gitea: Repository and organization project boards listed the pull requests that reference each issue on the board without…N/AN/AN/ANov 1, 2026
CVE-2026-119441: Gitea: `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only…N/AN/AN/ANov 1, 2026
CVE-2026-118504: Gitea: The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST…N/AN/AN/ANov 1, 2026
CVE-2026-118395: Gitea: Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories…N/AN/AN/ANov 1, 2026
CVE-2026-118394: Gitea: The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public…N/AN/AN/ANov 1, 2026
CVE-2026-117685: Gitea: The OCI registry's cross-repository blob mount checked the target package against the token's `public-only`…N/AN/AN/ANov 1, 2026
CVE-2026-117677: Gitea: When parsing an uploaded Helm chart, Gitea decompressed the archive and read every tar entry while looking for…N/AN/AN/ANov 1, 2026
CVE-2026-117649: Gitea: The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access,…N/AN/AN/ANov 1, 2026
CVE-2026-117646: Gitea: The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included…N/AN/AN/ANov 1, 2026
CVE-2026-117635: Gitea: The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokensN/AN/AN/ANov 1, 2026
CVE-2026-116474: Gitea: The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email…N/AN/AN/ANov 1, 2026
CVE-2026-116296: Gitea: The API routes for releases, release assets, milestones and repository labels did not reject changes to archived…N/AN/AN/ANov 1, 2026
CVE-2026-116289: Gitea: Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions…N/AN/AN/ANov 1, 2026
CVE-2026-114199: Gitea: `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner…N/AN/AN/ANov 1, 2026
CVE-2026-113429: Gitea: Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that…N/AN/AN/ANov 1, 2026
CVE-2026-112887: Gitea: Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository,…N/AN/AN/ANov 1, 2026
CVE-2026-120263: Gitea: When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account…N/AN/AN/ANov 1, 2026
26-50 of 420636