The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-118625: MLflow: MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability6.3 MediumN/AN/ANov 3, 2026
CVE-2026-118624: MLflow: MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability5.4 MediumN/AN/ANov 3, 2026
CVE-2026-118623: MLflow: MLflow PickleEvaluationArtifact Deserialization of Untrusted Data Remote Code Execution Vulnerability7.8 HighN/AN/ANov 3, 2026
CVE-2026-121589: spatie url-signer: A weakness has been identified in spatie url-signer up to 2.1.35.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-120651: CGI versions before 5.00 for Perl allow an infinite loop on a short request body when $DISABLE_UPLOADS is setN/AN/AN/ANov 3, 2026
CVE-2026-120650: CGI versions before 5.00 for Perl allow memory, CPU and disk exhaustion via missing or unenforced request size,…N/AN/AN/ANov 3, 2026
CVE-2026-120648: CGI versions before 5.00 for Perl allow HTML injection via text containing --> in commentN/AN/AN/ANov 3, 2026
CVE-2026-120647: CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the…N/AN/AN/ANov 3, 2026
CVE-2026-120646: CGI versions from 4.71 before 5.00 for Perl allow denial of service via a plain string dereferenced as a symbolic…N/AN/AN/ANov 3, 2026
CVE-2026-120645: CGI versions before 5.00 for Perl allow denial of service via submitted values used as a regex for optgroup selection…N/AN/AN/ANov 3, 2026
CVE-2026-120644: CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires…N/AN/AN/ANov 3, 2026
CVE-2026-120643: CGI versions from 4.62 before 5.00 for Perl allow cross-site scripting via a raw apostrophe in URLs returned by url and…N/AN/AN/ANov 3, 2026
CVE-2026-120642: CGI versions before 5.00 for Perl return request-derived values untainted under taint modeN/AN/AN/ANov 3, 2026
CVE-2026-120641: CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows pathsN/AN/AN/ANov 3, 2026
CVE-2026-120640: CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the…N/AN/AN/ANov 3, 2026
CVE-2026-120639: CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and…N/AN/AN/ANov 3, 2026
CVE-2026-120638: CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation…N/AN/AN/ANov 3, 2026
CVE-2026-120637: CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised…N/AN/AN/ANov 3, 2026
CVE-2026-120636: CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and…N/AN/AN/ANov 3, 2026
CVE-2026-120635: CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that…N/AN/AN/ANov 3, 2026
CVE-2026-120634: CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the…N/AN/AN/ANov 3, 2026
CVE-2026-120633: CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and…N/AN/AN/ANov 3, 2026
CVE-2026-120632: CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related…N/AN/AN/ANov 3, 2026
CVE-2026-120631: CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as…N/AN/AN/ANov 3, 2026
CVE-2026-121585: InfiniFlow RAGFlow: A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc24.3 Medium5.3 MediumN/ANov 3, 2026
26-50 of 528356
‹›