The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121451: amir1376 ab-download-manager: AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121450: PAICNI CFNext: CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to…7.5 High7.7 HighN/ANov 3, 2026
CVE-2026-118488: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an…5.9 MediumN/AN/ANov 3, 2026
CVE-2026-100493: AMD AMD Compressionator SDK: An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS…N/A6.9 MediumN/ANov 3, 2026
CVE-2026-40652: AMD AMD Compressionator SDK: An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a…N/A5.2 MediumN/ANov 3, 2026
CVE-2026-40661: AMD AMD Compressionator SDK: An out-of-bounds write (OOW) condition in the AMD Compressonator SDK could allow an attacker with local access to…N/A5.2 MediumN/ANov 3, 2026
CVE-2026-40660: AMD AMD Compressionator SDK: A heap-based out-of-bounds (OOB) read vulnerability in the AMD Compressonator SDK could allow an attacker with local…N/A5.2 MediumN/ANov 3, 2026
CVE-2026-40659: AMD AMD Compressionator SDK: An integer overflow condition in the AMD Compressonator SDK could allow an attacker with local access to supply a…N/A5.1 MediumN/ANov 3, 2026
CVE-2026-43603: AMD: A NULL pointer dereference in the Linux GPU driver could potentially lead to a kernel crash and result in denial of…N/A6.9 MediumN/ANov 3, 2026
CVE-2026-110265: runZero Platform: A specially crafted malformed search query could return results from outside a user's organization6.5 MediumN/AN/ANov 3, 2026
CVE-2026-118489: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…7.5 HighN/AN/ANov 3, 2026
CVE-2026-118527: Ivanti Connect Secure: Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-121449: Finsys dockhand: Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121448: Finsys dockhand: Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and…8.3 High8.7 HighN/ANov 3, 2026
CVE-2026-121447: darylldoyle svg-sanitizer: svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization…6.1 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121446: darylldoyle svg-sanitizer: svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121445: darylldoyle svg-sanitizer: darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121444: darylldoyle svg-sanitizer: svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121443: darylldoyle svg-sanitizer: svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121442: frappe hrms: Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121441: bytecodealliance wasmtime: Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121440: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121439: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121438: lepture mistune: Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121437: lepture mistune: Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU…7.5 High8.7 HighN/ANov 3, 2026
26-50 of 528356
‹›