The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-129163: dromara free-fs: Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-129164: dromara free-fs: Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-129165: AmidaWare Tactical RMM: Tactical RMM 0.17.0 through 1.6.1 contains an arbitrary file read in the /reporting/templates/preview/ endpoint because…9.1 Critical9.4 CriticalN/ANov 13, 2026
CVE-2026-129166: keephq Keep: Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-129167: Seafile SeaDoc: Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-129168: Jinnrry PMail: PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid}…6.1 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-129169: Jinnrry PMail: PMail 2.5.0 through 2.9.8 contains a stored cross-site scripting vulnerability that allows authenticated users to…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-129170: vastsa FileCodeBox: FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which…6.1 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-129171: likaia NginxPulse: NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to…9.8 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-129172: tianma-if EdgeEver: EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-128070: nuxt, @nuxt: Nuxt is an open-source web development framework for Vue.js5.9 MediumN/AN/ANov 13, 2026
CVE-2026-128069: rails rails-html-sanitizer: rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications4.7 MediumN/AN/ANov 13, 2026
CVE-2026-63155: Omnispace Agora Project: Omnispace Agora Project through 26.10.0 contains an open redirect vulnerability that allows remote attackers to…6.1 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-63151: Omnispace Agora Project: Omnispace Agora Project through 26.10.0 contains a predictable token generation vulnerability that allows…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-63150: Omnispace Agora Project: Omnispace Agora Project through 26.10.0 contains a cross-site request forgery vulnerability that allows remote…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-129135: private-octopus picoquic: picoquic before 2026.11.05.3e2e3d3 contains an integer overflow vulnerability in picoquic_decode_time_stamp_frame()…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-129134: meeting-room-booking-system mrbs-code: MRBS before 1.13.0 contains a password reset poisoning vulnerability that allows unauthenticated attackers to redirect…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-129133: meeting-room-booking-system mrbs-code: MRBS before 1.13.0 contains a CSV formula injection vulnerability that allows authenticated users to inject spreadsheet…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-129132: meeting-room-booking-system mrbs-code: MRBS before 1.13.0 contains an LDAP injection vulnerability in web/lib/MRBS/Auth/AuthLdap.php that interpolates…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2026-129131: gameyfin: Gameyfin before 2.6.2 contains a missing authorization vulnerability that allows unauthenticated attackers to bypass…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-129130: callstack agent-device: agent-device from 0.21.36 before 0.21.37 contains a local file disclosure vulnerability that allows authenticated…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-129129: beenuar AiSOC: AiSOC 12.1.0 before 23.3.0 contains a missing authentication vulnerability that allows unauthenticated attackers to…6.5 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-129128: aaif-goose goose: Goose CLI 1.35.0 before 1.53.0 contains a local code execution vulnerability that allows attackers to run commands by…7.8 High8.4 HighN/ANov 13, 2026
CVE-2026-129127: dataease SQLBot: SQLBot through 1.10.3 contains a weak password hashing vulnerability that stores local account passwords in…4.4 Medium5.9 MediumN/ANov 13, 2026
CVE-2026-129126: OpenKermit C-Kermit: C-Kermit before 11.1.515 contains a heap buffer overflow vulnerability in putsrv() in ckcfns.c that allows malicious…8.1 High9.2 CriticalN/ANov 13, 2026
26-50 of 532044