The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-97041: Go toolchain: Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external…N/AN/AN/ANov 11, 2026
CVE-2026-97042: Go toolchain: Building a malicious package that uses "//go:cgo_import_dynamic" or links against a crafted PE object on Windows could…N/AN/AN/ANov 11, 2026
CVE-2026-97043: Go toolchain: Building a malicious package that uses cgo could bypass "#cgo LDFLAGS" validation and cause unexpected code execution…N/AN/AN/ANov 11, 2026
CVE-2026-126546: Rakuten Viber Viber for iOS: Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126545: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126544: WWBN AVideo: WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126543: WWBN AVideo: WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that…7.5 High8.7 HighN/ANov 11, 2026
CVE-2026-126542: WWBN AVideo: WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to…9.8 Critical9.3 CriticalN/ANov 11, 2026
CVE-2026-126541: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows…8.1 High8.6 HighN/ANov 11, 2026
CVE-2026-126539: directus: Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip…8.1 High9.2 CriticalN/ANov 11, 2026
CVE-2026-126499: jellyfin: Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST…7.4 High8.3 HighN/ANov 11, 2026
CVE-2026-126498: Musing Studio WriteFreely: WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126497: LibreCAD: LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw…7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-126496: 1Panel-dev CordysCRM: 1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126495: emqx MQTTX: MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject…6.1 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126188: rails: Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record…3.7 LowN/AN/ANov 11, 2026
CVE-2026-20183: Cisco Cisco Identity Services Engine Software: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an…4.3 MediumN/AN/ANov 10, 2026
CVE-2026-126261: Fortinet FortiManager: A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager…9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-126187: react: React is a JavaScript library for building user interfacesN/A9.5 CriticalN/ANov 10, 2026
CVE-2026-123084: Red Hat: An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the…6.5 MediumN/AN/ANov 10, 2026
CVE-2026-0480: AMD: Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a…N/A6.0 MediumN/ANov 10, 2026
CVE-2026-0454: AMD: An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to…N/A4.6 MediumN/ANov 10, 2026
CVE-2026-0435: AMD: Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could…N/A6.0 MediumN/ANov 10, 2026
CVE-2026-0003: AMD: Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted…N/A5.9 MediumN/ANov 10, 2026
CVE-2025-48504: AMD: Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a…N/A6.8 MediumN/ANov 10, 2026
26-50 of 557027