The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120641: CGI versions before 5.00 for Perl return upload filenames with any client-supplied path, including ../ and Windows pathsN/AN/AN/ANov 3, 2026
CVE-2026-120640: CGI versions before 5.00 for Perl allow the POSTDATA, PUTDATA, PATCHDATA and XForms:Model parameters to be set from the…N/AN/AN/ANov 3, 2026
CVE-2026-120639: CGI versions before 5.00 for Perl allow HTTP header injection via entity decoding after the newline check in header and…N/AN/AN/ANov 3, 2026
CVE-2026-120638: CGI versions before 5.00 for Perl allow open redirects via HTML entity decoding of the URL after application validation…N/AN/AN/ANov 3, 2026
CVE-2026-120637: CGI versions before 5.00 for Perl take request parameters from the process command line arguments for an unrecognised…N/AN/AN/ANov 3, 2026
CVE-2026-120636: CGI versions before 5.00 for Perl allow open redirects and script injection via URLs built from REQUEST_URI in url and…N/AN/AN/ANov 3, 2026
CVE-2026-120635: CGI versions before 5.00 for Perl allow form fields to be smuggled past proxies and WAFs via multipart parsing that…N/AN/AN/ANov 3, 2026
CVE-2026-120634: CGI::Carp versions before 5.00 for Perl leak warnings across requests in persistent environments via the…N/AN/AN/ANov 3, 2026
CVE-2026-120633: CGI versions before 5.00 for Perl trust the client X-Forwarded-Host header in url, self_url, virtual_host and…N/AN/AN/ANov 3, 2026
CVE-2026-120632: CGI versions before 5.00 for Perl allow CPU exhaustion via a backtracking regex on the XForms multipart/related…N/AN/AN/ANov 3, 2026
CVE-2026-120631: CGI::Cookie versions from 4.67 before 5.00 for Perl allow denial of service via the client cookie expires value used as…N/AN/AN/ANov 3, 2026
CVE-2026-121585: InfiniFlow RAGFlow: A security flaw has been discovered in InfiniFlow RAGFlow up to 0.27.2/1.0.0-rc24.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121736: nocodb: NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121735: blueprintue blueprintue-self-hosted-edition: blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121734: zane-ops: ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to…6.5 Medium6.0 MediumN/ANov 3, 2026
CVE-2026-121733: Webkul Bagisto: Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload…5.4 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121732: francoisjacquet RosarioSIS: RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to…2.7 Low2.1 LowN/ANov 3, 2026
CVE-2026-121731: francoisjacquet RosarioSIS: RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121730: 0xdps emailflare: emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121729: 0xdps emailflare: emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes…8.3 High7.2 HighN/ANov 3, 2026
CVE-2026-121728: SourceHut meta.sr.ht: SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121727: jorisvink kore: Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121582: n/a Umami: A vulnerability has been found in Umami up to 3.4.16.5 Medium5.5 MediumN/ANov 3, 2026
CVE-2026-121581: n/a ArcReel: A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.04.3 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121565: Tanium: Tanium addressed an improper certificate validation vulnerability in multiple products7.4 HighN/AN/ANov 3, 2026
26-50 of 528356
‹›