The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123020: eosphoros-ai DB-GPT: A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.16.3 Medium2.1 LowN/ANov 5, 2026
CVE-2026-103866: Apache Software Foundation Apache Sling Engine: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling EngineN/AN/AN/ANov 5, 2026
CVE-2026-103864: Apache Software Foundation Apache Sling Engine: Improper output neutralization for logs in Apache Sling EngineN/AN/AN/ANov 5, 2026
CVE-2026-103863: Apache Software Foundation Apache Sling Engine: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling…N/AN/AN/ANov 5, 2026
CVE-2026-123022: agentscope-ai AgentScope: A vulnerability was detected in agentscope-ai AgentScope up to 2.0.117.3 High6.9 MediumN/ANov 5, 2026
CVE-2026-105321: Kobikom Telecommunications and Informatics Services Inc. Kobikom: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Kobikom…7.5 HighN/AN/ANov 5, 2026
CVE-2026-123059: Eclipse Foundation Eclipse BaSyx Helm Charts: In Eclipse BaSyx Helm Charts version 2.2.0 of the `aas-basyx-v2-full` chart, deployments with the bundled Keycloak…7.5 HighN/AN/ANov 5, 2026
CVE-2026-104720: Kobikom Telecommunications and Informatics Services Inc. Kobikom: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Kobikom…7.5 HighN/AN/ANov 5, 2026
CVE-2026-123019: eosphoros-ai DB-GPT: A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.27.3 High5.5 MediumN/ANov 5, 2026
CVE-2026-121489: Apache Software Foundation Apache Juneau: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-96677: Apache Software Foundation Apache Juneau: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73117: Apache Software Foundation Apache Juneau: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73116: Apache Software Foundation Apache Juneau: Insufficiently Protected Credentials vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73101: Apache Software Foundation Apache Juneau: Generation of Error Message Containing Sensitive Information vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73100: Apache Software Foundation Apache Juneau: Insertion of Sensitive Information into Log File vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73099: Apache Software Foundation Apache Juneau: Cross-Site Request Forgery (CSRF) vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73098: Apache Software Foundation Apache Juneau: Improper control of dynamically-loaded code vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73095: Apache Software Foundation Apache Juneau: Allocation of Resources Without Limits or Throttling vulnerability in Apache JuneauN/A8.7 HighN/ANov 5, 2026
CVE-2026-123018: eosphoros-ai DB-GPT: A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.28.3 High5.5 MediumN/ANov 5, 2026
CVE-2026-123036: Red Hat ansible-core: A flaw was found in ansible-core5.5 MediumN/AN/ANov 5, 2026
CVE-2026-118869: SHIRASAGI Project SHIRASAGI: An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute…8.8 High8.7 HighN/ANov 5, 2026
CVE-2026-117679: SHIRASAGI Project SHIRASAGI: A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute…5.4 Medium5.1 MediumN/ANov 5, 2026
CVE-2026-112072: jopenlibs vault-java-driver: vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser…6.5 MediumN/AN/ANov 5, 2026
CVE-2026-109408: jopenlibs vault-java-driver: vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in…7.4 HighN/AN/ANov 5, 2026
CVE-2026-107776: Unknown Dokan: The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger…2.2 LowN/AN/ANov 5, 2026
26-50 of 418286
‹›