Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125447: Cross-site Scripting (XSS)7.1 HighN/AN/ANov 15, 2026
CVE-2026-125795: Estatik: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…9.8 CriticalN/AN/ANov 15, 2026
CVE-2026-129483: cyrusimap cyrus-sasl: Cyrus SASL through 2.1.28 contains an authentication bypass vulnerability in the SRP server mechanism because…9.1 Critical9.3 CriticalN/ANov 15, 2026
CVE-2026-129482: Square OkHttp: OkHttp through 5.5.1 contains an improper certificate validation vulnerability in CertificatePinner that skips pin…4.8 Medium6.3 MediumN/ANov 15, 2026
CVE-2026-129480: assimp: Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in MD2Importer::InternReadFile that allows…5.3 Medium5.8 MediumN/ANov 15, 2026
CVE-2026-129479: assimp: Assimp through 6.0.6 contains an integer overflow vulnerability in OgreBinarySerializer::ReadSubMesh that allows…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2026-129478: assimp: Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in glTFCommon::Util::ParseDataURI caused by…6.1 Medium6.9 MediumN/ANov 15, 2026
CVE-2026-129477: assimp: Assimp through 6.0.6 contains a path traversal vulnerability in the glTF and glTF2 importers that allows attackers to…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2026-129453: DrayTek Vigor2960: A vulnerability was found in DrayTek Vigor2960 1.5.1.69.9 Critical8.6 HighN/ANov 15, 2026
CVE-2026-125857: Sarah Giles Dynamic User Directory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Sarah Giles…6.5 MediumN/AN/ANov 15, 2026
CVE-2026-125832: Passionate Programmer Peter WP Data Access: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Passionate…8.5 HighN/AN/ANov 15, 2026
CVE-2026-125828: Liquid Web / StellarWP BookIt: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125813: Ays Pro Survey Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Survey…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125805: AyeCode Ltd GeoDirectory: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AyeCode Ltd…6.5 MediumN/AN/ANov 15, 2026
CVE-2026-125791: iWorks Orphans: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in iWorks Orphans…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125790: e4jvikwp VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125789: e4jvikwp VikBooking Hotel Booking Engine & PMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125780: Acowebs Woocommerce Custom Product Addons Pro: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Acowebs Woocommerce…7.5 HighN/AN/ANov 15, 2026
CVE-2026-125775: CRM Perks CRM Perks Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CRM Perks CRM…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125769: Nasir Ahmed Advanced Form Integration: Incorrect Privilege Assignment vulnerability in Nasir Ahmed Advanced Form Integration advanced-form-integration allows…9.8 CriticalN/AN/ANov 15, 2026
CVE-2026-125764: E2Pdf.com e2pdf: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in E2Pdf.com e2pdf…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125449: Mamunur Rashid Testimonial Slider: Deserialization of Untrusted Data vulnerability in Mamunur Rashid Testimonial Slider testimonial-slider-and-showcase…8.8 HighN/AN/ANov 15, 2026
CVE-2026-125443: Denishua WPJAM Basic: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Denishua WPJAM…7.1 HighN/AN/ANov 15, 2026
CVE-2026-124995: Michal Jaworski: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Michal Jaworski…7.1 HighN/AN/ANov 15, 2026
CVE-2026-124755: Justin Kruit Advanced Custom Fields: Font Awesome Field: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Justin Kruit…6.5 MediumN/AN/ANov 15, 2026
26-50 of 426516