Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125818: AdvancedCoding wpDiscuz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125817: Themeisle Feedzy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeisle Feedzy…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125804: Meow Apps AI Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125798: Zaytech Smart Online Order for Clover: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Zaytech Smart…7.1 HighN/AN/ANov 15, 2026
CVE-2026-125796: Ahmad JS Help Desk: Missing Authorization vulnerability in Ahmad JS Help Desk js-support-ticket allows Exploiting Incorrectly Configured…6.5 MediumN/AN/ANov 15, 2026
CVE-2026-125760: Bit Apps Bit Assist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bit Apps Bit…7.1 HighN/AN/ANov 15, 2026
CVE-2026-129490: littlefs-project littlefs: littlefs through 2.11.3, when built with LFS_MIGRATE, contains a type confusion vulnerability in lfs_dir_traverse()…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2026-129485: Server-Side Request Forgery (SSRF)5.8 Medium6.9 MediumN/ANov 15, 2026
CVE-2026-129484: Cross-site Scripting (XSS)6.1 Medium5.3 MediumN/ANov 15, 2026
CVE-2025-71470: bellard mquickjs: MicroQuickJS (mquickjs) before commit 99eed3f contains an out-of-bounds read vulnerability because JS_Call() raises…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2025-71469: gpac: GPAC before 26.02.0 contains a type confusion vulnerability in ctxload_process() that passes non-object descriptors to…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2025-71468: gpac: GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_dash_group_get_audio_channels() in…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2025-71467: gpac: GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in gf_node_get_field_by_name() in…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2025-71466: gpac: GPAC before 26.02.0 contains a NULL pointer dereference vulnerability in m2tsdmx_update_sdt() in src/filters/dmx_m2ts.c…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2026-128893: Cross-site Scripting (XSS)7.1 HighN/AN/ANov 15, 2026
CVE-2026-125799: Insertion of Sensitive Information into Externally-Accessible File or Directory7.5 HighN/AN/ANov 15, 2026
CVE-2026-125793: Cross-site Scripting (XSS)7.1 HighN/AN/ANov 15, 2026
CVE-2026-125771: Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub…7.2 HighN/AN/ANov 15, 2026
CVE-2026-125765: Cross-site Scripting (XSS)7.1 HighN/AN/ANov 15, 2026
CVE-2026-125733: Cross-site Scripting (XSS)7.1 HighN/AN/ANov 15, 2026
CVE-2026-125447: Cross-site Scripting (XSS)7.1 HighN/AN/ANov 15, 2026
CVE-2026-125795: Estatik: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…9.8 CriticalN/AN/ANov 15, 2026
CVE-2026-129483: cyrusimap cyrus-sasl: Cyrus SASL through 2.1.28 contains an authentication bypass vulnerability in the SRP server mechanism because…9.1 Critical9.3 CriticalN/ANov 15, 2026
CVE-2026-129482: Square OkHttp: OkHttp through 5.5.1 contains an improper certificate validation vulnerability in CertificatePinner that skips pin…4.8 Medium6.3 MediumN/ANov 15, 2026
CVE-2026-129480: assimp: Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in MD2Importer::InternReadFile that allows…5.3 Medium5.8 MediumN/ANov 15, 2026
26-50 of 426516