Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-129454: izhaorui Zr.Admin.NET: Zr.Admin.NET commit 85cff6a through commit eb9228a contains an insecure direct object reference vulnerability in GET…6.5 Medium7.1 HighN/ANov 15, 2026
CVE-2026-129356: vllm-project vllm: A vulnerability was found in vllm-project vllm 0.30.0/0.31.05.0 Medium1.3 LowN/ANov 15, 2026
CVE-2026-129355: sigoden dufs: A vulnerability has been found in sigoden dufs up to 0.46.06.5 Medium6.9 MediumN/ANov 15, 2026
CVE-2026-129354: D-Link DIR-600L: A flaw has been found in D-Link DIR-600L 2.17b0210.0 Critical9.3 CriticalN/ANov 15, 2026
CVE-2026-129353: D-Link DIR-600L: A vulnerability was detected in D-Link DIR-600L 2.17/2.17b0210.0 Critical9.3 CriticalN/ANov 15, 2026
CVE-2026-129352: TRENDnet TEW-657BRM: A vulnerability was detected in TRENDnet TEW-657BRM 1.00.19.1 Critical8.5 HighN/ANov 14, 2026
CVE-2026-129351: TRENDnet TEW-657BRM: A security vulnerability has been detected in TRENDnet TEW-657BRM 1.00.110.0 Critical9.3 CriticalN/ANov 14, 2026
CVE-2026-129456: frrouting: In FRRouting, bgpd accepts a Tunnel Encapsulation attribute (type 23) whose outer TLV length does not match the length…N/A7.7 HighN/ANov 14, 2026
CVE-2015-10149: Improper Validation of Syntactic Correctness of InputN/AN/AN/ANov 14, 2026
CVE-2026-129267: sergix44 XBackBone: A vulnerability was found in sergix44 XBackBone up to 3.8.23.5 Low2.0 LowN/ANov 14, 2026
CVE-2026-129447: yuzutech kroki: Kroki before 0.36.0 contains a reflected cross-site scripting vulnerability in the /dbml/svg endpoint that allows…6.1 Medium5.3 MediumN/ANov 14, 2026
CVE-2026-129264: n/a sox_ng: A security vulnerability has been detected in sox_ng up to 14.8.15.5 Medium2.0 LowN/ANov 14, 2026
CVE-2026-129262: Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System: A weakness has been identified in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management…7.3 High5.5 MediumN/ANov 14, 2026
CVE-2026-129261: Kingston FURY CTRL RGB Control Software: A vulnerability was found in Kingston FURY CTRL RGB Control Software up to 2.0.66.08.2 High9.3 CriticalN/ANov 14, 2026
CVE-2026-129260: Mereithhh VanBlog: A security vulnerability has been detected in Mereithhh VanBlog up to 0.54.06.6 Medium2.0 LowN/ANov 14, 2026
CVE-2026-116753: ninjateam Multi Step for Contact Form 7: The Multi Step for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'multipart…7.2 HighN/AN/ANov 14, 2026
CVE-2026-127115: themekraft BuddyForms: The BuddyForms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buddyforms_form_content'…5.4 MediumN/AN/ANov 14, 2026
CVE-2026-120687: fooplugins Lightbox & Modal Popup WordPress Plugin – FooBox: The Lightbox & Modal Popup WordPress Plugin – FooBox plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…7.2 HighN/AN/ANov 14, 2026
CVE-2026-110531: foliovision FV Player 8: The FV Player 8 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'fv_player_videos' parameter…6.4 MediumN/AN/ANov 14, 2026
CVE-2026-129258: Insufficient Verification of Data Authenticity9.1 Critical8.5 HighN/ANov 14, 2026
CVE-2026-129259: Mereithhh VanBlog: A weakness has been identified in Mereithhh VanBlog up to 0.54.03.5 Low2.0 LowN/ANov 14, 2026
CVE-2011-10042: CRLF InjectionN/AN/AN/ANov 14, 2026
CVE-2026-19907: Shipo: The Shipo plugin for WordPress is vulnerable to Authentication Bypass in versions 1.6 through 1.8.09.8 CriticalN/AN/ANov 14, 2026
CVE-2026-18053: LearnDash MemberDash: The MemberDash plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.8.78.8 HighN/AN/ANov 14, 2026
CVE-2026-129433: dokploy: Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows…9.9 Critical9.4 CriticalN/ANov 14, 2026
26-50 of 561732