The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-110194: IBM ContextForge MCP Gateway: IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to server-side request forgery (SSRF)5.4 MediumN/AN/ANov 13, 2026
CVE-2026-110189: IBM ContextForge MCP Gateway: IBM ContextForge MCP Gateway 1.0.8 through 1.0.11, and v1.1.0 is vulnerable to denial of service due to an incomplete…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-110178: IBM ContextForge MCP Gateway: IBM ContextForge MCP Gateway 1.0.0 through 1.0.11 is vulnerable to improper access control in the bulk import path4.1 MediumN/AN/ANov 13, 2026
CVE-2026-109158: IBM: IBM App Connect Operator and IBM App Connect Enterprise Certified Containers Operands may allow the AI Agent to log…7.5 HighN/AN/ANov 13, 2026
CVE-2026-108290: IBM Cyber Fraud: IBM Cyber Fraud 1.0.0 through 1.1.0 could allow an attacker with local access to a container to extract sensitive…4.0 MediumN/AN/ANov 13, 2026
CVE-2026-102632: Devolutions PowerShell Universal: Incorrect privilege assignment in the app token management component in Devolutions PowerShell Universal 2026.3.4 and…N/AN/AN/ANov 13, 2026
CVE-2025-53700: Johnson Controls: CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR…N/A6.3 MediumN/ANov 13, 2026
CVE-2025-53699: Johnson Controls: Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra, Johnson…N/A7.0 HighN/ANov 13, 2026
CVE-2025-53698: Johnson Controls: Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson…N/A7.0 HighN/ANov 13, 2026
CVE-2025-53697: Johnson Controls: Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson…N/A8.4 HighN/ANov 13, 2026
CVE-2025-43874: Johnson Controls: : Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra,…N/A8.7 HighN/ANov 13, 2026
CVE-2026-129173: Stirling-Tools Stirling-PDF: A security flaw has been discovered in Stirling-Tools Stirling-PDF up to 3.3.05.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-92738: HashiCorp: Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests6.8 MediumN/AN/ANov 13, 2026
CVE-2026-89037: dolibarr: Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-82504: VITEC EZ TV Platform Server: VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that…9.8 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-128987: Red Hat Red Hat Enterprise Linux 10: A flaw was found in dbus6.2 MediumN/AN/ANov 13, 2026
CVE-2026-128885: Red Hat Red Hat Enterprise Linux 10: A flaw was found in D-Bus5.5 MediumN/AN/ANov 13, 2026
CVE-2026-128133: Rejected reason: This CVE is a duplicate of another CVE.N/AN/AN/ANov 13, 2026
CVE-2026-128132: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.7 HighN/ANov 13, 2026
CVE-2026-128131: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.7 HighN/ANov 13, 2026
CVE-2026-128130: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.3 HighN/ANov 13, 2026
CVE-2026-128129: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.2 HighN/ANov 13, 2026
CVE-2026-128128: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python7.5 HighN/AN/ANov 13, 2026
CVE-2026-128127: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.7 HighN/ANov 13, 2026
CVE-2026-128126: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.7 HighN/ANov 13, 2026
26-50 of 532044