Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-129467: tess1o GeoPulse: GeoPulse 1.5.0 through 2.3.0 contains an insecure direct object reference vulnerability in GET…4.3 Medium5.3 MediumN/ANov 15, 2026
CVE-2026-129452: DrayTek Vigor2960: A vulnerability has been found in DrayTek Vigor2960 1.5.1.69.1 Critical8.5 HighN/ANov 15, 2026
CVE-2026-129451: DrayTek Vigor2960: A flaw has been found in DrayTek Vigor2960 up to 1.5.1.69.9 Critical8.6 HighN/ANov 15, 2026
CVE-2026-129477: assimp: Assimp through 6.0.6 contains a path traversal vulnerability in the glTF and glTF2 importers that allows attackers to…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2026-129478: assimp: Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in glTFCommon::Util::ParseDataURI caused by…6.1 Medium6.9 MediumN/ANov 15, 2026
CVE-2026-129479: assimp: Assimp through 6.0.6 contains an integer overflow vulnerability in OgreBinarySerializer::ReadSubMesh that allows…5.5 Medium6.8 MediumN/ANov 15, 2026
CVE-2026-129480: assimp: Assimp through 6.0.6 contains a heap out-of-bounds read vulnerability in MD2Importer::InternReadFile that allows…5.3 Medium5.8 MediumN/ANov 15, 2026
CVE-2026-129450: DrayTek Vigor2960: A vulnerability was detected in DrayTek Vigor2960 1.5.1.69.9 Critical8.6 HighN/ANov 15, 2026
CVE-2026-129449: DrayTek Vigor2960: A security vulnerability has been detected in DrayTek Vigor2960 up to 1.5.1.69.9 Critical8.6 HighN/ANov 15, 2026
CVE-2026-82663: GiveWP Give - Peer-to-Peer: The Give - Peer-to-Peer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and…7.5 HighN/AN/ANov 15, 2026
CVE-2026-82568: GiveWP Give - Peer-to-Peer: The Give - Peer-to-Peer plugin for WordPress is vulnerable to time-based SQL Injection via the 'sort' parameter in all…7.5 HighN/AN/ANov 15, 2026
CVE-2026-129445: D-Link DIR-850L: A security flaw has been discovered in D-Link DIR-850L FW1.20WWb038.2 High8.4 HighN/ANov 15, 2026
CVE-2026-129349: Apache Software Foundation Apache Shiro: When authentication caching is enabled on DefaultLdapRealm, after a user logs in successfully once, subsequent logins…N/A9.1 CriticalN/ANov 15, 2026
CVE-2026-129444: D-Link DSL-6740C: A vulnerability was identified in D-Link DSL-6740C 2013112610.0 Critical9.3 CriticalN/ANov 15, 2026
CVE-2026-129443: itsourcecode Airline Reservation System: A vulnerability was determined in itsourcecode Airline Reservation System 1.06.3 Medium2.1 LowN/ANov 15, 2026
CVE-2026-127048: Unknown Custom Block Builder: The Custom Block Builder WordPress plugin before 3.0.0 does not properly deny unauthorised requests to its REST routes,…N/AN/AN/ANov 15, 2026
CVE-2026-124673: Unknown Burst Statistics: The Burst Statistics WordPress plugin before 3.7.5 does not check that a reported page view belongs to published…N/AN/AN/ANov 15, 2026
CVE-2026-124671: Unknown Burst Statistics: The Burst Statistics WordPress plugin before 3.7.5 does not enforce a shared report's date range on the analytics it…N/AN/AN/ANov 15, 2026
CVE-2026-123707: Unknown WPGraphQL: The WPGraphQL WordPress plugin before 2.27.1 does not restrict access to posts in custom non-public post statuses,…N/AN/AN/ANov 15, 2026
CVE-2026-116559: Unknown A2Reviews: The A2Reviews WordPress plugin through 1.2.3 does not properly verify authorization on several of its API command…N/AN/AN/ANov 15, 2026
CVE-2026-114452: Unknown Membership Plugin: The Membership Plugin WordPress plugin before 4.0.6 does not verify that the membership referenced in a saved-card…N/AN/AN/ANov 15, 2026
CVE-2026-114451: Unknown Membership Plugin: The Membership Plugin WordPress plugin before 4.0.6 does not perform any authorization or CSRF check before running a…N/AN/AN/ANov 15, 2026
CVE-2026-110989: Unknown RegistrationMagic: The RegistrationMagic WordPress plugin before 6.1.0.4 does not verify ownership of the submitted email address before…N/AN/AN/ANov 15, 2026
CVE-2026-110987: Unknown RegistrationMagic: The RegistrationMagic WordPress plugin before 6.1.0.4 does not properly escape a user-supplied value before printing it…N/AN/AN/ANov 15, 2026
CVE-2026-110984: Unknown RegistrationMagic: The RegistrationMagic WordPress plugin before 6.1.0.4 does not sanitise and escape a parameter before using it in a SQL…N/AN/AN/ANov 15, 2026
26-50 of 561732