The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-114235: Apache Software Foundation Apache OFBiz: Direct Request ('Forced Browsing') in the Order component in Apache OFBiz 24.09 before 24.09.08 on all platforms allows…N/AN/AN/ANov 5, 2026
CVE-2026-114233: Apache Software Foundation Apache OFBiz: Incorrect Privilege Assignment in the Order Manager in Apache OFBiz 24.09 before 24.09.08 on all platforms allows an…N/AN/AN/ANov 5, 2026
CVE-2026-114229: Apache Software Foundation Apache OFBiz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in the Catalog image viewer in…N/AN/AN/ANov 5, 2026
CVE-2026-109928: Apache Software Foundation Apache OFBiz: Incorrect Implementation of Authentication Algorithm in the password-reset and login JWT validation in Apache OFBiz…N/AN/AN/ANov 5, 2026
CVE-2026-109856: Apache Software Foundation Apache OFBiz: Direct Request ('Forced Browsing') to Financial Account services in Apache OFBiz 24.09 before 24.09.08 on all platforms…N/AN/AN/ANov 5, 2026
CVE-2026-109837: Apache Software Foundation Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns in Apache OFBiz 24.09 before 24.09.08 on all…N/AN/AN/ANov 5, 2026
CVE-2026-109129: Apache Software Foundation Apache OFBiz: Authorization Bypass Through User-Controlled Key in the Order Manager component in Apache OFBiz 24.09.07 on all…N/AN/AN/ANov 5, 2026
CVE-2026-107912: Red Hat: A flaw was found in the management interface of the Quarkus framework, specifically within the quarkus-vertx-http…7.7 HighN/AN/ANov 5, 2026
CVE-2026-105461: Apache Software Foundation Apache OFBiz: Missing check for ORDERMGR_UPDATE in ordermgr allows user with only ORDERMGR_VIEW permission to update ordersN/AN/AN/ANov 5, 2026
CVE-2026-105330: Apache Software Foundation Apache OFBiz: Use of Hard-coded Cryptographic Key in JWT token authentication in Apache OFBiz 24.09.06 and 24.09.07 on all platforms…N/AN/AN/ANov 5, 2026
CVE-2026-105325: Apache Software Foundation Apache OFBiz: Missing check for ACCOUNTING_UPDATE / ACCOUNTING_CREATE in accounting in allows user with only ACCOUNTING_VIEW…N/AN/AN/ANov 5, 2026
CVE-2026-105321: Kobikom Telecommunications and Informatics Services Inc. Kobikom: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Kobikom…7.5 HighN/AN/ANov 5, 2026
CVE-2026-104720: Kobikom Telecommunications and Informatics Services Inc. Kobikom: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Kobikom…7.5 HighN/AN/ANov 5, 2026
CVE-2026-100228: Apache Software Foundation Apache OFBiz: Improper Input Validation in Order Returns in Apache OFBiz 24.09.07 on all platforms allows an authenticated user…N/AN/AN/ANov 5, 2026
CVE-2026-100168: Apache Software Foundation Apache OFBiz: Direct Request ('Forced Browsing') in the Content Manager component in Apache OFBiz 24.09.07 on all platforms allows an…N/AN/AN/ANov 5, 2026
CVE-2026-95652: TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter: Execution with unnecessary privileges vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute…6.6 MediumN/AN/ANov 5, 2026
CVE-2026-123119: sensiolabs symfony: The Symfony HttpClient component NoPrivateNetworkHttpClient does not pin the checked IP address of cached hosts,…N/A2.3 LowN/ANov 5, 2026
CVE-2026-123047: Eclipse Foundation Eclipse BaSyx Helm Charts: In Eclipse BaSyx Helm Charts versions 3.0.0-rc.1 to 3.12.1 of the `basyx` chart, deployments with the bundled Keycloak…7.5 HighN/AN/ANov 5, 2026
CVE-2026-123020: eosphoros-ai DB-GPT: A security vulnerability has been detected in eosphoros-ai DB-GPT up to 0.8.16.3 Medium2.1 LowN/ANov 5, 2026
CVE-2026-103866: Apache Software Foundation Apache Sling Engine: Inconsistent interpretation of HTTP requests ('HTTP Request/Response smuggling') vulnerability in Apache Sling EngineN/AN/AN/ANov 5, 2026
CVE-2026-103864: Apache Software Foundation Apache Sling Engine: Improper output neutralization for logs in Apache Sling EngineN/AN/AN/ANov 5, 2026
CVE-2026-103863: Apache Software Foundation Apache Sling Engine: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Apache Sling…N/AN/AN/ANov 5, 2026
CVE-2026-96677: Apache Software Foundation Apache Juneau: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73117: Apache Software Foundation Apache Juneau: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73116: Apache Software Foundation Apache Juneau: Insufficiently Protected Credentials vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
26-50 of 556715
‹›