The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-119275: Akaunting: Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflowN/A7.0 HighN/ANov 12, 2026
CVE-2026-118495: Datasolution AcyMailing extension for Joomla and WordPress: Joomla / WordPress Extension - acymailing.com - Exposure of sensitive information to an unauthorized actor in…N/A8.8 HighN/ANov 12, 2026
CVE-2026-117551: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend…N/A10.0 CriticalN/ANov 12, 2026
CVE-2026-117550: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend…N/A7.1 HighN/ANov 12, 2026
CVE-2026-117543: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - SSRF via external download URL field jDownloads < 4.1.8 - HTTP redirects when…N/A8.9 HighN/ANov 12, 2026
CVE-2026-107365: Grafana: A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other…N/A5.3 MediumN/ANov 12, 2026
CVE-2026-106475: Grafana: The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data…7.1 HighN/AN/ANov 12, 2026
CVE-2026-106472: Grafana: Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server…6.3 MediumN/AN/ANov 12, 2026
CVE-2026-106154: Progress Software Telerik UI for ASP.NET Core: In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser…8.6 HighN/AN/ANov 12, 2026
CVE-2026-106146: Progress Software Telerik UI for ASP.NET MVC: In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing…8.6 HighN/AN/ANov 12, 2026
CVE-2026-120033: frrouting: In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires,…N/A6.0 MediumN/ANov 12, 2026
CVE-2026-117544: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id`…N/A8.2 HighN/ANov 12, 2026
CVE-2026-126203: flavorjones loofah: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri6.1 MediumN/AN/ANov 12, 2026
CVE-2026-127235: The OpenNMS Group: A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS…6.1 MediumN/AN/ANov 12, 2026
CVE-2026-121619: sensiolabs symfony: The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies() method…N/A6.3 MediumN/ANov 12, 2026
CVE-2026-117542: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file`…N/A5.1 MediumN/ANov 12, 2026
CVE-2026-127236: The OpenNMS Group: An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and…5.4 MediumN/AN/ANov 12, 2026
CVE-2026-120467: Datasolution AcyMailing extension for Joomla and WordPress: Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing…N/A7.1 HighN/ANov 12, 2026
CVE-2026-82977: WebPros Plesk: The Plesk GoAccess statistics integration in Plesk Obsidian for Linux, versions 18.0.77 to 18.0.81.7, 18.0.82 to…N/A8.4 HighN/ANov 12, 2026
CVE-2026-82032: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/ANov 12, 2026
CVE-2026-16052: Python Software Foundation CPython: The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output…N/A2.3 LowN/ANov 12, 2026
CVE-2026-127203: AppFlowy-IO AppFlowy-Cloud: AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace…5.4 Medium5.1 MediumN/ANov 12, 2026
CVE-2026-127202: mlflow: MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated…5.3 Medium6.3 MediumN/ANov 12, 2026
CVE-2026-127030: Red Hat: A flaw was found in freeradius7.5 HighN/AN/ANov 12, 2026
CVE-2026-127029: Red Hat: A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM)…7.5 HighN/AN/ANov 12, 2026
26-50 of 433023