The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-116081: Fenrir Inc.: Sleipnir Mobile for iPhone / iPad and Sleipnir Mobile for iPhone / iPad Black Edition provided by Fenrir Inc4.2 Medium2.3 LowN/ANov 11, 2026
CVE-2026-63660: mapbox node-fontnik: node-fontnik is a library that delivers a range of glyphs rendered as SDFs (signed distance fields) in a protocol buffer8.1 HighN/AN/ANov 11, 2026
CVE-2026-63194: Bahmni bahmni-core: OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients)N/A8.7 HighN/ANov 11, 2026
CVE-2026-63192: Bahmni bahmni-core: OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients)N/A7.1 HighN/ANov 11, 2026
CVE-2026-126571: padloc: Padloc 4.0.0 before 4.3.1 contains an authentication bypass vulnerability in the legacy retrieveMFAToken handler that…4.8 Medium6.3 MediumN/ANov 11, 2026
CVE-2026-126570: padloc: Padloc 4.0.0 before 4.3.1 contains a prototype pollution vulnerability that allows SCIM token holders to modify…7.6 High7.0 HighN/ANov 11, 2026
CVE-2026-126569: MbinOrg mbin: Mbin 1.2.1 before 1.11.1 contains a stored cross-site scripting vulnerability in EmbedElement::buildDestructed() that…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126567: SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in Special:Ask with the…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126566: SemanticMediaWiki: Semantic MediaWiki 7.3.1 before 7.4.1 contains an incorrect authorization vulnerability in…7.1 High7.1 HighN/ANov 11, 2026
CVE-2026-126565: SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.4.1 contains a denial of service vulnerability in the ElasticStore and SPARQLStore…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126564: SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.4.1 contains a stored cross-site scripting vulnerability in…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126563: SemanticMediaWiki: Semantic MediaWiki 2.4.0 before 7.4.1 contains a reflected cross-site scripting vulnerability in…6.1 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126562: SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.4.1 contains an uncontrolled recursion vulnerability in the ElasticStore…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126561: SemanticMediaWiki: Semantic MediaWiki 2.5.0 before 7.4.1 contains a missing authorization vulnerability that allows editors without the…7.1 High7.1 HighN/ANov 11, 2026
CVE-2026-126560: SemanticMediaWiki: Semantic MediaWiki 3.0.0 before 7.4.1 contains a stored cross-site scripting vulnerability in the DataTables…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126559: SemanticMediaWiki: Semantic MediaWiki 4.2.0 before 7.4.1 contains a stored cross-site scripting vulnerability in…4.8 Medium4.8 MediumN/ANov 11, 2026
CVE-2026-116645: LimeSurvey LimeSurvey Community Edition: LimeSurvey Community Edition 7.8.0 contains an SQL injection vulnerability in the survey-archive participant import and…N/A7.1 HighN/ANov 11, 2026
CVE-2026-126546: Rakuten Viber Viber for iOS: Viber for iOS through 29.4.0.24 fails to validate the logical screen width and height in received GIF headers, allowing…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126545: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in API::get_api_tags() in plugin/API/API.php…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126544: WWBN AVideo: WWBN AVideo 6.5 through 29.7.1 contains an email verification bypass vulnerability in User::verifyCode() in…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126543: WWBN AVideo: WWBN AVideo through 29.7.1 contains an improper payment verification vulnerability in plugin/PayPalYPT/ipnV2.php that…7.5 High8.7 HighN/ANov 11, 2026
CVE-2026-126542: WWBN AVideo: WWBN AVideo 6.5 through 29.7.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to…9.8 Critical9.3 CriticalN/ANov 11, 2026
CVE-2026-126541: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows…8.1 High8.6 HighN/ANov 11, 2026
CVE-2026-126539: directus: Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip…8.1 High9.2 CriticalN/ANov 11, 2026
CVE-2026-126499: jellyfin: Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST…7.4 High8.3 HighN/ANov 11, 2026
26-50 of 557027