The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126410: bytecodealliance wasmtime: Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a…6.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126409: bytecodealliance wasmtime: Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion…2.0 Low1.8 LowN/ANov 13, 2026
CVE-2026-125659: eMudhra emBridge: This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpointsN/A2.1 LowN/ANov 13, 2026
CVE-2026-126407: bytecodealliance wasmtime: Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host…4.8 Medium5.9 MediumN/ANov 13, 2026
CVE-2026-126406: bytecodealliance wasmtime: The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-126405: coder: Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126403: coder: Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before…6.5 Medium8.5 HighN/ANov 13, 2026
CVE-2026-126402: fleetdm fleet: Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-126401: fleetdm fleet: Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126399: vllm-project vllm: vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126398: vllm-project vllm: vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-126397: vllm-project vllm: vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126395: vllm-project vllm: vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126394: vllm-project vllm: vLLM 0.30.0 before 0.31.0 contains a resource exhaustion vulnerability in OpenCVDynamicOpenPanguVideoBackend, which…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126393: siyuan-note siyuan: SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because…6.1 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126391: n8n-io n8n: n8n before 1.123.89 contains an insufficient isolation vulnerability in workflow expression evaluation that allows…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-126390: n8n-io n8n: n8n before 1.123.89 contains a credential leakage vulnerability in the NocoDB node that sends the configured NocoDB API…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-126389: n8n-io n8n: n8n before 1.123.89 contains an authentication bypass vulnerability in the Chat Trigger that allows unauthenticated…5.4 Medium6.3 MediumN/ANov 13, 2026
CVE-2026-126387: n8n-io n8n: n8n before 2.46.1 contains an arbitrary file read vulnerability that allows authenticated members to read server files…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126386: n8n-io n8n: n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains an open redirect…4.7 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126385: n8n-io n8n: n8n before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a flaw in the OAuth2 credential callback of the…7.7 High4.8 MediumN/ANov 13, 2026
CVE-2026-126383: n8n-io n8n: n8n before 1.123.89, 2.x before 2.45.5, 2.46.x before 2.46.1, and 3.x before 3.0.1 contains a NoSQL injection…8.2 High5.3 MediumN/ANov 13, 2026
CVE-2026-126382: n8n-io n8n: n8n before 2.38.0 and 3.x before 3.0.1 contains a missing authentication vulnerability in the Asana Trigger that…5.4 Medium6.3 MediumN/ANov 13, 2026
CVE-2026-126381: n8n-io n8n: n8n before 2.43.5, 2.44.x before 2.44.1, and 3.x before 3.0.1 contains an SQL injection vulnerability in the Vector…6.3 Medium4.9 MediumN/ANov 13, 2026
CVE-2026-126379: givanz Vvveb: Vvveb 1.0.8.6 contains an incomplete server-side request forgery fix that allows authenticated admin users to bypass…7.6 High8.3 HighN/ANov 13, 2026
476-500 of 532044