The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126285: nocodb: NocoDB before 2026.08.0 contains an sql injection vulnerability that allows authenticated users with read access to run…7.7 High8.3 HighN/ANov 13, 2026
CVE-2026-126284: nocodb: NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role…3.1 Low2.3 LowN/ANov 13, 2026
CVE-2026-126283: nocodb: NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126282: nocodb: NocoDB from 2026.04.0 before 2026.08.0 contains an improper privilege management vulnerability in org-users.service.ts…8.0 High8.6 HighN/ANov 13, 2026
CVE-2026-126281: nocodb: NocoDB before 2026.08.0 contains a missing authorization vulnerability in the copy-from branch of integration creation…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126280: nocodb: NocoDB before 2026.08.0 contains a race condition in refresh-token rotation that allows attackers to reuse tokens…7.4 High9.1 CriticalN/ANov 13, 2026
CVE-2026-126279: nocodb: NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders…6.3 Medium7.0 HighN/ANov 13, 2026
CVE-2026-126278: nocodb: NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126277: nocodb: NocoDB before 2026.08.1 contains an uncontrolled resource consumption vulnerability that allows unauthenticated…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126276: nocodb: NocoDB before 2026.08.1 contains an authentication bypass vulnerability in oauth-token.service.ts that treats PKCE as a…6.3 Medium8.2 HighN/ANov 13, 2026
CVE-2026-126275: nocodb: NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126274: nocodb: NocoDB before 2026.08.0 contains a stored cross-site scripting vulnerability that allows authenticated Creator users to…8.7 High9.3 CriticalN/ANov 13, 2026
CVE-2026-126273: nocodb: NocoDB before 2026.09.0 contains a privilege escalation vulnerability in initAdminFromEnv.ts that silently skips…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-126272: nocodb: NocoDB before 2026.09.0 contains an uncontrolled resource consumption vulnerability that allows authenticated users to…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126271: nocodb: NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to…7.7 High8.3 HighN/ANov 13, 2026
CVE-2026-126270: nocodb: NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of…6.5 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126269: nocodb: NocoDB before 2026.09.0 contains a stored cross-site scripting vulnerability that allows authenticated Editor users to…8.7 High9.3 CriticalN/ANov 13, 2026
CVE-2026-126268: nocodb: NocoDB before 2026.08.0 contains an IP address spoofing vulnerability that allows unauthenticated attackers to forge…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126267: nocodb: NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126266: siyuan-note siyuan: SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126265: siyuan-note siyuan: SiYuan 2.1.0 before 3.8.9 contains a flaw where the loginAuth CAPTCHA challenge lives in a signed client-side cookie,…7.4 High9.1 CriticalN/ANov 13, 2026
CVE-2026-126264: siyuan-note siyuan: SiYuan before 3.8.9 contains an information disclosure vulnerability that allows authenticated Reader users to retrieve…7.7 High8.3 HighN/ANov 13, 2026
CVE-2026-126029: wpzoom WPZOOM Addons for Elementor – Starter Templates & Widgets: The WPZOOM Addons for Elementor – Starter Templates & Widgets plugin for WordPress is vulnerable to Stored Cross-Site…6.4 MediumN/AN/ANov 13, 2026
CVE-2026-125948: wpzoom Recipe Card Blocks Lite: The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text'…6.4 MediumN/AN/ANov 13, 2026
CVE-2026-125409: wpchill Passster – Password Protect Pages and Content: The Passster – Password Protect Pages and Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…6.4 MediumN/AN/ANov 13, 2026
501-525 of 532044