The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126374: givanz Vvveb: Vvveb through 1.0.8.6 contains an SQL injection vulnerability because the @KEYS(:each) macro emits PHP array keys as…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126373: givanz Vvveb: Vvveb 1.0.8.4 through 1.0.8.6 contains an authorization bypass vulnerability in the content/revisions revision action…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126372: givanz Vvveb: Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126371: givanz Vvveb: Vvveb through 1.0.8.6 contains an SQL injection vulnerability in Admin_Auth_TokenSQL::update(), which interpolates…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126370: givanz Vvveb: Vvveb through 1.0.8.6 contains a remote code execution vulnerability allowing restricted site_admin roles to inject PHP…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126369: givanz Vvveb: Vvveb through 1.0.8.6 contains a stored cross-site scripting vulnerability that allows low-privilege author or vendor…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126322: openemr: OpenEMR before 8.3.0 contains an unsanitized deserialization vulnerability that allows authenticated attackers to…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126321: Finsys dockhand: Dockhand before 1.0.55 contains a path traversal vulnerability that allows authenticated users with stacks:edit to…8.3 High7.2 HighN/ANov 13, 2026
CVE-2026-126320: Finsys dockhand: Dockhand before 1.0.55 contains an improper authorization vulnerability that lets users holding only containers:view…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126319: Finsys dockhand: Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126318: redaxo core: REDAXO before 5.21.6 contains an authorization bypass vulnerability that allows editors without the…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126316: frappe hrms: Frappe HRMS from 16.0.0 before 16.20.1 contains an information exposure vulnerability that places the subscription key…2.2 Low2.1 LowN/ANov 13, 2026
CVE-2026-126315: frappe hrms: Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's…9.8 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-126314: frappe hrms: Frappe HRMS 15.0.0 before 15.64.6 and 16.0.0 before 16.20.1 does not check access to each employee on endpoints that…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126313: frappe hrms: Frappe HRMS 16.0.0 before 16.20.1 contains an authorization bypass because an ownership check is missing on a record…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126312: openbao: OpenBao before 2.6.5 and 2.7.x before 2.7.2, and the openbao-plugins LDAP and RADIUS auth plugins before 0.2.0, contain…7.1 High7.6 HighN/ANov 13, 2026
CVE-2026-126311: openbao: OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals…5.8 Medium4.6 MediumN/ANov 13, 2026
CVE-2026-126310: openbao: OpenBao before 2.6.5 and 2.7.2 contains an authentication bypass vulnerability that allows unauthenticated callers to…8.7 High7.0 HighN/ANov 13, 2026
CVE-2026-126309: openbao: OpenBao before 2.6.5 and 2.7.2 contains a path traversal vulnerability in Transit key import that allows authenticated…7.1 High7.6 HighN/ANov 13, 2026
CVE-2026-126308: coder: The web dashboard in Coder 2.24.0 before 2.29.23, 2.30.0 before 2.34.14, 2.35.0 before 2.36.9, 2.37.0 before 2.37.6,…7.7 High8.7 HighN/ANov 13, 2026
CVE-2026-126307: nezhahq nezha: Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126306: espocrm: EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a stored cross-site scripting vulnerability that allows…8.0 High8.6 HighN/ANov 13, 2026
CVE-2026-126305: espocrm: EspoCRM before 9.3.11 and 10.x before 10.0.9 contains a stored cross-site scripting vulnerability in Knowledge Base…7.3 High8.5 HighN/ANov 13, 2026
CVE-2026-126304: nltk: NLTK from 3.10.0 before 3.10.4 contains a symlink escape vulnerability in YCOECorpusReader that allows attackers to…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126303: nltk: NLTK before 3.10.4 contains an uncontrolled resource consumption vulnerability in…7.5 High8.7 HighN/ANov 13, 2026
501-525 of 532044