The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-73099: Apache Software Foundation Apache Juneau: Cross-Site Request Forgery (CSRF) vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73098: Apache Software Foundation Apache Juneau: Improper control of dynamically-loaded code vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-73095: Apache Software Foundation Apache Juneau: Allocation of Resources Without Limits or Throttling vulnerability in Apache JuneauN/A8.7 HighN/ANov 5, 2026
CVE-2026-123019: eosphoros-ai DB-GPT: A weakness has been identified in eosphoros-ai DB-GPT up to 0.8.27.3 High5.5 MediumN/ANov 5, 2026
CVE-2026-123018: eosphoros-ai DB-GPT: A security flaw has been discovered in eosphoros-ai DB-GPT up to 0.8.28.3 High5.5 MediumN/ANov 5, 2026
CVE-2026-121489: Apache Software Foundation Apache Juneau: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache JuneauN/A10.0 CriticalN/ANov 5, 2026
CVE-2026-95652: TÜBİTAK BİLGEM Software Technologies Research Institute pardus-usb-formatter: Execution with unnecessary privileges vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute…6.6 MediumN/AN/ANov 5, 2026
CVE-2026-123036: Red Hat ansible-core: A flaw was found in ansible-core5.5 MediumN/AN/ANov 5, 2026
CVE-2026-118869: SHIRASAGI Project SHIRASAGI: An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute…8.8 High8.7 High1%Nov 5, 2026
CVE-2026-117679: SHIRASAGI Project SHIRASAGI: A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute…5.4 Medium5.1 Medium0%Nov 5, 2026
CVE-2026-112072: jopenlibs vault-java-driver: vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser…6.5 MediumN/A0%Nov 5, 2026
CVE-2026-109408: jopenlibs vault-java-driver: vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in…7.4 HighN/A0%Nov 5, 2026
CVE-2026-107776: Unknown Dokan: The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger…2.2 LowN/A0%Nov 5, 2026
CVE-2026-100109: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating…9.8 CriticalN/A0%Nov 5, 2026
CVE-2026-123033: iXsystems TrueNAS SCALE: Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release…8.3 HighN/A0%Nov 5, 2026
CVE-2026-123029: Wowza Streaming Engine: Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files…7.5 HighN/A0%Nov 5, 2026
CVE-2026-123025: OPNsense os-acme-client: An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense…N/A9.4 Critical1%Nov 5, 2026
CVE-2026-123014: iTerm2: iTerm2 before 3.7.7beta2 has an argument injection vulnerability in the x-man-page: URL handler, allowing an attacker…N/A8.7 High0%Nov 5, 2026
CVE-2026-123017: GodotSteam: GodotSteam 4.17 through 4.23.2 trusts the peer value of 1 to mean that a player is the server6.5 MediumN/A0%Nov 5, 2026
CVE-2026-109150: Unknown WP PageNavi Style: The WP PageNavi Style WordPress plugin through 1.4 does not sanitise and escape some of its settings, and has no CSRF…N/AN/A0%Nov 5, 2026
CVE-2026-107787: Unknown CatFolders: The CatFolders WordPress plugin before 2.5.7 does not have authorisation checks on a folder maintenance action,…N/AN/A0%Nov 5, 2026
CVE-2026-107786: Unknown CatFolders: The CatFolders WordPress plugin before 2.5.7 does not properly sanitize and escape a user-controlled sort setting…N/AN/A0%Nov 5, 2026
CVE-2026-107775: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not verify that…N/AN/A0%Nov 5, 2026
CVE-2026-107774: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not use a trusted…N/AN/A0%Nov 5, 2026
CVE-2026-107773: Unknown Dokan: AI Powered WooCommerce Multivendor Marketplace Solution: The Dokan: AI Powered WooCommerce Multivendor Marketplace Solution WordPress plugin before 5.3.3 does not correctly…N/AN/A0%Nov 5, 2026
526-550 of 423114
‹›