The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126420: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126419: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the esign_form_submit handler of…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126418: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in interface/billing/sl_eob_invoice.php,…6.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126417: openemr: OpenEMR before 8.5.0 contains an access control flaw in get_claim_file.php: with location=tmp, it serves any file in…5.3 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126416: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126415: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Patient Validation module that allows any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126414: frappe hrms: Frappe HRMS 15.0.0 before 15.64.2 and 16.0.0 before 16.20.0 contains a missing authorization vulnerability in certain…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126413: frappe hrms: Frappe HRMS 15.x before 15.64.1 and 16.x before 16.19.0 contains a missing authorization vulnerability in an endpoint…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126412: frappe hrms: Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126411: frappe hrms: Frappe HRMS 16.0.0 before 16.50.0 lacks authorization checks on certain HR workflow endpoints, letting authenticated…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126410: bytecodealliance wasmtime: Wasmtime's wasmtime-wasi crate 48.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a…6.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126409: bytecodealliance wasmtime: Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains a cross-engine type confusion…2.0 Low1.8 LowN/ANov 13, 2026
CVE-2026-126408: bytecodealliance wasmtime: Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in…1.8 Low1.0 LowN/ANov 13, 2026
CVE-2026-126407: bytecodealliance wasmtime: Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 allocates untracked host…4.8 Medium5.9 MediumN/ANov 13, 2026
CVE-2026-126406: bytecodealliance wasmtime: The wasmtime-wasi-http p2 implementation in Wasmtime before 36.0.20, 37.0.0 before 48.0.8, 49.0.0 before 49.0.5, and…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-126405: coder: Coder 2.21.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126404: coder: Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before…6.8 Medium7.6 HighN/ANov 13, 2026
CVE-2026-126403: coder: Coder 2.26.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before…6.5 Medium8.5 HighN/ANov 13, 2026
CVE-2026-126402: fleetdm fleet: Fleet before 4.89.0 contains an incorrect authorization flaw in its user administration API that accepts user creation…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-126401: fleetdm fleet: Fleet before 4.86.2 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126400: pglombardo PasswordPusher: Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-126399: vllm-project vllm: vLLM from 0.19.0 before 0.31.0 contains a resource exhaustion vulnerability that allows inference clients to bypass the…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126398: vllm-project vllm: vLLM from 0.28.0 before 0.30.0 contains a reachable assertion vulnerability in GPUModelRunner._init_xdrope_positions…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-126397: vllm-project vllm: vLLM from 0.10.1 before 0.31.0 forwards a request-controlled mm_processor_kwargs.max_patches value to the Hugging Face…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126396: vllm-project vllm: vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which…5.3 Medium6.9 MediumN/ANov 13, 2026
526-550 of 532044