The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-113783: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework7.4 HighN/A0%Nov 4, 2026
CVE-2026-113782: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework7.1 HighN/A0%Nov 4, 2026
CVE-2026-113780: espressif esp-idf: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework9.3 CriticalN/A0%Nov 4, 2026
CVE-2026-107846: bitcoinjs bitcoinjs-lib: bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsersN/A9.3 Critical0%Nov 4, 2026
CVE-2026-102345: zammad: Zammad is a web based open source helpdesk/customer support systemN/A5.1 Medium0%Nov 4, 2026
CVE-2026-115474: zulip: Zulip is an open-source team collaboration tool6.5 MediumN/A0%Nov 4, 2026
CVE-2026-115574: zulip: Zulip is an open-source team collaboration tool5.3 MediumN/A0%Nov 4, 2026
CVE-2026-63183: omniauth: OmniAuth is a flexible authentication system utilizing Rack middlewareN/A6.9 Medium0%Nov 4, 2026
CVE-2026-57853: DataGerry: DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with…8.8 High8.7 High1%Nov 4, 2026
CVE-2026-122118: Yealink: In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK…7.4 HighN/A0%Nov 4, 2026
CVE-2026-122116: Yealink: Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X…4.3 MediumN/A0%Nov 4, 2026
CVE-2026-122054: The GNU C Library glibc: Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU…5.9 MediumN/A0%Nov 4, 2026
CVE-2026-121971: sensiolabs symfony: The component ScopingHttpClient in Symfony HttpClient merges the options of its default scope (such as auth_bearer or…N/A8.2 High0%Nov 4, 2026
CVE-2026-121927: A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.36.3 Medium2.1 Low0%Nov 4, 2026
CVE-2026-76506: Cisco Cisco Unified Computing System Central Software: A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated,…7.6 HighN/A1%Nov 4, 2026
CVE-2026-76419: Cisco Cisco Unified Communications Manager: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco…6.1 MediumN/A0%Nov 4, 2026
CVE-2026-20241: Cisco: A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity…5.3 MediumN/A0%Nov 4, 2026
CVE-2026-121926: Missing Authentication for Critical Function7.3 High5.5 Medium0%Nov 4, 2026
CVE-2026-119749: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows…7.5 High8.7 High0%Nov 4, 2026
CVE-2026-119748: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows…6.5 Medium6.9 Medium0%Nov 4, 2026
CVE-2026-119747: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the…7.1 High7.1 High0%Nov 4, 2026
CVE-2026-92704: sharpemu: SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux8.3 HighN/A0%Nov 4, 2026
CVE-2026-91168: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux6.8 MediumN/A0%Nov 4, 2026
CVE-2026-91163: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux3.7 LowN/A0%Nov 4, 2026
CVE-2026-122032: SPIP: SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access…6.5 Medium7.1 High0%Nov 4, 2026
526-550 of 423114
‹›