The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2025-71461: diced zipline: Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2025-71460: diced zipline: Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2025-71459: diced zipline: Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files…8.1 High7.2 HighN/ANov 13, 2026
CVE-2024-58405: diced zipline: Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which…8.6 High8.8 HighN/ANov 13, 2026
CVE-2024-58404: diced zipline: Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via…7.7 High8.3 HighN/ANov 13, 2026
CVE-2023-54423: OpenMage magento-lts: OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG…7.5 High8.3 HighN/ANov 13, 2026
CVE-2026-126317: frappe hrms: Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126396: vllm-project vllm: vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126416: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-127085: IgnisDa ryot: Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-128017: php frankenphp: FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-128021: php frankenphp: FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-128025: php frankenphp: FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows…6.5 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128029: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting…4.7 Medium2.3 LowN/ANov 13, 2026
CVE-2026-128033: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-128043: OpenMage magento-lts: OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery…3.1 Low2.3 LowN/ANov 13, 2026
CVE-2026-128047: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-128052: OpenMage magento-lts: OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization…2.7 Low5.1 MediumN/ANov 13, 2026
CVE-2026-128239: gpac: GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers…5.5 Medium6.8 MediumN/ANov 13, 2026
CVE-2026-128328: dokploy: Dokploy 0.28.0 before 0.31.1 contains a path traversal vulnerability that allows authenticated organization members to…5.0 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-128332: knadh listmonk: Listmonk 6.0.0 before 7.0.0-beta.2 contains a 2FA bypass vulnerability that allows attackers with a valid password to…7.4 High9.1 CriticalN/ANov 13, 2026
CVE-2026-128336: exceljs: ExcelJS through 4.4.0 contains a prototype pollution vulnerability that allows attackers to add numeric keys to…4.8 Medium6.3 MediumN/ANov 13, 2026
CVE-2026-128340: exceljs: ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128344: exceljs: ExcelJS through 4.4.0 contains a memory exhaustion vulnerability that allows attackers to crash applications by…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128348: exceljs: ExcelJS through 4.4.0 contains a formula injection vulnerability in the totals row formula getter in lib/doc/table.js…4.2 Medium2.3 LowN/ANov 13, 2026
551-575 of 532044