The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules

TitleEitWModules
CVE-2026-112181: OpenKM OpenKM Community Edition: Vulnerability due to inadequate restriction of references to external XML entities in OpenKM Community EditionN/A8.3 HighN/ANov 13, 2026
CVE-2026-103645: qt: An integer overflow vulnerability in the Qt QTextCodec fromUnicode() and toUnicode() functionality of the Qt 5 Core…N/A1.1 LowN/ANov 13, 2026
CVE-2025-71463: secdev scapy: Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows…6.7 Medium5.4 MediumN/ANov 13, 2026
CVE-2025-71462: diced zipline: Zipline before 3.7.12 contains a cross-site scripting vulnerability in the login page that allows attackers to execute…6.1 Medium5.1 MediumN/ANov 13, 2026
CVE-2025-71461: diced zipline: Zipline before 4.0.2 contains a predictable filename vulnerability that allows attackers to infer other users' upload…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2025-71460: diced zipline: Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2025-71459: diced zipline: Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files…8.1 High7.2 HighN/ANov 13, 2026
CVE-2024-58405: diced zipline: Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which…8.6 High8.8 HighN/ANov 13, 2026
CVE-2024-58404: diced zipline: Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via…7.7 High8.3 HighN/ANov 13, 2026
CVE-2023-54423: OpenMage magento-lts: OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG…7.5 High8.3 HighN/ANov 13, 2026
CVE-2026-126317: frappe hrms: Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126396: vllm-project vllm: vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126416: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126942: diced zipline: Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126946: diced zipline: Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126948: diced zipline: Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126952: diced zipline: Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-127073: OpsTree Solutions BuildPiper: OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain…9.9 Critical9.4 CriticalN/ANov 13, 2026
CVE-2026-127077: OpsTree Solutions BuildPiper: OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-127081: OpsTree Solutions BuildPiper: OpsTree BuildPiper before 2.7.0 contains an authorization bypass vulnerability that allows authenticated users to link…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-127085: IgnisDa ryot: Ryot before 10.5.6 contains an authorization bypass vulnerability that allows authenticated users to remove entries…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-127090: Jadaptive: Jadaptive Maverick Synergy Server before 3.0.33 and 3.1.x before 3.1.7, and Maverick Legacy Server before 1.8.1,…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-127094: Pagelayer Team Pagelayer: Pagelayer 2.1.7 before 2.2.1 contains a missing authorization vulnerability in Abilities API abilities registered in…7.6 High7.2 HighN/ANov 13, 2026
CVE-2026-128017: php frankenphp: FrankenPHP before 1.13.4 contains a double free vulnerability in worker mode that frees…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-128021: php frankenphp: FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier…3.7 Low6.3 MediumN/ANov 13, 2026
551-575 of 532044
‹›