The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2025-71460: diced zipline: Zipline before 4.2.1 contains a missing authorization vulnerability in the /api/user/files/transaction endpoint that…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2024-58405: diced zipline: Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which…8.6 High8.8 HighN/ANov 13, 2026
CVE-2024-58404: diced zipline: Zipline versions from 3.4.5 before 3.7.10 contain a path traversal vulnerability in the user data export endpoint via…7.7 High8.3 HighN/ANov 13, 2026
CVE-2023-54423: OpenMage magento-lts: OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG…7.5 High8.3 HighN/ANov 13, 2026
CVE-2026-112182: OpenKM OpenKM Community Edition: Unauthorization vulnerability in the management of workflow definitions in OpenKM Community EditionN/A8.7 HighN/ANov 13, 2026
CVE-2025-71459: diced zipline: Zipline through 4.3.2 contains a path traversal vulnerability that allows authenticated uploaders to write files…8.1 High7.2 HighN/ANov 13, 2026
CVE-2025-71463: secdev scapy: Scapy before 2.7.0 contains an insecure deserialization vulnerability in the load_session function that allows…6.7 Medium5.4 MediumN/ANov 13, 2026
CVE-2026-75490: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a remote code execution vulnerability that allows unauthenticated adjacent attackers…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-75494: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains an argument injection vulnerability that allows a malicious or compromised ACS to…7.4 High8.3 HighN/ANov 13, 2026
CVE-2026-75578: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-126267: nocodb: NocoDB from 0.300.0 before 2026.04.4 contains a denial of service vulnerability that allows authenticated users to…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126271: nocodb: NocoDB before 2026.09.0 contains an information disclosure vulnerability that allows authenticated base Viewers to…7.7 High8.3 HighN/ANov 13, 2026
CVE-2026-126275: nocodb: NocoDB before 2026.09.0 contains an insecure direct object reference vulnerability that allows authenticated users to…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126279: nocodb: NocoDB before 2026.06.2 contains a stored cross-site scripting vulnerability in PromptWithFields.vue that renders…6.3 Medium7.0 HighN/ANov 13, 2026
CVE-2026-126283: nocodb: NocoDB before 2026.08.0 contains an incorrect authorization vulnerability that lets base-scoped API tokens act as…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126291: nocodb: NocoDB before 2026.06.2 contains an SQL injection vulnerability in base-user.cte.utils.ts, which concatenates base…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126295: nltk: NLTK from 3.10.0 before 3.10.4 contains an arbitrary file read vulnerability in BllipParser that allows attackers to…6.8 Medium7.0 HighN/ANov 13, 2026
CVE-2026-126299: nltk: NLTK before 3.10.4 contains a denial of service vulnerability in the CCG lexicon parser fromstring that allows remote…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126307: nezhahq nezha: Nezha Dashboard before 2.6.0 contains multiple authorization, tenant isolation, and resource exhaustion vulnerabilities…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126311: openbao: OpenBao before 2.6.5 and 2.7.x before 2.7.2 does not neutralize wildcard characters in SSH certificate principals…5.8 Medium4.6 MediumN/ANov 13, 2026
CVE-2026-126315: frappe hrms: Frappe HRMS 16.14.0 before 16.20.1 sends product usage events on certain HR transactions without checking the site's…9.8 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-126317: frappe hrms: Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126319: Finsys dockhand: Dockhand before 1.0.55 contains an arbitrary file read vulnerability that allows authenticated users with stacks:create…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126323: givanz Vvveb: Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126372: givanz Vvveb: Vvveb through 1.0.8.6 contains an incomplete fix for CVE-2026-41934 that allows authenticated editor or site_admin…8.8 High8.7 HighN/ANov 13, 2026
576-600 of 532044