The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126392: parse-community parse-server: Parse Server from 9.10.6-alpha.1 before 9.10.8-alpha.1 contains an information disclosure vulnerability that allows…3.1 Low2.3 LowN/ANov 13, 2026
CVE-2026-126396: vllm-project vllm: vLLM from 0.24.0 before 0.31.0 contains a resource exhaustion vulnerability in the MiniMax M3 VL video processor, which…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126400: pglombardo PasswordPusher: Password Pusher from 1.49.0 before 2.17.0 contains an IP spoofing vulnerability that allows remote clients to forge the…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-126404: coder: Coder 2.28.0 before 2.29.24, 2.30.0 before 2.34.16, 2.35.0 before 2.36.11, 2.37.0 before 2.37.8, and 2.38.0 before…6.8 Medium7.6 HighN/ANov 13, 2026
CVE-2026-126408: bytecodealliance wasmtime: Wasmtime 47.0.0 before 48.0.8, 49.0.0 before 49.0.5, and 50.0.0 before 50.0.1 contains an insufficient type-check in…1.8 Low1.0 LowN/ANov 13, 2026
CVE-2026-126412: frappe hrms: Frappe HRMS 15.0.0 before 15.64.1 and 16.0.0 before 16.19.0 lacks a write permission check on a bulk record processing…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126416: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in patient_tracker_status.php that allows…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126420: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the FaxSMS module's utility.php that allows…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126424: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows users with admin/superbill write…3.5 Low4.6 MediumN/ANov 13, 2026
CVE-2026-126428: openemr: OpenEMR before 8.5.0 contains a remote code execution vulnerability that allows authenticated billing users to store…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-126432: openemr: OpenEMR before 8.5.0 contains an improper authorization vulnerability in interface/orders/list_reports.php that allows…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126436: openemr: OpenEMR before 8.5.0 contains an authorization bypass vulnerability that allows OAuth2 clients to use unregistered…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126440: openemr: OpenEMR before 8.5.0 contains a missing authorization flaw in the Care Coordination CCDA and CCR import controllers,…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126444: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in the Ensora eRx integration that allows…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-122227: mervb1 Easy Property Listings: The Easy Property Listings plugin for WordPress is vulnerable to generic SQL Injection via the 'post_type' parameter in…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-120573: etruel WPeMatico RSS Feed Fetcher: The WPeMatico RSS Feed Fetcher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/ANov 13, 2026
CVE-2026-118191: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to arbitrary file…8.1 HighN/AN/ANov 13, 2026
CVE-2026-126448: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability that allows authenticated users lacking…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-125948: wpzoom Recipe Card Blocks Lite: The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps[].text'…6.4 MediumN/AN/ANov 13, 2026
CVE-2026-116615: marketingfire Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets: The Widget Options – Advanced Conditional Visibility for Gutenberg Blocks & Classic Widgets plugin for WordPress is…8.8 HighN/AN/ANov 13, 2026
CVE-2026-126452: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in diagnosis_full.php that allows authenticated…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126456: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability in the Fee Sheet notecodes field, which is…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126461: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in library/ajax/user_settings.php that lets any…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126465: openemr: OpenEMR before 8.5.0 contains an SQL injection vulnerability in the patient portal api/onsiteactivityviews endpoint…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-126469: openemr: OpenEMR before 8.5.0 contains a missing authorization vulnerability in several custom/ scripts that rely only on…8.8 High8.7 HighN/ANov 13, 2026
601-625 of 532044