The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121946: zbateson mail-mime-parser: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in…7.2 High6.9 Medium0%Nov 4, 2026
CVE-2026-121945: CoopCycle coopcycle-web: CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read…7.6 High7.2 High0%Nov 4, 2026
CVE-2026-121944: irontec sngrep: sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows…5.5 Medium6.8 Medium0%Nov 4, 2026
CVE-2026-121943: irontec sngrep: Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and…4.8 Medium6.3 Medium6%Nov 4, 2026
CVE-2026-121942: mchehab zbar: ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows…6.1 Medium6.9 Medium0%Nov 4, 2026
CVE-2026-121941: munt libmt32emu: libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows…7.8 High8.5 High0%Nov 4, 2026
CVE-2026-121940: Stonewuu ai-fusion-video: Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows…8.8 High8.7 High0%Nov 4, 2026
CVE-2026-121939: David-Crty Databasement: Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser()…8.1 High9.2 Critical1%Nov 4, 2026
CVE-2026-121938: moyangzhan langchain4j-aideepin: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…5.3 Medium6.0 Medium0%Nov 4, 2026
CVE-2026-121937: blackholll loonflow: loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any…3.1 Low2.3 Low0%Nov 4, 2026
CVE-2026-121936: cosin2077 easyVoice: easyVoice before 0.0.23 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…6.5 Medium6.9 Medium0%Nov 4, 2026
CVE-2026-121620: CoopCycle coopcycle-web: CoopCycle coopcycle-web 5.6.0 before 6.20.0 contains a missing authentication vulnerability that allows unauthenticated…6.5 Medium8.3 High0%Nov 4, 2026
CVE-2026-121373: sensiolabs symfony: The Symfony HtmlSanitizer component MetaRefreshAttributeSanitizer, introduced to fix CVE-2026-48761, sanitizes the…N/A5.3 Medium0%Nov 4, 2026
CVE-2026-121147: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to improper implementation of SSL…N/A8.5 High0%Nov 4, 2026
CVE-2026-121146: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to the recording of authentication tokens…N/A6.8 Medium0%Nov 4, 2026
CVE-2026-121145: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to insufficient validation of URLs and…N/A7.1 High0%Nov 4, 2026
CVE-2026-121144: Tata Motors: This vulnerability exists in the iRA 2.0 and iRA.ev mobile applications due to presence of hardcoded service account…N/A8.8 High0%Nov 4, 2026
CVE-2026-119481: Crocoblock JetFormBuilder: Incorrect Privilege Assignment vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Privilege…9.8 CriticalN/A0%Nov 4, 2026
CVE-2026-119468: Noptin Newsletter Team Noptin: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Noptin Newsletter…7.1 HighN/A0%Nov 4, 2026
CVE-2026-118516: sensiolabs symfony: The Symfony Routing components CompiledUrlMatcher and UrlMatcher interpret the host and path information differently,…N/A6.3 Medium0%Nov 4, 2026
CVE-2026-118513: sensiolabs symfony: Authentication bypass by spoofing in X509Authenticator and X509AuthenticationListener of Symfony versions prior to…N/A7.7 High0%Nov 4, 2026
CVE-2026-107479: Qt: An integer truncation vulnerability in the QTextCodec conversion functions of the Qt 5 Core Compatibility APIs module…N/A1.7 Low0%Nov 4, 2026
CVE-2026-97397: easywpstuff: The Remove Google Fonts – Disable, Block, or Replace with Bunny Fonts for GDPR Compliance plugin for WordPress is…7.2 HighN/A0%Nov 4, 2026
CVE-2026-121925: Snowflake: A stack-based buffer overflow in libsnowflakeclient and the Snowflake PHP PDO Driver could, under specific conditions,…6.6 MediumN/A1%Nov 4, 2026
CVE-2026-114456: Snowflake: Multiple Snowflake client drivers implementing the `authenticator=externalbrowser` single sign-on flow could have…6.5 MediumN/A0%Nov 4, 2026
626-650 of 423114
‹›