The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2023-54423: OpenMage magento-lts: OpenMage magento-lts before 20.2.0 contains a stored cross-site scripting vulnerability because the TinyMCE WYSIWYG…7.5 High8.3 HighN/ANov 13, 2026
CVE-2024-58405: diced zipline: Zipline through 3.7.9 contains an improper authorization vulnerability in the /api/auth/register endpoint, which…8.6 High8.8 HighN/ANov 13, 2026
CVE-2026-126266: siyuan-note siyuan: SiYuan from 3.6.0 before 3.8.9 contains an information disclosure vulnerability that allows unauthenticated publish…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126270: nocodb: NocoDB before 2026.09.1 contains a missing authentication vulnerability in the aggregated meta info route of…6.5 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126278: nocodb: NocoDB before 2026.08.1 contains a race condition vulnerability in users.service.ts that allows holders of a valid…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126286: nocodb: NocoDB before 2026.08.0 contains a reflected cross-site scripting vulnerability in PageLeavingWarning.vue that allows…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-126294: getgrav grav: Grav Login plugin before 3.11.0 contains an authentication bypass vulnerability that allows attackers with an account…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126298: nltk: NLTK before 3.10.4 contains a denial of service vulnerability in Tree.chomsky_normal_form that allows remote attackers…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-126317: frappe hrms: Frappe HRMS from 16.0.0 before 16.20.1 contains a missing authorization vulnerability that allows authenticated users…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126395: vllm-project vllm: vLLM from 0.14.0rc1 before 0.31.0 contains an information disclosure vulnerability in sanitize_message() whose…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-119077: elextensions ELEX WordPress HelpDesk & Customer Ticketing System: The ELEX WordPress HelpDesk & Customer Ticketing System plugin for WordPress is vulnerable to PHP Object Injection in…9.8 CriticalN/AN/ANov 13, 2026
CVE-2026-121518: ivole Customer Reviews for WooCommerce: The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Sensitive Information Exposure in versions…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125055: sameh101: The Chatterbug Forms – Fast, Flexible WordPress Form Builder plugin for WordPress is vulnerable to Arbitrary File…9.8 CriticalN/AN/ANov 13, 2026
CVE-2026-126955: glanceapp glance: Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-127076: OpsTree Solutions BuildPiper: OpsTree BuildPiper before 2.7.0 contains a broken access control vulnerability that allows authenticated users to list…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-127080: OpsTree Solutions BuildPiper: OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users…9.9 Critical9.4 CriticalN/ANov 13, 2026
CVE-2026-127088: Bubka 2FAuth: 2FAuth before 9.0.1 contains a weak password recovery vulnerability that allows unauthenticated attackers to poison…8.1 High8.6 HighN/ANov 13, 2026
CVE-2026-128238: secdev scapy: Scapy before 2.8.0 contains an uncontrolled recursion vulnerability in the BER/ASN.1 decoder in scapy/asn1/ber.py that…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128239: gpac: GPAC through 26.07.0 contains a NULL pointer dereference vulnerability in the MPEG-4 Form spatial-constraint handlers…5.5 Medium6.8 MediumN/ANov 13, 2026
CVE-2026-128242: actix: actix-http before 3.20.1 and actix-web before 4.18.2 contain an unbounded decompression vulnerability in…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128339: exceljs: ExcelJS through 4.4.0 contains a memory exhaustion vulnerability in Worksheet._parseMergeCells that allows attackers to…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128343: exceljs: exceljs through 4.4.0 contains a denial of service vulnerability that allows attackers to block the event loop by…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128347: exceljs: ExcelJS through 4.4.0 contains an arbitrary file read vulnerability in the streaming WorkbookWriter that allows…7.5 High8.7 HighN/ANov 13, 2026
CVE-2026-128824: Red Hat: A flaw was found in Red Hat Quay5.4 MediumN/AN/ANov 13, 2026
CVE-2026-120867: Citrix: Memory overflow in SSL/TLS/DTLS can lead to unpredictable or erroneous behavior or Denial of Service in Citrix…N/A8.7 HighN/ANov 13, 2026
651-675 of 532044