The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123506: go-vikunja vikunja: Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped…5.4 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123505: go-vikunja vikunja: Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read stored data…5.5 Medium6.8 Medium0%Nov 8, 2026
CVE-2026-123504: go-vikunja vikunja: Vikunja from 0.22.0 before 2.7.1 contains an information disclosure vulnerability that allows read-only project members…4.3 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123503: go-vikunja vikunja: Vikunja before 2.7.1 contains an improper authorization vulnerability in canDoBucket that allows users with project…5.4 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123502: go-vikunja vikunja: Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes…5.2 Medium6.9 Medium0%Nov 8, 2026
CVE-2026-123501: go-vikunja vikunja: Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to…6.5 Medium7.1 High0%Nov 8, 2026
CVE-2026-123500: go-vikunja vikunja: Vikunja before 2.7.1 contains an insecure file permissions vulnerability that allows local users to read dump archives…6.2 Medium6.9 Medium0%Nov 8, 2026
CVE-2026-123499: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a credential exposure vulnerability that allows malicious repository authors to…5.9 Medium6.0 Medium0%Nov 8, 2026
CVE-2026-123498: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to…3.7 Low2.1 Low0%Nov 8, 2026
CVE-2026-123497: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a protocol downgrade vulnerability in serverCandidates that allows on-path…6.8 Medium7.6 High0%Nov 8, 2026
CVE-2026-123496: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a symlink following vulnerability that allows attackers to make veans init write…3.3 Low4.8 Medium0%Nov 8, 2026
CVE-2026-123495: go-vikunja vikunja: Vikunja 2.0.0 before 2.7.1 accepts form-encoded bodies on the /api/v2 login and OIDC callback endpoints without CSRF or…4.6 Medium5.1 Medium0%Nov 8, 2026
CVE-2026-123494: go-vikunja vikunja: Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data…3.5 Low5.1 Medium0%Nov 8, 2026
CVE-2026-123493: go-vikunja vikunja: Vikunja from 2.4.0 before 2.7.1 contains an authentication bypass vulnerability that allows disabled or locked users to…5.4 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123574: hickory-dns: The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a…7.5 High8.7 High0%Nov 8, 2026
CVE-2026-123530: go-vikunja vikunja: Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to…5.9 Medium6.0 Medium0%Nov 8, 2026
CVE-2026-120531: wedevs: The Subscribe2 – Form, Email Subscribers & Newsletters plugin for WordPress is vulnerable to Stored Cross-Site…7.2 HighN/A0%Nov 7, 2026
CVE-2026-99284: Linux: In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker in…N/AN/A0%Nov 7, 2026
CVE-2026-99283: Linux: In the Linux kernel, the following vulnerability has been resolved: netfilter: conntrack: tcp: use UNACK timeout for…N/AN/A0%Nov 7, 2026
CVE-2026-124060: TOTOLINK CA300-PoE: A vulnerability was detected in TOTOLINK CA300-PoE 6.2c.8849.1 Critical8.5 High1%Nov 7, 2026
CVE-2026-124059: TOTOLINK CA300-PoE: A security vulnerability has been detected in TOTOLINK CA300-PoE 6.2c.8849.1 Critical8.5 High0%Nov 7, 2026
CVE-2026-124058: TOTOLINK CA300-PoE: A weakness has been identified in TOTOLINK CA300-PoE 6.2c.8849.1 Critical8.5 High0%Nov 7, 2026
CVE-2026-124258: ThemeGrill User Registration: Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly…5.3 MediumN/A0%Nov 7, 2026
CVE-2026-124057: TOTOLINK CA300-PoE: A security flaw has been discovered in TOTOLINK CA300-PoE 6.2c.8849.1 Critical8.5 High1%Nov 7, 2026
CVE-2026-123472: eLightUp Meta Box – WordPress Custom Fields Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in eLightUp Meta Box…6.5 MediumN/A0%Nov 7, 2026
676-700 of 427771
‹›