The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-128066: python-pillow Pillow: Pillow is a Python imaging libraryN/A8.7 HighN/ANov 13, 2026
CVE-2026-128065: grpc grpc-node: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addonN/A6.9 MediumN/ANov 13, 2026
CVE-2026-127275: Linksys EA8100: A vulnerability was determined in Linksys EA8100 1.0.3.21694010.0 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-127274: Linksys EA8100: A vulnerability was found in Linksys EA8100 1.0.3.2169403.7 Low2.9 LowN/ANov 13, 2026
CVE-2026-127273: Linksys EA8100: A vulnerability has been found in Linksys EA8100 1.0.3.2169404.3 Medium2.1 LowN/ANov 13, 2026
CVE-2026-127212: dokploy: Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126982: MongoDB C# Driver: A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-126839: MongoDB C# Driver: A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2026-126792: MongoDB Libmongocrypt Driver: A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write…4.7 Medium5.7 MediumN/ANov 13, 2026
CVE-2026-126367: grpc grpc-node: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon4.8 MediumN/AN/ANov 13, 2026
CVE-2026-126366: msgpack msgpack-ruby: MessagePack for Ruby is an implementation of the MessagePack binary serialization format7.5 HighN/AN/ANov 13, 2026
CVE-2026-126365: withastro, @astrojs: Astro is a web framework for content-driven websites5.4 MediumN/AN/ANov 13, 2026
CVE-2026-126364: withastro astro: Astro is a web framework for content-driven websitesN/A6.3 MediumN/ANov 13, 2026
CVE-2026-126363: withastro astro: Astro is a web framework for content-driven websitesN/A2.3 LowN/ANov 13, 2026
CVE-2026-126362: withastro astro: Astro is a web framework for content-driven websitesN/A2.3 LowN/ANov 13, 2026
CVE-2026-126361: withastro astro: Astro is a web framework for content-driven websitesN/A2.3 LowN/ANov 13, 2026
CVE-2026-126360: open-telemetry opentelemetry-python: OpenTelemetry Python provides the Python API and SDK for OpenTelemetry5.3 MediumN/AN/ANov 13, 2026
CVE-2026-126359: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime3.4 LowN/AN/ANov 13, 2026
CVE-2026-126358: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime5.3 MediumN/AN/ANov 13, 2026
CVE-2026-126357: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime5.3 MediumN/AN/ANov 13, 2026
CVE-2026-126356: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime5.3 MediumN/AN/ANov 13, 2026
CVE-2026-126355: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime5.3 MediumN/AN/ANov 13, 2026
CVE-2026-120868: Citrix NetScaler: Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler…N/A9.3 CriticalN/ANov 13, 2026
CVE-2026-91141: COVESA vSomeIp: A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive…N/AN/AN/ANov 12, 2026
CVE-2026-127211: MultiVendorX MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions: MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the…6.5 Medium7.1 HighN/ANov 12, 2026
676-700 of 532044