The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-115294: Elastic Kibana: Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to…7.3 HighN/AN/ANov 3, 2026
CVE-2026-115293: Elastic Kibana: Insertion of Sensitive Information Into Sent Data (CWE-201) in Kibana Observability onboarding can lead to disclosure…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-115292: Elastic Kibana: Authorization Bypass Through User-Controlled Key (CWE-639) in Kibana Machine Learning can lead to information…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-115290: Elastic Elasticsearch: Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested…7.5 HighN/AN/ANov 3, 2026
CVE-2026-115289: Elastic APM Server: Use of Multiple Resources with Duplicate Identifier (CWE-694) in APM Server can lead to information disclosure via a…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-119495: WebberZone Better Search: Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-109594: SonicWall Global Management System (GMS): Post-authentication Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability…N/AN/AN/ANov 3, 2026
CVE-2026-121603: solanum-ircd solanum: Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked…6.5 Medium8.5 HighN/ANov 3, 2026
CVE-2026-121602: solanum-ircd solanum: Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server…6.5 Medium8.5 HighN/ANov 3, 2026
CVE-2026-109593: SonicWall Global Management System (GMS): An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read…N/AN/AN/ANov 3, 2026
CVE-2026-28336: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of…9.9 CriticalN/AN/ANov 3, 2026
CVE-2026-28335: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution8.4 HighN/AN/ANov 3, 2026
CVE-2026-119674: MongoDB Database Tools: MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the…3.7 Low2.1 LowN/ANov 3, 2026
CVE-2026-28327: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability8.2 HighN/AN/ANov 3, 2026
CVE-2026-103916: Docker Docker Sandboxes: Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspaceN/A8.4 HighN/ANov 3, 2026
CVE-2026-121562: CTFd: CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121561: HumanSignal: Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that…7.7 High6.3 MediumN/ANov 3, 2026
CVE-2026-121560: logchimp: LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post…7.1 High7.1 HighN/ANov 3, 2026
CVE-2026-121558: Ricky-7-Yan intelligent-audit-system: AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in…4.3 Medium2.3 LowN/ANov 3, 2026
CVE-2026-121557: wppconnect wppconnect-server: WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121556: beecue FastBee: FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows…8.3 High8.7 HighN/ANov 3, 2026
CVE-2026-121554: silkimen cordova-plugin-advanced-http: cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121553: cotonti: Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing…4.8 Medium6.3 MediumN/ANov 3, 2026
CVE-2026-121552: dromara domain-admin: Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121550: jarun nnn: nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because…3.3 Low1.0 LowN/ANov 3, 2026
51-75 of 528356
‹›