The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121956: FreeRDP: FreeRDP before 3.32.2 contains a double free in the WinPR Kerberos SSPI retrieveSomeTgt function, which installs the…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121955: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121954: FreeRDP: FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-121953: FreeRDP: FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel…9.8 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121952: FreeRDP: FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects…9.8 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121951: FreeRDP: FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121950: FreeRDP: FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-66736: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/ANov 4, 2026
CVE-2026-39431: n/a: On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service…N/AN/AN/ANov 4, 2026
CVE-2026-39430: n/a: On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management…N/AN/AN/ANov 4, 2026
CVE-2026-122008: oqtane oqtane.framework: Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of…5.0 Medium5.3 MediumN/ANov 4, 2026
CVE-2026-121009: SQL InjectionN/AN/AN/ANov 4, 2026
CVE-2026-121008: Cross-site Scripting (XSS)N/AN/AN/ANov 4, 2026
CVE-2026-121007: SQL InjectionN/AN/AN/ANov 4, 2026
CVE-2026-120421: Eclipse Foundation Eclipse Mojarra: In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client…6.1 MediumN/AN/ANov 4, 2026
CVE-2026-119776: frrouting: In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets…N/A6.1 MediumN/ANov 4, 2026
CVE-2026-100408: git-for-windows git: Git for Windows is the Windows port of Git4.4 MediumN/AN/ANov 4, 2026
CVE-2026-100407: git-for-windows git: Git for Windows is the Windows port of Git4.4 MediumN/AN/ANov 4, 2026
CVE-2026-122032: SPIP: SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-122007: oqtane oqtane.framework: Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an…6.5 Medium7.4 HighN/ANov 4, 2026
CVE-2026-121637: WatchGuard AuthPoint Authentication Gateway: An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a…N/A8.9 HighN/ANov 4, 2026
CVE-2026-121639: WatchGuard AuthPoint Authentication Gateway: A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote…N/A9.2 CriticalN/ANov 4, 2026
CVE-2026-121638: WatchGuard AuthPoint Authentication Gateway: An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path…N/A9.1 CriticalN/ANov 4, 2026
CVE-2026-121640: WatchGuard AuthPoint Authentication Gateway: An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has…N/A9.1 CriticalN/ANov 4, 2026
CVE-2026-114627: Cross-site Scripting (XSS)N/AN/AN/ANov 4, 2026
51-75 of 418286
‹›