The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-124442: AzuraCast: AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124441: kyverno: Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any…8.8 High8.7 HighN/ANov 8, 2026
CVE-2026-124440: kyverno: Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that…9.9 Critical9.4 CriticalN/ANov 8, 2026
CVE-2026-124439: scriban: Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-124438: scriban: Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template…7.4 High9.1 CriticalN/ANov 8, 2026
CVE-2026-124437: scriban: Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-124436: openremote core: OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access…8.0 High8.6 HighN/ANov 8, 2026
CVE-2026-124435: openremote core: OpenRemote before 1.32.2 contains a stored cross-site scripting vulnerability that allows authenticated users with…4.8 Medium4.6 MediumN/ANov 8, 2026
CVE-2026-124434: getgrav grav: Grav Lightbox Gallery plugin 1.1.0 before 1.3.2 on Grav 2.x calls any medium method named in image, thumb or…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-124433: thorsten phpMyFAQ: phpMyFAQ before 4.1.11 contains an insufficient authorization vulnerability that allows delegated administrators…6.5 Medium7.0 HighN/ANov 8, 2026
CVE-2026-124432: thorsten phpMyFAQ: phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in…7.3 High6.9 MediumN/ANov 8, 2026
CVE-2026-124431: craftcms cms: Craft CMS from 5.10.0 before 5.11.2 contains an authorization bypass vulnerability that allows authenticated…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-124430: craftcms cms: Craft CMS from 5.10.0 before 5.11.2 contains a remote code execution vulnerability that allows non-administrator…8.8 High8.7 HighN/ANov 8, 2026
CVE-2026-124429: craftcms cms: Craft CMS from 5.0.0 before 5.11.2 contains a privilege escalation vulnerability that allows unauthenticated public…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-124428: craftcms cms: Craft CMS from 5.7.0 before 5.11.2 contains an arbitrary file read vulnerability that allows authenticated control…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124427: craftcms cms: Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows anonymous GraphQL clients…9.8 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-124426: craftcms cms: Craft CMS from 5.0.0 before 5.11.2 contains an authorization bypass vulnerability that allows unauthenticated attackers…5.3 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-124425: parse-community parse-server: Parse Server 8.6.109 before 8.6.116 and 9.10.6-alpha.1 before 9.10.7-alpha.2 contains an information disclosure…3.1 Low2.3 LowN/ANov 8, 2026
CVE-2026-124424: WWBN AVideo: WWBN AVideo contains a path traversal vulnerability in plugin/AI/receiveAsync.json.php that allows holders of any valid…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-124331: Jinher OA: A vulnerability was identified in Jinher OA C67.3 High5.5 MediumN/ANov 8, 2026
CVE-2026-124552: webmin: Webmin through 2.670 contains a stored cross-site scripting vulnerability in the Shorewall and Shorewall6 modules'…4.8 Medium4.8 MediumN/ANov 8, 2026
CVE-2026-124551: classroomio: ClassroomIO through 1.0.0 contains an authorization bypass vulnerability that allows authenticated users of any…5.3 Medium6.0 MediumN/ANov 8, 2026
CVE-2026-124474: meeting-room-booking-system mrbs-code: MRBS (Meeting Room Booking System) before 1.12.3 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-124465: Trendyol kafka-konsumer: Trendyol kafka-konsumer from 2.3.3 before 2.6.18 contains a denial of service vulnerability in batch_consumer.go that…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124330: FlowCI flow-core-x: A vulnerability was determined in FlowCI flow-core-x up to 1.23.495.0 Medium1.3 LowN/ANov 8, 2026
51-75 of 522604
‹›