Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-129433: dokploy: Dokploy before 0.31.1 contains an OS command injection vulnerability in getComposeContainerCommand() that allows…9.9 Critical9.4 CriticalN/ANov 14, 2026
CVE-2026-129432: ettercap: Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_mountd() in…6.5 Medium7.1 HighN/ANov 14, 2026
CVE-2026-129431: ettercap: Ettercap through 0.8.5.1 contains a heap out-of-bounds read vulnerability in dissector_socks() in…6.5 Medium7.1 HighN/ANov 14, 2026
CVE-2026-129430: axeloz filesharing: Axeloz Filesharing before 2.14.3 contains a stored cross-site scripting vulnerability that allows authenticated users…5.4 Medium5.1 MediumN/ANov 14, 2026
CVE-2026-129429: frappe india-payroll: Frappe india-payroll before 16.0.4 contains a missing authorization vulnerability in the get_employee_details,…7.1 High7.1 HighN/ANov 14, 2026
CVE-2026-129428: rcourtman Pulse: Pulse from 5.0.17 before 6.8.0 contains a missing authorization vulnerability in the /api/ai/approvals endpoints that…5.4 Medium5.3 MediumN/ANov 14, 2026
CVE-2026-129255: CoolerMaster MASTERPLUS+: A vulnerability was identified in CoolerMaster MASTERPLUS+ 1.9.68.8 High9.3 CriticalN/ANov 14, 2026
CVE-2026-129254: Opixido OCMS: A flaw has been found in Opixido OCMS up to b7c15660aba83d96677c1a9abaa69c082a24f21c4.3 Medium2.1 LowN/ANov 14, 2026
CVE-2026-120522: fluentwiz: The Cloud Storage Manager for Fluent Forms – Google Drive, Dropbox, OneDrive, S3 Uploads plugin for WordPress is…9.8 CriticalN/AN/ANov 14, 2026
CVE-2025-71465: kolkov angular-editor: @kolkov/angular-editor before 3.0.3 contains a cross-site scripting vulnerability in refreshView() that writes HTML…6.1 Medium5.3 MediumN/ANov 14, 2026
CVE-2025-71464: kolkov angular-editor: @kolkov/angular-editor before 3.0.4 contains a cross-site scripting vulnerability in toggleEditorMode() that assigns…6.1 Medium5.3 MediumN/ANov 14, 2026
CVE-2026-129427: CervantesSec cervantes: Stored XSS via avatar upload chained with an authentication bypass in /Attachments leads to ATO in Cervantes version…8.7 HighN/AN/ANov 14, 2026
CVE-2026-129251: hrshadhin CloudSchool: A vulnerability was detected in hrshadhin CloudSchool up to 3.0.12.4 Low1.9 LowN/ANov 14, 2026
CVE-2026-129250: Edimax BR6478ACV2: A security vulnerability has been detected in Edimax BR6478ACV2 1.239.9 Critical8.6 HighN/ANov 14, 2026
CVE-2026-129115: Use After FreeN/AN/AN/ANov 14, 2026
CVE-2026-129114: Off-by-one ErrorN/AN/AN/ANov 14, 2026
CVE-2026-129113: Integer UnderflowN/AN/AN/ANov 14, 2026
CVE-2026-124541: Missing Release of Memory after Effective LifetimeN/AN/AN/ANov 14, 2026
CVE-2026-124540: Uncontrolled RecursionN/AN/AN/ANov 14, 2026
CVE-2026-124539: Missing Release of Memory after Effective LifetimeN/AN/AN/ANov 14, 2026
CVE-2026-124536: Allocation of Resources Without Limits or ThrottlingN/AN/AN/ANov 14, 2026
CVE-2026-129248: n/a Akaunting: A weakness has been identified in Akaunting up to 3.3.04.3 Medium5.3 MediumN/ANov 14, 2026
CVE-2026-129247: yangzongzhuan RuoYi: A security flaw has been discovered in yangzongzhuan RuoYi up to 4.8.34.7 Medium5.1 MediumN/ANov 14, 2026
CVE-2026-18742: UX-themes Flatsome: The Flatsome theme for WordPress is vulnerable to Stored Cross-Site Scripting via 'data-text-sec', 'data-title', and…6.4 MediumN/A0%Nov 14, 2026
CVE-2026-129181: projectworlds Visitor Management System: A vulnerability has been found in projectworlds Visitor Management System 1.07.3 High5.5 Medium0%Nov 14, 2026
51-75 of 561732