The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-128049: OpenMage magento-lts: OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery…9.0 Critical9.4 CriticalN/ANov 13, 2026
CVE-2026-128048: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 lets restricted administrators read decrypted…4.9 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128047: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-128046: OpenMage magento-lts: OpenMage magento-lts 20.17.0 before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an unrestricted file upload…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-128045: OpenMage magento-lts: OpenMage Magento-LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an authorization bypass in the…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128044: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.x before 21.0.0-beta3 validates OAuth 1.0a oauth_callback URLs with a…7.7 High8.7 HighN/ANov 13, 2026
CVE-2026-128043: OpenMage magento-lts: OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery…3.1 Low2.3 LowN/ANov 13, 2026
CVE-2026-128042: OpenMage magento-lts: OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-128041: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 serves RSS feeds with a text/html content type…8.0 High8.8 HighN/ANov 13, 2026
CVE-2026-128040: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting…6.1 Medium8.4 HighN/ANov 13, 2026
CVE-2026-128033: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an information disclosure…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-128032: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 accepts the free (No Payment Information…4.4 Medium5.9 MediumN/ANov 13, 2026
CVE-2026-128031: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an incorrect authorization…3.8 Low5.1 MediumN/ANov 13, 2026
CVE-2026-128030: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains an insufficient session expiration…5.9 Medium7.4 HighN/ANov 13, 2026
CVE-2026-128029: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting…4.7 Medium2.3 LowN/ANov 13, 2026
CVE-2026-128028: OpenMage magento-lts: OpenMage magento-lts before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a stored cross-site scripting…4.7 Medium2.3 LowN/ANov 13, 2026
CVE-2026-128027: php frankenphp: FrankenPHP Docker images before 1.1.11 were rebuilt only when new base image tags were created, so security fixes that…9.8 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-128026: php frankenphp: FrankenPHP from 1.5.0 before 1.13.0 contains an incomplete environment sandbox vulnerability in which putenv writes to…6.4 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128025: php frankenphp: FrankenPHP before 1.13.0 contains a path-split interpretation conflict in splitPos in cgi.go that allows…6.5 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128024: php frankenphp: FrankenPHP before 1.13.0 contains a denial of service vulnerability in goArray() that allows remote attackers to abort…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-128023: php frankenphp: FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof…7.4 High9.1 CriticalN/ANov 13, 2026
CVE-2026-128022: php frankenphp: FrankenPHP before 1.13.2 contains a resource exhaustion vulnerability that allows unauthenticated clients to tie up PHP…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-128021: php frankenphp: FrankenPHP before 1.13.2 contains an information disclosure vulnerability that allows later clients to read earlier…3.7 Low6.3 MediumN/ANov 13, 2026
CVE-2026-128020: php frankenphp: FrankenPHP before 1.13.2 contains an uncontrolled recursion vulnerability in its PHP-to-Go array converter that fails…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-128019: php frankenphp: FrankenPHP before 1.13.4 contains an information disclosure vulnerability in worker mode that leaks per-request…4.8 Medium6.3 MediumN/ANov 13, 2026
51-75 of 573544