The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-106127: Progress Software KendoReact: Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0…4.1 MediumN/AN/ANov 6, 2026
CVE-2026-62856: freescout-help-desk freescout: FreeScout is a self-hosted help desk and shared mailbox application7.7 HighN/AN/ANov 6, 2026
CVE-2026-106144: Progress Software Kendo UI for Angular: Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common)…4.1 MediumN/AN/ANov 6, 2026
CVE-2026-106143: Progress Software Kendo UI for Vue: Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-vue-editor) in Progress Software Kendo UI for Vue…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106142: Progress Software KendoReact: Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-react-editor) in Progress Software KendoReact…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106141: Progress Software Kendo UI for Angular: Cross-Site Scripting (XSS) in the Editor component (@progress/kendo-angular-editor) in Progress Software Kendo UI for…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106136: Progress Software KendoReact: Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-react-conversational-ui) in Progress Software…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-62854: freescout-help-desk freescout: FreeScout is a self-hosted help desk and shared mailbox7.6 HighN/AN/ANov 6, 2026
CVE-2026-106134: Progress Software KendoReact: Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-106135: Progress Software Kendo UI for Angular: Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo…5.4 MediumN/AN/ANov 6, 2026
CVE-2026-122053: sensiolabs symfony: The Symfony Serializer component ObjectNormalizer treats any attribute name containing N/A6.9 MediumN/ANov 6, 2026
CVE-2026-104656: Progress Software Progress® Telerik® Fiddler® Everywhere: Improper neutralization of input in the sessions grid in Progress Telerik Fiddler Everywhere 8.3.0 and earlier allows…7.3 HighN/AN/ANov 6, 2026
CVE-2026-104657: Progress Software Fiddler Download & Setup Skill: Missing integrity verification in the Progress Software Fiddler Download and Setup Skill on Linux, macOS, and Windows…7.5 HighN/AN/ANov 6, 2026
CVE-2026-90436: Apache Software Foundation Apache Axis 1.x (EOL): ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated…N/AN/AN/ANov 6, 2026
CVE-2026-80303: Gen Digital: An integer underflow vulnerability in the Avast Windows Filtering Platform (WFP) stream parser on Windows allows denial…N/AN/AN/ANov 6, 2026
CVE-2026-80302: Gen Digital: Insufficient isolation in the Avast sandbox file virtualization layer on Windows allows a local, low-privileged…N/AN/AN/ANov 6, 2026
CVE-2026-80301: Gen Digital: Improper isolation in the Avast sandbox on Windows allows a local, low-privileged attacker executing inside the sandbox…N/AN/AN/ANov 6, 2026
CVE-2026-66987: HCL Software HCL AION: HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-66986: HCL Software HCL AION: HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity3.3 LowN/AN/ANov 6, 2026
CVE-2026-66984: HCL Software HCL AION: HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths3.1 LowN/AN/ANov 6, 2026
CVE-2026-66982: HCL Software HCL AION: HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing…3.3 LowN/AN/ANov 6, 2026
CVE-2026-66981: HCL Software HCL AION: HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in…6.5 MediumN/AN/ANov 6, 2026
CVE-2026-21834: HCL Software HCL AION: HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing…3.1 LowN/AN/ANov 6, 2026
CVE-2026-12067: Gen Digital: Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged…N/AN/AN/ANov 6, 2026
CVE-2026-123792: sensiolabs symfony: The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted…N/A8.7 HighN/ANov 6, 2026
51-75 of 419658
‹›