The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-102612: bacnet-stack: BACnet Stack is a BACnet open source protocol stack C library for embedded systems8.1 HighN/AN/ANov 13, 2026
CVE-2026-102537: bacnet-stack: BACnet Stack is a BACnet open source protocol stack C library for embedded systemsN/A7.7 HighN/ANov 13, 2026
CVE-2026-100403: bacnet-stack: BACnet Stack is a BACnet open source protocol stack C library for embedded systems7.5 HighN/AN/ANov 13, 2026
CVE-2026-68551: teelur budget-board: Budget Board is an app for tracking monthly spending and working towards financial goalsN/A8.3 HighN/ANov 13, 2026
CVE-2026-128087: Eugeny russh: russh is a Rust SSH client and server library that includes an SSH agent protocol implementation3.7 LowN/AN/ANov 13, 2026
CVE-2026-64675: bacnet-stack: BACnet Stack is a BACnet open source protocol stack C library for embedded systems5.3 MediumN/AN/ANov 13, 2026
CVE-2026-104204: bacnet-stack: BACnet Stack is a BACnet open source protocol stack C library for embedded systemsN/A8.7 HighN/ANov 13, 2026
CVE-2026-82414: bacnet-stack: BACnet Stack is a BACnet open source protocol stack C library for embedded systems8.8 HighN/AN/ANov 13, 2026
CVE-2026-128082: LuckyPennySoftware AutoMapper: AutoMapper is a convention-based object-object mapper in .NET7.5 HighN/AN/ANov 13, 2026
CVE-2026-97361: B. Braun Melsungen AG SpaceCom: There exists an improper privilege management vulnerability that could cause privilege escalation at the SpaceCom and…N/A8.5 HighN/ANov 13, 2026
CVE-2026-97358: B. Braun Melsungen AG SpaceCom: An inclusion of web functionality from an untrusted source could allow remote code execution on SpaceComN/A7.0 HighN/ANov 13, 2026
CVE-2026-97357: B. Braun Melsungen AG SpaceCom: An Out-Of-Bounds Write due to missing input validation is possible in the autoprogramming interface of SpaceCom and…N/A6.9 MediumN/ANov 13, 2026
CVE-2026-129172: tianma-if EdgeEver: EdgeEver 1.9.0 before 2.13.0 contains a stored cross-site scripting vulnerability in the backup restore endpoint PUT…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-129171: likaia NginxPulse: NginxPulse 1.5.0 before 1.6.26 contains an unauthenticated sql injection vulnerability that allows remote attackers to…9.8 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-129170: vastsa FileCodeBox: FileCodeBox 2.2.1 through 2.8.4 contains a stored cross-site scripting vulnerability in renderMarkdownPreview, which…6.1 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-129168: Jinnrry PMail: PMail 2.9.1 through 2.9.8 contains a stored cross-site scripting vulnerability because the /attachments/{id}/{cid}…6.1 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-129167: Seafile SeaDoc: Seafile SeaDoc converter 2.0.4 before 2.0.11 and 3.0.0 before 3.0.8 contains an absolute path traversal vulnerability…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-129166: keephq Keep: Keep 0.34.10 through 0.55.0 contains a blind SQL injection vulnerability in its CEL-to-SQL converter, which inserts…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-129164: dromara free-fs: Dromara free-fs 2.0.1 through 2.3.1 contains an authorization bypass vulnerability that allows attackers to access…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-129163: dromara free-fs: Dromara free-fs 2.0.1 through 2.3.1 contains a stored cross-site scripting vulnerability that allows registered users…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-129162: dromara free-fs: Dromara free-fs 2.0.1 through 2.3.1 contains a missing authentication vulnerability in FileStreamController.preview…5.9 Medium8.2 HighN/ANov 13, 2026
CVE-2026-129160: dromara free-fs: free-fs 2.0.1 through 2.3.1 contains an SQL injection vulnerability in FileShareServiceImpl.getPages, which passes the…6.5 Medium7.1 HighN/ANov 13, 2026
CVE-2026-129158: nageoffer ragent: ragent 1.1.0 contains a stored cross-site scripting vulnerability that allows authenticated users to inject scripts by…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-129157: nageoffer ragent: ragent 1.0.0 through 1.1.0 contains a missing authorization vulnerability in RagTraceController that allows any…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-129155: liangliangyy DjangoBlog: DjangoBlog 2.0.0.0 through 2.1.0.0 contains a stored cross-site scripting vulnerability because the class_filter…5.4 Medium5.1 MediumN/ANov 13, 2026
51-75 of 532044