The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126356: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime5.3 MediumN/AN/ANov 13, 2026
CVE-2026-120868: Citrix NetScaler: Memory overflow in Packet Processing can lead to unpredictable or erroneous behavior or Denial of Service in NetScaler…N/A9.3 CriticalN/ANov 13, 2026
CVE-2026-91141: COVESA vSomeIp: A vulnerability in the default configuration of vsomeip allows a remote, unauthenticated attacker to trigger massive…N/AN/AN/ANov 12, 2026
CVE-2026-127211: MultiVendorX MultiVendorX – WooCommerce Multivendor Marketplace AI Powered Solutions: MultiVendorX plugin for WordPress before 5.0.22 contains a broken access control vulnerability in the…6.5 Medium7.1 HighN/ANov 12, 2026
CVE-2026-127209: Xiaomi Mi Browser (com.mi.globalbrowser): Xiaomi Mi Browser Android Application (com.mi.globalbrowser) before 14.66.0-gn contains a path traversal vulnerability…4.0 Medium5.1 MediumN/ANov 12, 2026
CVE-2026-126823: MongoDB Atlas SQL JDBC Driver: A local user with an ordinary account on the same host can place a file in a shared temporary location that the JDBC…7.0 High7.3 HighN/ANov 12, 2026
CVE-2026-126354: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library4.8 MediumN/AN/ANov 12, 2026
CVE-2026-126353: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library5.9 MediumN/AN/ANov 12, 2026
CVE-2026-126352: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library5.9 MediumN/AN/ANov 12, 2026
CVE-2026-126350: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library5.9 MediumN/AN/ANov 12, 2026
CVE-2026-126349: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library3.1 LowN/AN/ANov 12, 2026
CVE-2026-126348: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library4.3 MediumN/AN/ANov 12, 2026
CVE-2026-126346: patrickjuchli basic-ftp: basic-ftp is an FTP client for Node.js5.9 MediumN/AN/ANov 12, 2026
CVE-2026-126345: patrickjuchli basic-ftp: basic-ftp is an FTP client for Node.js5.3 MediumN/AN/ANov 12, 2026
CVE-2026-126344: honojs node-server: @hono/node-server allows running the Hono application on Node.js5.4 MediumN/AN/ANov 12, 2026
CVE-2026-126210: honojs node-server: @hono/node-server allows running the Hono application on Node.js5.3 MediumN/AN/ANov 12, 2026
CVE-2026-126355: honojs hono: Hono is a Web application framework that provides support for any JavaScript runtime5.3 MediumN/AN/ANov 12, 2026
CVE-2026-126351: sporkmonger addressable: Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library5.9 MediumN/AN/ANov 12, 2026
CVE-2026-126347: tornadoweb tornado: Tornado is a Python web framework and asynchronous networking library3.1 LowN/AN/ANov 12, 2026
CVE-2026-126343: honojs node-server: @hono/node-server allows running the Hono application on Node.js5.3 MediumN/AN/ANov 12, 2026
CVE-2026-86324: Red Hat: A flaw was found in Foreman’s Api::V2::SshKeysController, where the target user is resolved through…4.3 MediumN/AN/ANov 12, 2026
CVE-2026-86323: Red Hat: A flaw was found in Foreman’s Api::V2::MailNotificationsController, where authorization checks on user-specific…4.3 MediumN/AN/ANov 12, 2026
CVE-2026-127208: datamodel-code-generator: datamodel-code-generator before 0.84.0 contains a code injection vulnerability that allows attackers to achieve…8.8 High8.6 HighN/ANov 12, 2026
CVE-2026-126793: AWS aws-advanced-go-wrapper: An untrusted search path issue in Aurora PostgreSQL dialect detection in the AWS Advanced Go Wrapper from release…8.0 High8.6 HighN/ANov 12, 2026
CVE-2026-126209: flavorjones loofah: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of NokogiriN/A5.3 MediumN/ANov 12, 2026
751-775 of 532044