The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120431: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120430: owen2345 Camaleon CMS: Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController…5.4 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120428: Chaitin PandaWiki: PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 MediumN/ANov 2, 2026
CVE-2026-120427: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated…4.3 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120426: OpenCSG CSGHub: OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve…7.5 High8.7 HighN/ANov 2, 2026
CVE-2026-120318: Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing…7.2 High8.6 HighN/ANov 2, 2026
CVE-2025-71450: benhoyt inih: inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to…3.3 Low4.8 MediumN/ANov 2, 2026
CVE-2025-62819: n/a: Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via…N/AN/AN/ANov 2, 2026
CVE-2026-115654: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that…N/A6.9 MediumN/ANov 2, 2026
CVE-2026-115653: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a…N/A7.0 HighN/ANov 2, 2026
CVE-2026-114408: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6…N/A8.7 HighN/ANov 2, 2026
CVE-2026-118052: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without…N/A6.8 MediumN/ANov 2, 2026
CVE-2026-73697: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection…8.8 High8.7 HighN/ANov 2, 2026
CVE-2026-120491: Wing FTP Software Wing FTP Server: Wing FTP Server before 8.2.6 contains a stored cross-site scripting vulnerability that allows authenticated web-client…5.4 Medium5.1 MediumN/ANov 2, 2026
CVE-2026-120461: dromara Jpom: Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves…8.8 High8.7 HighN/ANov 2, 2026
CVE-2026-120457: Deutsches Klimarechenzentrum libaec: libaec through 1.1.7 contains an out-of-bounds read vulnerability in m_se_decode() in src/decode.c that allows…5.3 Medium5.8 MediumN/ANov 2, 2026
CVE-2026-120453: The Sleuth Kit: The Sleuth Kit through 4.15.0 contains a heap out-of-bounds read vulnerability in hfs_load_extended_attrs() in…3.3 Low4.8 MediumN/ANov 2, 2026
CVE-2026-120449: Outline: Outline before 1.12.0 contains an improper access control vulnerability that allows unauthenticated users to read…5.3 Medium6.9 MediumN/ANov 2, 2026
CVE-2026-120445: madong-code madong-admin-saas: madong-admin-saas through 5.1.4 contains an incorrect authorization vulnerability in AccessTokenMiddleware that allows…8.8 High8.7 HighN/ANov 2, 2026
CVE-2026-120441: OwnTone OwnTone Server: OwnTone Server through 29.3 contains an sql injection vulnerability in mpd_sticker_find() in src/mpd.c that allows…5.3 Medium6.9 MediumN/ANov 2, 2026
CVE-2026-120437: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in…6.1 Medium6.9 MediumN/ANov 2, 2026
CVE-2026-120433: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120429: owen2345 Camaleon CMS: Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows…7.1 High7.1 HighN/ANov 2, 2026
CVE-2026-120425: munafio Chatify: Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that…6.5 Medium7.1 HighN/ANov 2, 2026
CVE-2026-120463: sassanix Warracker: Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an…6.5 Medium6.0 MediumN/ANov 2, 2026
76-100 of 574114
‹›