The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-122014: NPC-Worldwide npcpy: A vulnerability has been found in NPC-Worldwide npcpy up to 2.1.276.3 Medium2.1 LowN/ANov 4, 2026
CVE-2026-97705: moleculerjs moleculer: Moleculer is a progressive microservices framework for Node.js7.5 HighN/AN/ANov 4, 2026
CVE-2026-76806: solidtime-io solidtime: Solidtime is an open-source time-tracking app6.3 MediumN/AN/ANov 4, 2026
CVE-2026-122220: wpo365 WPO365 | SEAMLESS WORDPRESS + MICROSOFT INTEGRATION (WPO365 | LOGIN): WPO365 | LOGIN (wpo365-login) plugin before version 45.2 contains an authentication bypass by capture-replay…7.4 High9.1 CriticalN/ANov 4, 2026
CVE-2026-122192: AWS firecracker: Improper handling of a failed memory remap in Firecracker versions 0.23.0 through 1.16.1 might allow a guest user with…7.5 High7.1 HighN/ANov 4, 2026
CVE-2026-121933: Linksys E5350: A flaw has been found in Linksys E5350 1.0.00.03710.0 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-115574: zulip: Zulip is an open-source team collaboration tool5.3 MediumN/AN/ANov 4, 2026
CVE-2026-115474: zulip: Zulip is an open-source team collaboration tool6.5 MediumN/AN/ANov 4, 2026
CVE-2026-113374: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 does not require realm administration permission when a user creates a Rut Auth capabilityN/A8.6 HighN/ANov 4, 2026
CVE-2026-113373: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 Pro does not check the local account status when a user signs in through a configured SAML…N/A9.1 CriticalN/ANov 4, 2026
CVE-2026-113372: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 returns the private signing key of a YUM proxy or group repository to an account that holds…N/A7.1 HighN/ANov 4, 2026
CVE-2026-113371: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 returns the signing passphrase of an APT or YUM repository, through an internal REST…N/A7.1 HighN/ANov 4, 2026
CVE-2026-113370: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 contains a SQL injection vulnerability in the optional "Reindex Search Tables By Pattern"…N/A7.7 HighN/ANov 4, 2026
CVE-2026-113369: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account…N/A6.3 MediumN/ANov 4, 2026
CVE-2026-113368: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the…N/A5.3 MediumN/ANov 4, 2026
CVE-2026-97701: zulip: Zulip is an open-source team collaboration tool6.5 MediumN/AN/ANov 4, 2026
CVE-2026-82033: deepseek-ai deepseek-harness: DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication…8.4 High8.6 HighN/ANov 4, 2026
CVE-2026-82029: invoiceninja: Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-63183: omniauth: OmniAuth is a flexible authentication system utilizing Rack middlewareN/A6.9 MediumN/ANov 4, 2026
CVE-2026-122148: Yealink MeetingBoard Pro: In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass…N/A8.2 HighN/ANov 4, 2026
CVE-2026-122124: Yealink UVC40 E2: On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi…6.1 MediumN/AN/ANov 4, 2026
CVE-2026-122120: Yealink Plug-in Softwares: In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific…9.0 CriticalN/AN/ANov 4, 2026
CVE-2026-121932: Linksys E5350: A vulnerability was detected in Linksys E5350 1.0.00.03710.0 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121931: Linksys WRT54GL: A security vulnerability has been detected in Linksys WRT54GL 4.30.189.1 Critical8.5 HighN/ANov 4, 2026
CVE-2026-121930: Linksys WRT54GL: A weakness has been identified in Linksys WRT54GL 4.30.189.1 Critical8.5 HighN/ANov 4, 2026
76-100 of 418286
‹›