The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121387: FreeRDP: FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121386: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-118527: Ivanti Connect Secure: Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-118489: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…7.5 HighN/AN/ANov 3, 2026
CVE-2026-118488: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an…5.9 MediumN/AN/ANov 3, 2026
CVE-2026-110265: runZero Platform: A specially crafted malformed search query could return results from outside a user's organization6.5 MediumN/AN/ANov 3, 2026
CVE-2026-106991: n/a: hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control7.1 HighN/AN/ANov 3, 2026
CVE-2026-100493: AMD AMD Compressionator SDK: An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS…N/A6.9 MediumN/ANov 3, 2026
CVE-2026-73328: volmarg personal-management-system: Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121562: CTFd: CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121561: HumanSignal: Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that…7.7 High6.3 MediumN/ANov 3, 2026
CVE-2026-121560: logchimp: LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post…7.1 High7.1 HighN/ANov 3, 2026
CVE-2026-121559: glpi-project GLPI: GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121558: Ricky-7-Yan intelligent-audit-system: AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in…4.3 Medium2.3 LowN/ANov 3, 2026
CVE-2026-121557: wppconnect wppconnect-server: WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121556: beecue FastBee: FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows…8.3 High8.7 HighN/ANov 3, 2026
CVE-2026-121555: DrizzleTime Foxel: Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121554: silkimen cordova-plugin-advanced-http: cordova-plugin-advanced-http through 3.3.1 contains an information disclosure vulnerability that leaks cookies to…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121553: cotonti: Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing…4.8 Medium6.3 MediumN/ANov 3, 2026
CVE-2026-121552: dromara domain-admin: Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121551: postfixadmin: PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users…5.4 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-121550: jarun nnn: nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because…3.3 Low1.0 LowN/ANov 3, 2026
CVE-2026-121549: jarun nnn: nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local…4.4 Medium4.1 MediumN/ANov 3, 2026
CVE-2026-121548: jarun nnn: Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to…7.8 High8.4 HighN/ANov 3, 2026
CVE-2026-121547: Canop dysk: Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject…2.2 Low1.0 LowN/ANov 3, 2026
76-100 of 528356
‹›