The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121577: lucasrodes whatstk: Inefficient Regular Expression Complexity (CWE-1333) in generate_regex() (whatstk/whatsapp/parser.py) in whatstk from…N/A6.7 MediumN/ANov 3, 2026
CVE-2026-120567: MongoDB Entity Framework Core Provider: The MongoDB Entity Framework Core provider does not neutralize special elements when it places a caller-supplied value…5.4 Medium2.3 LowN/ANov 3, 2026
CVE-2026-110826: team-alembic ash_authentication: Improper Session Invalidation after Authentication Credential Change vulnerability in team-alembic ash_authentication…N/A6.3 MediumN/ANov 3, 2026
CVE-2026-105822: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT proxy contains a server-side request forgery (SSRF) vulnerability because it accepts a…N/A8.3 HighN/ANov 3, 2026
CVE-2026-105821: TP-Link Systems Inc. Tapo Cloud Service: The Tapo Cloud MQTT broker contains a broken access control vulnerability in a proxy topic used by authenticated Tapo…N/A8.3 HighN/ANov 3, 2026
CVE-2025-71452: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…6.1 Medium5.1 MediumN/ANov 3, 2026
CVE-2025-71451: Vembu Technologies BDRSuite: Vembu BDRSuite before 7.6.0 contains an unauthenticated cross-site scripting vulnerability in…6.1 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-120959: MongoDB Atlas SQL: A memory-handling flaw in the MongoDB Atlas SQL ODBC Driver can cause values returned for a query to be written outside…3.7 Low2.1 LowN/ANov 3, 2026
CVE-2026-120952: MongoDB Atlas SQL ODBC Driver: An out-of-bounds write in the MongoDB Atlas SQL ODBC Driver may be triggered when a value of a particular database type…7.1 High6.0 MediumN/ANov 3, 2026
CVE-2026-121502: mathurvishal CloudClassroom-PHP-Project: A vulnerability was identified in mathurvishal CloudClassroom-PHP-Project7.3 High6.9 MediumN/ANov 3, 2026
CVE-2026-61495: hathach TinyUSB: TinyUSB through 0.21.0, fixed in commit e85c2b8, contains an out-of-bounds write vulnerability in the MTP device class…6.8 Medium7.0 HighN/ANov 3, 2026
CVE-2026-95860: node-opcua: node-opcua is an OPC UA implementation for TypeScript and Node.js9.1 CriticalN/AN/ANov 3, 2026
CVE-2026-95730: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A buffer overflow vulnerability exists in HPE Networking VIA that could allow an authenticated low-privileged local…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-95729: Hewlett Packard Enterprise (HPE) Virtual Intranet Access (VIA): A sensitive information disclosure vulnerability exists in HPE Networking VIA6.5 MediumN/AN/ANov 3, 2026
CVE-2026-82976: Red Hat: A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack7.1 HighN/AN/ANov 3, 2026
CVE-2026-63417: armurox loggingredactor: Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or…N/A8.2 HighN/ANov 3, 2026
CVE-2026-63198: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP7.3 HighN/AN/ANov 3, 2026
CVE-2026-63197: traPtitech traQ: traQ is a messenger application built for Digital Creators Club traP7.3 HighN/AN/ANov 3, 2026
CVE-2026-57154: opnsense core: OPNsense is a FreeBSD based firewall and routing platform8.1 HighN/AN/ANov 3, 2026
CVE-2026-46487: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources7.5 HighN/AN/ANov 3, 2026
CVE-2026-39379: geonetwork core-geonetwork: GeoNetwork is a catalog application to manage spatially referenced resources7.1 HighN/AN/ANov 3, 2026
CVE-2026-121652: AWS maplibre-gl-js-amplify: Cross-site scripting (XSS) issue in AWS Amplify maplibre-gl-js-amplify before 4.0.3 might allow remote authenticated…5.4 Medium4.8 MediumN/ANov 3, 2026
CVE-2026-121501: mathurvishal CloudClassroom-PHP-Project: A vulnerability was determined in mathurvishal CloudClassroom-PHP-Project6.3 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121382: Netcore NBR100V2: A vulnerability was determined in Netcore NBR100V2 1.3.240614.0309287.5 High7.7 HighN/ANov 3, 2026
CVE-2026-120956: MongoDB C Driver: The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query…7.1 High7.1 HighN/ANov 3, 2026
76-100 of 528356
‹›