The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-28335: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution8.4 HighN/AN/ANov 3, 2026
CVE-2026-119674: MongoDB Database Tools: MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the…3.7 Low2.1 LowN/ANov 3, 2026
CVE-2026-28327: SolarWinds Dameware: SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability8.2 HighN/AN/ANov 3, 2026
CVE-2026-103916: Docker Docker Sandboxes: Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspaceN/A8.4 HighN/ANov 3, 2026
CVE-2026-121562: CTFd: CTFd 3.1.0 before 3.8.7 contains an information disclosure vulnerability in the /api/v1/teams list endpoint that…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121561: HumanSignal: Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that…7.7 High6.3 MediumN/ANov 3, 2026
CVE-2026-121560: logchimp: LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post…7.1 High7.1 HighN/ANov 3, 2026
CVE-2026-121558: Ricky-7-Yan intelligent-audit-system: AuditPilot before commit 4669c93 contains an authorization bypass vulnerability in _metadata_allowed in…4.3 Medium2.3 LowN/ANov 3, 2026
CVE-2026-121557: wppconnect wppconnect-server: WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121556: beecue FastBee: FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows…8.3 High8.7 HighN/ANov 3, 2026
CVE-2026-121554: silkimen cordova-plugin-advanced-http: cordova-plugin-advanced-http 1.5.0 through 3.3.1 contains an information disclosure vulnerability that leaks cookies to…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121553: cotonti: Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing…4.8 Medium6.3 MediumN/ANov 3, 2026
CVE-2026-121552: dromara domain-admin: Dromara domain-admin before 1.6.79 contains a missing authorization vulnerability in the POST /api/getGroupUserList…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121550: jarun nnn: nnn through 5.3 contains an insecure file handling vulnerability that allows local attackers to redirect writes because…3.3 Low1.0 LowN/ANov 3, 2026
CVE-2026-121549: jarun nnn: nnn through 5.3 contains an insecure temporary file vulnerability in the pdfread and nuke plugins that allows local…4.4 Medium4.1 MediumN/ANov 3, 2026
CVE-2026-121548: jarun nnn: Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to…7.8 High8.4 HighN/ANov 3, 2026
CVE-2026-121546: Novik ruTorrent: ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users…5.9 Medium6.0 MediumN/ANov 3, 2026
CVE-2026-121545: robiningelbrecht dreeve: Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that…6.5 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121544: koodo-reader: Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that…4.9 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121455: dbgate: DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated…5.4 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121454: padloc: Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121453: dataease SQLBot: SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated…2.7 Low5.1 MediumN/ANov 3, 2026
CVE-2026-121451: amir1376 ab-download-manager: AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121450: PAICNI CFNext: CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to…7.5 High7.7 HighN/ANov 3, 2026
CVE-2026-121260: Ziroom ZHOME A0101: A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 2020041514059.1 Critical8.5 HighN/ANov 3, 2026
76-100 of 528356
‹›