The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120455: biojppm rapidyaml: rapidyaml through 0.16.0 contains an out-of-bounds write vulnerability in ParseEngine::_add_annotation() that allows…6.1 Medium6.9 MediumN/ANov 2, 2026
CVE-2026-120454: The Sleuth Kit: The Sleuth Kit through 4.15.0 contains a NULL pointer dereference vulnerability in decmpfs_decompress_lzvn_attr() that…5.5 Medium6.8 MediumN/ANov 2, 2026
CVE-2026-120452: gPhoto libgphoto2: libgphoto2 through 2.5.34 contains a heap out-of-bounds read and write vulnerability in jl2005bcd_decompress() that…5.4 Medium5.2 MediumN/ANov 2, 2026
CVE-2026-120451: gPhoto libgphoto2: libgphoto2 through 2.5.34 contains stack-based and heap-based buffer overflow vulnerabilities in jl2005c_init() that…6.8 Medium7.0 HighN/ANov 2, 2026
CVE-2026-120450: LaraDashboard: LaraDashboard 1.4.0 before 1.4.9 contains an improper authorization vulnerability that allows authenticated users with…4.3 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120448: doramart DoraCMS: DoraCMS through 3.1.0 contains a mass assignment vulnerability in the PUT /api/v1/user/api-keys/:id endpoint that…8.1 High8.6 HighN/ANov 2, 2026
CVE-2026-120447: bufanyun HotGo: HotGo through 2.15.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to choose…8.1 High9.2 CriticalN/ANov 2, 2026
CVE-2026-120446: madong-code madong-admin-saas: madong-admin-saas through 5.1.4 contains a missing authentication vulnerability in the platform tenant management API…9.4 Critical8.8 HighN/ANov 2, 2026
CVE-2026-120444: sea-team GoFound: GoFound through 1.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to delete arbitrary…8.1 High7.2 HighN/ANov 2, 2026
CVE-2026-120443: sea-team GoFound: GoFound through 1.4.1 contains a stored cross-site scripting vulnerability that allows unauthenticated attackers to…6.1 Medium5.1 MediumN/ANov 2, 2026
CVE-2026-120442: xianhc ape-volo-admin: ape-volo-admin before 3.6.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to…9.8 Critical9.3 CriticalN/ANov 2, 2026
CVE-2026-120440: QuickJS-NG: QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the…5.3 Medium6.9 MediumN/ANov 2, 2026
CVE-2026-120439: QuickJS-NG: QuickJS-NG before 0.16.0 contains an integer overflow in js_typed_array_sort() in quickjs.c that allows attackers to…7.0 High8.3 HighN/ANov 2, 2026
CVE-2026-120438: QuickJS-NG: QuickJS-NG before 0.16.0 contains an integer overflow in js_proxy_get_own_property_names() in quickjs.c that causes a…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120436: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120435: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a heap buffer overflow in xpmtoppm…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120434: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120432: Netpbm: Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120431: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.29, and 11.03 before 11.15.07 contains a heap-based buffer overflow in…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120430: owen2345 Camaleon CMS: Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController…5.4 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120428: Chaitin PandaWiki: PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 MediumN/ANov 2, 2026
CVE-2026-120427: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated…4.3 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120426: OpenCSG CSGHub: OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve…7.5 High8.7 HighN/ANov 2, 2026
CVE-2026-120318: Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing…7.2 High8.6 HighN/ANov 2, 2026
CVE-2026-118052: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without…N/A6.8 MediumN/ANov 2, 2026
76-100 of 574114
‹›