The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-18379: Red Hat Red Hat Enterprise Linux 10: A flaw was found in yggdrasil-worker-package-manager8.8 HighN/AN/ANov 12, 2026
CVE-2026-127236: The OpenNMS Group: An argument injection vulnerability exists in the ad-hoc RRD graph feature of multiple versions of OpenNMS Meridian and…5.4 MediumN/AN/ANov 12, 2026
CVE-2026-127235: The OpenNMS Group: A reflected cross-site scripting vulnerability exists in the web user interface of multiple versions of OpenNMS…6.1 MediumN/AN/ANov 12, 2026
CVE-2026-127119: AWS aws-sdk-pandas: Unverified ownership of the default cluster log location in the EMR module in AWS SDK for pandas (awswrangler) from…5.3 Medium5.9 MediumN/ANov 12, 2026
CVE-2026-126838: MongoDB Rust Driver: A MongoDB Rust Driver component that holds client-side field level encryption settings includes key management service…5.5 Medium5.7 MediumN/ANov 12, 2026
CVE-2026-126204: express-rate-limit: express-rate-limit is a basic rate-limiting middleware for Express3.7 LowN/AN/ANov 12, 2026
CVE-2026-126203: flavorjones loofah: Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri6.1 MediumN/AN/ANov 12, 2026
CVE-2026-121619: sensiolabs symfony: The Symfony FrameworkBundle framework.trusted_proxies option and the HttpFoundation Request::setTrustedProxies() method…N/A6.3 MediumN/ANov 12, 2026
CVE-2026-120467: Datasolution AcyMailing extension for Joomla and WordPress: Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing…N/A7.1 HighN/ANov 12, 2026
CVE-2026-120033: frrouting: In FRRouting 10.1 and later, bgpd does not correctly close a BGP session when the Send Hold Timer (RFC 9687) expires,…N/A6.0 MediumN/ANov 12, 2026
CVE-2026-117544: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id`…N/A8.2 HighN/ANov 12, 2026
CVE-2026-117542: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file`…N/A5.1 MediumN/ANov 12, 2026
CVE-2026-0436: AMD: Insufficient parameter sanitization in the AMD Secure Processor (ASP) trusted execution environment (TEE) SPDM driver…N/A6.9 MediumN/ANov 12, 2026
CVE-2026-0101: AMD: Improper validation of specified quantities in input within AMD Power Management Firmware (PMFW) could allow a local…N/A6.8 MediumN/ANov 12, 2026
CVE-2026-0004: AMD: A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute code on…N/A5.7 MediumN/ANov 12, 2026
CVE-2025-54501: AMD: Improper access control on an internal debug interface could allow a high privileged attacker to bypass memory access…N/A5.9 MediumN/ANov 12, 2026
CVE-2024-21954: AMD: Improper exception handling in IOMMU could allow an invalidate command to be sent to PCIe devices that do not support…N/A7.0 HighN/ANov 12, 2026
CVE-2026-81843: Grafana: Grafana is an open-source platform for monitoring and observability6.5 MediumN/AN/ANov 12, 2026
CVE-2026-71363: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in AWX5.3 MediumN/AN/ANov 12, 2026
CVE-2026-127204: wp.insider: WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability…7.5 High8.7 HighN/ANov 12, 2026
CVE-2026-127101: Red Hat: A flaw was found in SSSD's PAM responder5.5 MediumN/AN/ANov 12, 2026
CVE-2026-127100: Red Hat: A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled5.5 MediumN/AN/ANov 12, 2026
CVE-2026-127099: Red Hat: A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys5.9 MediumN/AN/ANov 12, 2026
CVE-2026-127063: DataComm RMM+: The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by defaultN/A9.3 CriticalN/ANov 12, 2026
CVE-2026-126831: Red Hat: A flaw was found in cpio5.5 MediumN/AN/ANov 12, 2026
76-100 of 433023