The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-81843: Grafana: Grafana is an open-source platform for monitoring and observability6.5 MediumN/AN/ANov 12, 2026
CVE-2026-71363: Red Hat Red Hat Ansible Automation Platform 2: A flaw was found in AWX5.3 MediumN/AN/ANov 12, 2026
CVE-2026-127204: wp.insider: WooCommerce PayPal Pro Payment Gateway plugin before 4.1.1 contains an unauthenticated payment bypass vulnerability…7.5 High8.7 HighN/ANov 12, 2026
CVE-2026-127101: Red Hat: A flaw was found in SSSD's PAM responder5.5 MediumN/AN/ANov 12, 2026
CVE-2026-127100: Red Hat: A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled5.5 MediumN/AN/ANov 12, 2026
CVE-2026-127099: Red Hat: A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys5.9 MediumN/AN/ANov 12, 2026
CVE-2026-127063: DataComm RMM+: The third-party RMM+ extension for ConnectWise ScreenConnect uses a static API secret by defaultN/A9.3 CriticalN/ANov 12, 2026
CVE-2026-126831: Red Hat: A flaw was found in cpio5.5 MediumN/AN/ANov 12, 2026
CVE-2026-126199: pgEdge pgedge-postgres-mcp: pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible…6.8 MediumN/AN/ANov 12, 2026
CVE-2026-126198: pgEdge pgedge-postgres-mcp: pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible…3.1 LowN/AN/ANov 12, 2026
CVE-2026-126197: pgEdge pgedge-postgres-mcp: pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible…8.8 HighN/AN/ANov 12, 2026
CVE-2026-126196: pgEdge pgedge-postgres-mcp: pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible…8.1 HighN/AN/ANov 12, 2026
CVE-2026-125324: Rejected reason: This CVE is a duplicate of another CVE.N/AN/AN/ANov 12, 2026
CVE-2026-124702: Progress Software Telerik UI for WPF: In Telerik UI for WPF, versions prior to 2026.4.1110, an untrusted URL redirection vulnerability exists that allows an…7.8 HighN/AN/ANov 12, 2026
CVE-2026-124700: Progress Software Telerik UI for WinForms: In Telerik UI for WinForms, versions prior to 2026.4.1111, an untrusted URL redirection vulnerability exists that…7.8 HighN/AN/ANov 12, 2026
CVE-2026-119275: Akaunting: Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in the XLSX invoice-import workflowN/A7.0 HighN/ANov 12, 2026
CVE-2026-107365: Grafana: A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other…N/A5.3 MediumN/ANov 12, 2026
CVE-2026-106475: Grafana: The Elasticsearch data source resource proxy forwards the request method and path to Elasticsearch using the data…7.1 HighN/AN/ANov 12, 2026
CVE-2026-106472: Grafana: Grafana's Prometheus data source passes the resource path supplied by the caller to the configured Prometheus server…6.3 MediumN/AN/ANov 12, 2026
CVE-2026-106154: Progress Software Telerik UI for ASP.NET Core: In Progress® Telerik® UI for ASP.NET Core versions `2015.1.318` through `2026.3.1015`, the server-side FilterParser…8.6 HighN/AN/ANov 12, 2026
CVE-2026-106146: Progress Software Telerik UI for ASP.NET MVC: In Progress® Telerik® UI for ASP.NET MVC versions `2012.2.710` through `2026.3.1015`, server-side filter processing…8.6 HighN/AN/ANov 12, 2026
CVE-2026-117544: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - IDOR allowing restricted file downloads in jDownloads < 4.1.8 - The `other_file_id`…N/A8.2 HighN/ANov 12, 2026
CVE-2026-117542: jdownloads.com jDownloads extension for Joomla: Joomla Extension - jdownloads.com - Authenticated path traversal in jDownloads < 4.1.8 - A manipulated `update_file`…N/A5.1 MediumN/ANov 12, 2026
CVE-2026-120467: Datasolution AcyMailing extension for Joomla and WordPress: Joomla / WordPress Extension - acymailing.com - Subscriber identity not bound to the record acted upon in AcyMailing…N/A7.1 HighN/ANov 12, 2026
CVE-2026-120468: Datasolution AcyMailing extension for Joomla: Joomla Extension - acymailing.com - Unauthenticated disclosure of mailing list metadata in AcyMailing 1.0.0 - 11.1.1 -…N/A6.9 MediumN/ANov 12, 2026
76-100 of 433023