The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126330: Docker Docker Sandboxes: Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned…N/A2.4 LowN/ANov 12, 2026
CVE-2026-126329: Docker Docker Sandboxes: Docker Sandboxes reuses existing state and configuration directories without verifying their ownershipN/A7.3 HighN/ANov 12, 2026
CVE-2026-6467: n/a PostgreSQL: Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege…7.2 HighN/AN/ANov 12, 2026
CVE-2026-6460: n/a PostgreSQL: Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running…8.8 HighN/AN/ANov 12, 2026
CVE-2026-18447: n/a PostgreSQL: Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating…8.8 HighN/AN/ANov 12, 2026
CVE-2026-16240: n/a PostgreSQL: Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a…3.7 LowN/AN/ANov 12, 2026
CVE-2026-16237: n/a PostgreSQL: Improper protection in PostgreSQL INSERT ..5.4 MediumN/AN/ANov 12, 2026
CVE-2026-14661: n/a PostgreSQL: External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent…8.1 HighN/AN/ANov 12, 2026
CVE-2026-126998: n/a JeecgBoot: A security flaw has been discovered in JeecgBoot up to 3.9.57.3 High5.5 MediumN/ANov 12, 2026
CVE-2026-126997: n/a JeecgBoot: A vulnerability was identified in JeecgBoot up to 3.9.67.3 High5.5 MediumN/ANov 12, 2026
CVE-2026-126996: SakanaAI text-to-LoRA: A vulnerability was determined in SakanaAI text-to-LoRA 0.0.16.3 Medium2.1 LowN/ANov 12, 2026
CVE-2026-123790: ComfyUI-Easy-Use: ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST…N/AN/AN/ANov 12, 2026
CVE-2026-120154: n/a PostgreSQL: Improper protection in PostgreSQL INSERT ..4.3 MediumN/AN/ANov 12, 2026
CVE-2026-120153: n/a PostgreSQL: SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to…7.2 HighN/AN/ANov 12, 2026
CVE-2026-120152: n/a PostgreSQL: Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a…4.3 MediumN/AN/ANov 12, 2026
CVE-2026-120151: n/a PostgreSQL: Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the…8.8 HighN/AN/ANov 12, 2026
CVE-2026-120150: n/a PostgreSQL: Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the…8.8 HighN/AN/ANov 12, 2026
CVE-2026-120149: n/a PostgreSQL: Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via…8.8 HighN/AN/ANov 12, 2026
CVE-2026-120148: n/a PostgreSQL: Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating…8.1 HighN/AN/ANov 12, 2026
CVE-2026-120147: n/a PostgreSQL: Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating…8.8 HighN/AN/ANov 12, 2026
CVE-2026-120146: n/a PostgreSQL: Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the…4.3 MediumN/AN/ANov 12, 2026
CVE-2026-120145: n/a PostgreSQL: Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the…8.8 HighN/AN/ANov 12, 2026
CVE-2026-120144: n/a PostgreSQL: Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as…8.8 HighN/AN/ANov 12, 2026
CVE-2026-120143: n/a PostgreSQL: Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating…8.8 HighN/AN/ANov 12, 2026
CVE-2026-120142: n/a PostgreSQL: Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating…8.8 HighN/AN/ANov 12, 2026
76-100 of 433023