The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-126541: WWBN AVideo: WWBN AVideo through 29.7.1 contains a missing authorization vulnerability in Live plugin restream endpoints that allows…8.1 High8.6 HighN/ANov 11, 2026
CVE-2026-126539: directus: Directus before 12.1.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to skip…8.1 High9.2 CriticalN/ANov 11, 2026
CVE-2026-126499: jellyfin: Jellyfin before 12.0 contains a path traversal vulnerability in the DELETE /Library/VirtualFolders and POST…7.4 High8.3 HighN/ANov 11, 2026
CVE-2026-126498: Musing Studio WriteFreely: WriteFreely before 0.17.3 contains a stored cross-site scripting vulnerability that allows authenticated authors to…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126497: LibreCAD: LibreCAD through 2.2.1.6 contains a heap-based out-of-bounds write vulnerability in the bundled libdxfrw…7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-126496: 1Panel-dev CordysCRM: 1Panel-dev CordysCRM before 1.9.6 contains an authorization bypass vulnerability in CustomerContactController.get that…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126495: emqx MQTTX: MQTTX desktop through 1.13.3 contains a stored cross-site scripting vulnerability that allows attackers to inject…6.1 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126188: rails: Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record…3.7 LowN/AN/ANov 11, 2026
Cisco ISE: CVE-2026-20183: Cisco Identity Services Engine Authorization Bypass Vulnerabilities4.3 MediumN/AN/ANov 10, 2026
Fortinet FortiManager: CVE-2026-126261: FGFM elevation before registration password is verified9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-126187: react: React is a JavaScript library for building user interfacesN/A9.5 CriticalN/ANov 10, 2026
CVE-2026-123084: Red Hat: An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the…6.5 MediumN/AN/ANov 10, 2026
CVE-2024-36309: AMD: Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally…N/A4.6 MediumN/ANov 10, 2026
CVE-2026-96437: Kong Inc. Kong Gateway Enterprise: The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the…N/A8.2 HighN/ANov 10, 2026
CVE-2026-92558: Kong Inc.: The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator…N/A6.3 MediumN/ANov 10, 2026
CVE-2026-92545: Kong Inc.: The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request…N/A8.7 HighN/ANov 10, 2026
CVE-2026-92443: Kong Inc.: The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying…N/A8.2 HighN/ANov 10, 2026
CVE-2026-92442: Kong Inc.: The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key,…N/A8.3 HighN/ANov 10, 2026
CVE-2026-92441: Kong Inc.: Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the…N/A7.8 HighN/ANov 10, 2026
CVE-2026-92439: Kong Inc.: The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for…N/A7.8 HighN/ANov 10, 2026
CVE-2026-91000: N-able N-central: Missing authentication for critical function vulnerability in N-able N-central allows Privilege EscalationN/A8.4 HighN/ANov 10, 2026
CVE-2026-90834: zephyrproject zephyr: The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the…5.5 MediumN/AN/ANov 10, 2026
CVE-2026-90833: zephyrproject zephyr: The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with…7.8 HighN/AN/ANov 10, 2026
CVE-2026-90832: zephyrproject zephyr: bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and…4.3 MediumN/AN/ANov 10, 2026
WordPress Plugin: basel-post-types: CVE-2026-89324: Improper Authentication9.8 CriticalN/AN/ANov 10, 2026
1051-1075 of 433023