The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121546: Novik ruTorrent: ruTorrent before 5.3.20 contains a path traversal vulnerability in the datadir plugin that allows authenticated users…5.9 Medium6.0 MediumN/ANov 3, 2026
CVE-2026-121545: robiningelbrecht dreeve: Dreeve before 5.8.0 contains a missing authentication vulnerability in StravaWebhookRequestHandler::handleEvent that…6.5 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121544: koodo-reader: Koodo Reader through 2.4.6 contains a path traversal vulnerability in the self-hosted HTTP server's OPDS handlers that…4.9 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121543: a466350665 smart-sso: smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121455: dbgate: DbGate before 7.3.3 contains a missing authorization vulnerability that allows connection-restricted authenticated…5.4 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121454: padloc: Padloc through 4.3.0 contains a missing authentication vulnerability in ScimServer._handleScimGet() that allows…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121453: dataease SQLBot: SQLBot through 1.10.3 contains a path traversal vulnerability in the importToDb endpoint that allows authenticated…2.7 Low5.1 MediumN/ANov 3, 2026
CVE-2026-121452: mlogclub bbs-go: bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers…6.5 Medium8.3 HighN/ANov 3, 2026
CVE-2026-121451: amir1376 ab-download-manager: AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121450: PAICNI CFNext: CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to…7.5 High7.7 HighN/ANov 3, 2026
CVE-2026-89295: Eclipse Foundation Eclipse Mnestix: In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the…N/AN/AN/ANov 3, 2026
CVE-2026-85035: zephyrproject zephyr: The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in…8.8 HighN/AN/ANov 3, 2026
CVE-2026-85034: zephyrproject zephyr: The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or…6.7 MediumN/AN/ANov 3, 2026
CVE-2026-85033: zephyrproject zephyr: The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a…4.6 MediumN/AN/ANov 3, 2026
CVE-2026-85032: zephyrproject zephyr: The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system…4.8 MediumN/AN/ANov 3, 2026
CVE-2026-120572: Mozilla Firefox: Incorrect boundary conditions in the Layout: Block and Inline component8.8 HighN/AN/ANov 3, 2026
CVE-2026-119742: Nagios Enterprises, LLC Nagios XI: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-119179: MongoDB Node.js Driver: A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the…7.0 High8.3 HighN/ANov 3, 2026
CVE-2026-99270: Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler()N/AN/AN/ANov 3, 2026
CVE-2026-76124: BuddyBoss BuddyBoss App: The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…8.8 HighN/AN/ANov 3, 2026
CVE-2026-65160: NVIDIA: NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero5.5 MediumN/AN/ANov 3, 2026
CVE-2026-108060: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108059: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108058: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108057: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
101-125 of 528356
‹›