The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-113369: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 allows a user account that can push manifests to a hosted OCI repository (a user account…N/A6.3 MediumN/ANov 4, 2026
CVE-2026-113368: Sonatype Nexus Repository 3: Sonatype Nexus Repository 3 does not check that a user account is authorized to access a repository before the…N/A5.3 MediumN/ANov 4, 2026
CVE-2026-97701: zulip: Zulip is an open-source team collaboration tool6.5 MediumN/AN/ANov 4, 2026
CVE-2026-82033: deepseek-ai deepseek-harness: DeepSeek Harness prior to 0.1.2-alpha.2, and specifically commit 3e24087, contains a missing authentication…8.4 High8.6 HighN/ANov 4, 2026
CVE-2026-82029: invoiceninja: Invoice Ninja before 5.13.28 contains a broken access control vulnerability that allows authenticated vendor-portal…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-63183: omniauth: OmniAuth is a flexible authentication system utilizing Rack middlewareN/A6.9 MediumN/ANov 4, 2026
CVE-2026-122148: Yealink MeetingBoard Pro: In Yealink MeetingBoard Pro before 331.320.0.64, the Web management module has a front-end validation bypass…N/A8.2 HighN/ANov 4, 2026
CVE-2026-122124: Yealink UVC40 E2: On Yealink UVC40 E2 devices before 319.410.0.71, an attacker with short-term physical access can steal Wi‑Fi…6.1 MediumN/AN/ANov 4, 2026
CVE-2026-122120: Yealink Plug-in Softwares: In Yealink Plug-in Softwares before 2.35.219.0, there is an unauthorized file write vulnerability under specific…9.0 CriticalN/AN/ANov 4, 2026
CVE-2026-121932: Linksys E5350: A vulnerability was detected in Linksys E5350 1.0.00.03710.0 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121931: Linksys WRT54GL: A security vulnerability has been detected in Linksys WRT54GL 4.30.189.1 Critical8.5 HighN/ANov 4, 2026
CVE-2026-121930: Linksys WRT54GL: A weakness has been identified in Linksys WRT54GL 4.30.189.1 Critical8.5 HighN/ANov 4, 2026
CVE-2026-121929: EmpireSoft EmpireCMS: A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.03.5 Low2.0 LowN/ANov 4, 2026
CVE-2026-121928: InfiniFlow RAGFlow: A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.23.5 Low2.0 LowN/ANov 4, 2026
CVE-2026-113783: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework7.4 HighN/AN/ANov 4, 2026
CVE-2026-113782: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework7.1 HighN/AN/ANov 4, 2026
CVE-2026-113780: espressif esp-idf: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework9.3 CriticalN/AN/ANov 4, 2026
CVE-2026-107846: bitcoinjs bitcoinjs-lib: bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsersN/A9.3 CriticalN/ANov 4, 2026
CVE-2026-102345: zammad: Zammad is a web based open source helpdesk/customer support systemN/A5.1 MediumN/ANov 4, 2026
CVE-2026-57853: DataGerry: DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with…8.8 High8.7 HighN/ANov 4, 2026
CVE-2026-122118: Yealink: In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK…7.4 HighN/AN/ANov 4, 2026
CVE-2026-122116: Yealink: Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X…4.3 MediumN/AN/ANov 4, 2026
CVE-2026-122054: The GNU C Library glibc: Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU…5.9 MediumN/AN/ANov 4, 2026
CVE-2026-121971: Exposure of Sensitive InformationN/A8.2 HighN/ANov 4, 2026
CVE-2026-121927: A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.36.3 Medium2.1 LowN/ANov 4, 2026
101-125 of 418286
‹›