The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121508: D3TN GmbH µD3TN: Use-After-Free in µD3TN BPv6 Fragmenter Cleanup allows Unauthenticated Remote Attacker to Cause DoS on Allocation…5.9 MediumN/AN/ANov 3, 2026
CVE-2026-121507: D3TN GmbH µD3TN: Double Free in µD3TN BPv6 Fragmenter Block Duplication allows Unauthenticated Remote Attacker to Cause DoS on…5.9 MediumN/AN/ANov 3, 2026
CVE-2026-121506: NTPsec: An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5…7.4 HighN/AN/ANov 3, 2026
CVE-2026-121505: NTPsec: An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4…3.7 LowN/AN/ANov 3, 2026
CVE-2026-121448: Finsys dockhand: Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and…8.3 High8.7 HighN/ANov 3, 2026
CVE-2026-121447: darylldoyle svg-sanitizer: svg-sanitizer before 1.1.0 contains a cross-site scripting vulnerability that allows attackers to bypass sanitization…6.1 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121446: darylldoyle svg-sanitizer: svg-sanitizer from 0.5.0 before 1.1.0 contains an incomplete filtering vulnerability that allows attackers to bypass…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121444: darylldoyle svg-sanitizer: svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121443: darylldoyle svg-sanitizer: svg-sanitizer from 1.1.0 before 1.1.1 contains a denial of service vulnerability that allows remote attackers to crash…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121442: frappe hrms: Frappe HRMS before 15.61.0 contains a permission bypass vulnerability that allows authenticated employees to view other…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121440: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121439: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contains a response splitting vulnerability in wasi-http p3 that…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121438: lepture mistune: Mistune before 3.3.3 contains a denial of service vulnerability in InlineParser.parse_link that allows attackers to…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121436: froxlor: Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121435: froxlor: Froxlor before 2.3.15 contains an authorization bypass vulnerability that allows authenticated customers to create…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121434: froxlor: Froxlor 2.3.0 before 2.3.15 contains a missing authorization check in the Certificates.add and Certificates.update API…5.4 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121433: AzuraCast: AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media…5.4 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-121432: AzuraCast: AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject…3.5 Low5.1 MediumN/ANov 3, 2026
CVE-2026-121431: AzuraCast: AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121430: AzuraCast: AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST…5.4 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121429: AzuraCast: AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121428: AzuraCast: AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121427: AzuraCast: AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121426: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr…6.5 Medium8.3 HighN/ANov 3, 2026
CVE-2026-121424: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote…6.5 Medium8.3 HighN/ANov 3, 2026
101-125 of 528356
‹›