The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121929: EmpireSoft EmpireCMS: A security flaw has been discovered in EmpireSoft EmpireCMS up to 8.03.5 Low2.0 LowN/ANov 4, 2026
CVE-2026-121928: InfiniFlow RAGFlow: A vulnerability was identified in InfiniFlow RAGFlow up to 0.27.23.5 Low2.0 LowN/ANov 4, 2026
CVE-2026-113783: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework7.4 HighN/AN/ANov 4, 2026
CVE-2026-113782: espressif esp-idf: ESP-IDF is the Espressif Internet of Things (IOT) Development Framework7.1 HighN/AN/ANov 4, 2026
CVE-2026-113780: espressif esp-idf: ESF-IDF is the Espressif Internet of Things (IOT) Development Framework9.3 CriticalN/AN/ANov 4, 2026
CVE-2026-107846: bitcoinjs bitcoinjs-lib: bitcoinjs-lib is a JavaScript Bitcoin library for Node.js and browsersN/A9.3 CriticalN/ANov 4, 2026
CVE-2026-102345: zammad: Zammad is a web based open source helpdesk/customer support systemN/A5.1 MediumN/ANov 4, 2026
CVE-2026-57853: DataGerry: DataGerry before 3.3.0 contains a server-side template injection vulnerability that allows authenticated attackers with…8.8 High8.7 HighN/ANov 4, 2026
CVE-2026-122118: Yealink: In certain Yealink products before 2026-04-15, when the Wi-Fi AP function is enabled, a default 8-digit numeric PSK…7.4 HighN/AN/ANov 4, 2026
CVE-2026-122116: Yealink: Certain Yealink terminal devices before 2026-04-21 contain an improper access control vulnerability in the Wi-Fi 802.1X…4.3 MediumN/AN/ANov 4, 2026
CVE-2026-122054: The GNU C Library glibc: Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU…5.9 MediumN/AN/ANov 4, 2026
CVE-2026-121971: Exposure of Sensitive InformationN/A8.2 HighN/ANov 4, 2026
CVE-2026-121927: A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.36.3 Medium2.1 LowN/ANov 4, 2026
CVE-2026-76506: Cisco Cisco Unified Computing System Central Software: A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated,…7.6 HighN/AN/ANov 4, 2026
CVE-2026-76419: Cisco Cisco Unified Communications Manager: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco…6.1 MediumN/AN/ANov 4, 2026
CVE-2026-20241: Cisco: A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-121926: Improper Authentication7.3 High5.5 MediumN/ANov 4, 2026
CVE-2026-119749: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-119748: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows…6.5 Medium6.9 MediumN/ANov 4, 2026
CVE-2026-119747: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the…7.1 High7.1 HighN/ANov 4, 2026
CVE-2026-92704: sharpemu: SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux8.3 HighN/AN/ANov 4, 2026
CVE-2026-91168: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux6.8 MediumN/AN/ANov 4, 2026
CVE-2026-91163: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux3.7 LowN/AN/ANov 4, 2026
CVE-2026-122032: SPIP: SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-121967: coder: Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5,…4.9 Medium2.3 LowN/ANov 4, 2026
101-125 of 418286
‹›