The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules

TitleEitWModules
CVE-2026-127073: OpsTree Solutions BuildPiper: OpsTree BuildPiper before 2.7.0 contains a privilege escalation vulnerability that allows project users to gain…9.9 Critical9.4 CriticalN/ANov 13, 2026
CVE-2026-126955: glanceapp glance: Glance from 0.8.0 before 0.8.8 contains an observable response discrepancy in handlePageRequest and…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126954: glanceapp glance: Glance from 0.7.9 before 0.8.8 contains a stored cross-site scripting vulnerability that allows malicious extension…4.7 Medium2.3 LowN/ANov 13, 2026
CVE-2026-126953: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains an OS command injection vulnerability that allows a malicious or compromised ACS to…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-126952: diced zipline: Zipline through 4.4.0 contains an authentication bypass vulnerability in the WebAuthn login endpoint that creates…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-126951: diced zipline: Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated users to read arbitrary server…N/A6.9 MediumN/ANov 13, 2026
CVE-2026-126950: diced zipline: Zipline through 4.4.0 contains a path traversal vulnerability that allows authenticated attackers to delete arbitrary…N/A7.0 HighN/ANov 13, 2026
CVE-2026-126949: diced zipline: Zipline through 4.4.0 contains a path traversal vulnerability in the PATCH /api/user/files/:id rename endpoint that…N/A7.0 HighN/ANov 13, 2026
CVE-2026-126948: diced zipline: Zipline before 4.5.0 contains an insecure direct object reference vulnerability caused by missing ownership…8.8 High8.7 HighN/ANov 13, 2026
CVE-2026-126947: diced zipline: Zipline before 4.5.0 contains a stored open redirect vulnerability that allows authenticated users to set arbitrary…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126946: diced zipline: Zipline from 4.3.0 before 4.5.0 contains a stored cross-site scripting vulnerability that allows authenticated…5.4 Medium5.1 MediumN/ANov 13, 2026
CVE-2026-126945: diced zipline: Zipline before 4.5.1 contains a stored cross-site scripting vulnerability in the HighlightCode component that renders…8.7 High9.3 CriticalN/ANov 13, 2026
CVE-2026-126944: diced zipline: Zipline before 4.6.1 contains a path traversal vulnerability in LocalDatasource that allows SUPERADMIN users to read or…5.7 Medium5.8 MediumN/ANov 13, 2026
CVE-2026-126943: diced zipline: Zipline from 4.2.0 before 4.6.2 contains an information disclosure vulnerability that logs sensitive environment…4.9 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126942: diced zipline: Zipline before 4.6.2 contains a missing authorization vulnerability in POST /api/user/folders that allows authenticated…5.4 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126941: diced zipline: Zipline through 4.6.2 contains an authorization bypass vulnerability that allows authenticated administrators to read…6.8 Medium8.2 HighN/ANov 13, 2026
CVE-2026-126940: diced zipline: Zipline before 4.6.4 contains a rate limit bypass vulnerability that allows remote attackers to evade request limits by…6.5 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126939: diced zipline: Zipline before 4.6.4 contains an information disclosure vulnerability in GET /api/server/folder/:id that allows…5.3 Medium6.9 MediumN/ANov 13, 2026
CVE-2026-126938: diced zipline: Zipline before 4.6.4 contains a resource allocation vulnerability that allows authenticated users to bypass…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126937: diced zipline: Zipline before 4.6.5 contains a TOCTOU race condition in the POST /api/setup endpoint that allows unauthenticated…8.1 High9.2 CriticalN/ANov 13, 2026
CVE-2026-126936: diced zipline: Zipline before 4.7.0 contains a race condition vulnerability that allows users to bypass invitation usage limits,…5.9 Medium6.0 MediumN/ANov 13, 2026
CVE-2026-126494: openemr: OpenEMR before 8.4.0 contains an improper authorization vulnerability in ScopeRepository::finalizeScopes() that allows…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126493: openemr: OpenEMR before 8.5.0 contains a stored cross-site scripting vulnerability that allows low-privileged patient portal…5.4 Medium4.8 MediumN/ANov 13, 2026
CVE-2026-126492: openemr: OpenEMR before 8.5.0 contains a second-order sql injection vulnerability that allows low-privileged authenticated users…7.1 High7.1 HighN/ANov 13, 2026
CVE-2026-126491: openemr: OpenEMR before 8.5.0 contains a stored SQL injection vulnerability in getByPatientDemographics() where layout_options…7.6 High8.3 HighN/ANov 13, 2026
101-125 of 568393
‹›