Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2025-53698: Johnson Controls: Missing protection mechanism for alternate hardware interface vulnerability in Johnson Controls iSTAR Ultra and Johnson…N/A7.0 High0%Nov 13, 2026
CVE-2025-53697: Johnson Controls: Use of default credentials vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson…N/A8.4 High0%Nov 13, 2026
CVE-2025-43874: Johnson Controls: : Improper Neutralization of Special Elements used in an OS Command vulnerability in Johnson Controls iSTAR Ultra,…N/A8.7 High1%Nov 13, 2026
CVE-2026-92738: HashiCorp: Vault's Login MFA feature did not consistently enforce the lifetime of pending two-phase login requests6.8 MediumN/A0%Nov 13, 2026
CVE-2026-89037: dolibarr: Dolibarr before 24.0.2 contains an insecure direct object reference vulnerability in the REST Documents API for the…6.5 Medium7.1 High0%Nov 13, 2026
CVE-2026-82504: VITEC EZ TV Platform Server: VITEC EZ TV Platform Server before 8.5.0 contains an unrestricted file upload vulnerability in the upload handler that…9.8 Critical9.3 Critical1%Nov 13, 2026
CVE-2026-128987: Red Hat Red Hat Enterprise Linux 10: A flaw was found in dbus6.2 MediumN/A0%Nov 13, 2026
CVE-2026-128885: Red Hat Red Hat Enterprise Linux 10: A flaw was found in D-Bus5.5 MediumN/A0%Nov 13, 2026
CVE-2026-128133: Rejected reason: This CVE is a duplicate of another CVE.N/AN/AN/ANov 13, 2026
CVE-2026-128132: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.7 High0%Nov 13, 2026
CVE-2026-128131: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.7 High1%Nov 13, 2026
CVE-2026-128130: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.3 High0%Nov 13, 2026
CVE-2026-128129: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.2 High1%Nov 13, 2026
CVE-2026-128128: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python7.5 HighN/A0%Nov 13, 2026
CVE-2026-128127: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.7 High1%Nov 13, 2026
CVE-2026-128126: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.7 High1%Nov 13, 2026
CVE-2026-128125: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A6.3 Medium1%Nov 13, 2026
CVE-2026-128124: aio-libs aiohttp: AIOHTTP is an asynchronous HTTP client/server framework for asyncio and PythonN/A8.2 High1%Nov 13, 2026
CVE-2026-127217: Koen Reus Post to Google My Business (Google Business Profile): Post to Google My Business plugin for WordPress before 3.5.7 contains a blind server-side request forgery vulnerability…6.4 Medium5.3 Medium0%Nov 13, 2026
CVE-2026-127216: Fahad Mahmood Injection Guard: Injection Guard plugin for WordPress before 1.4.0 contains a cross-site request forgery vulnerability that allows…6.5 Medium7.1 High0%Nov 13, 2026
CVE-2025-43867: Johnson Controls: - Dependency on Vulnerable Third-Party Component vulnerability in Johnson Controls FX Server, Johnson Controls FX80,…N/A8.5 High0%Nov 13, 2026
CVE-2026-68905: lanshi17 hugo_blog: Hugo Blog is a tech blog site8.2 HighN/A0%Nov 13, 2026
CVE-2026-68551: teelur budget-board: Budget Board is an app for tracking monthly spending and working towards financial goalsN/A8.3 High0%Nov 13, 2026
CVE-2026-128123: sveltejs, @sveltejs: SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte5.9 MediumN/A0%Nov 13, 2026
CVE-2026-128122: sveltejs kit: SvelteKit is a framework for rapidly developing robust, performant web applications using Svelte5.9 MediumN/A0%Nov 13, 2026
101-125 of 561732