The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120440: QuickJS-NG: QuickJS-NG before 0.16.0 contains a memory leak vulnerability in js_atomics_store() in quickjs.c that fails to free the…5.3 Medium6.9 MediumN/ANov 2, 2026
CVE-2026-120437: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an out-of-bounds read vulnerability in…6.1 Medium6.9 MediumN/ANov 2, 2026
CVE-2026-120436: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains an integer overflow in jbigtopnm that…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120433: Netpbm: Netpbm before 10.86.51, 11.x before 11.02.30, and 11.03 before 11.15.08 contains a stack-based buffer overflow in the…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120432: Netpbm: Netpbm before 10.86.51, 11.02.30, and 11.15.08 contains an integer overflow vulnerability in winicontopam that allows…7.8 High8.5 HighN/ANov 2, 2026
CVE-2026-120429: owen2345 Camaleon CMS: Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows…7.1 High7.1 HighN/ANov 2, 2026
CVE-2026-120428: Chaitin PandaWiki: PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 MediumN/ANov 2, 2026
CVE-2026-120425: munafio Chatify: Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that…6.5 Medium7.1 HighN/ANov 2, 2026
CVE-2026-120318: Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing…7.2 High8.6 HighN/ANov 2, 2026
CVE-2026-74993: Starnet Computer and Network Systems Inventory Tracking Application: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer…7.5 HighN/AN/ANov 2, 2026
CVE-2026-120463: sassanix Warracker: Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an…6.5 Medium6.0 MediumN/ANov 2, 2026
CVE-2026-114364: Apache Software Foundation Apache Syncope: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-113687: Apache Software Foundation Apache Syncope: Improper isolation or compartmentalization vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-113511: Apache Software Foundation Apache Syncope: Authorization bypass through User-Controlled key vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-111959: Apache Software Foundation Apache Arrow Rust: Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1,…N/AN/AN/ANov 2, 2026
CVE-2026-110535: Apache Software Foundation Apache Syncope: Improper Privilege Management vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-109083: Apache Software Foundation Apache Syncope: Improper isolation or compartmentalization vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-105602: joomshaper.com Helix Ultimate extension for Joomla: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate <…N/A8.6 HighN/ANov 2, 2026
CVE-2026-105601: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5N/A5.3 MediumN/ANov 2, 2026
CVE-2026-105600: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5N/A8.6 HighN/ANov 2, 2026
CVE-2026-103420: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5N/A7.2 HighN/ANov 2, 2026
CVE-2026-103419: joomshaper.com Helix Ultimate extension for Joomla: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.N/A8.6 HighN/ANov 2, 2026
CVE-2026-102802: regularlabs.com: Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles…N/A8.9 HighN/ANov 2, 2026
CVE-2026-102801: regularlabs.com: Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere…N/A5.1 MediumN/ANov 2, 2026
CVE-2026-92886: TÜBİTAK BİLGEM Software Technologies Research Institute eta-register: Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows…7.8 HighN/AN/ANov 2, 2026
101-125 of 574114
‹›