The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-77882: Lenovo System Update: A deserialization of untrusted data vulnerability was discovered in Lenovo System Update that could allow a local…7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-77873: Lenovo System Update: An improper permissions vulnerability was reported in Lenovo System Update that could allow a local authenticated user…7.3 High7.0 HighN/ANov 11, 2026
CVE-2026-126724: Rooxis Rooxis RXR-12: Rooxis RXR-12 Wi-Fi router contains an undocumented UID-0 backdoor account (dg) with a firmware-wide default password…N/AN/AN/ANov 11, 2026
CVE-2026-126723: Rooxis Rooxis RXR-12: Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler…N/AN/AN/ANov 11, 2026
CVE-2026-126722: Rooxis Rooxis RXR-12: Rooxis RXR-12 Wi-Fi router contains an undocumented telnet backdoor daemon (/usr/bin/telnetd_startup) that, upon…N/AN/AN/ANov 11, 2026
CVE-2026-126720: Rooxis Rooxis RXR-12: Rooxis RXR-12 Wi-Fi router contains an unauthenticated remote code execution vulnerability in /usr/bin/cloud_manage,…N/AN/AN/ANov 11, 2026
CVE-2026-124694: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not…7.1 HighN/AN/ANov 11, 2026
CVE-2026-124693: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and…7.1 HighN/AN/ANov 11, 2026
CVE-2026-124692: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList…7.1 HighN/AN/ANov 11, 2026
CVE-2026-124690: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it7.1 HighN/AN/ANov 11, 2026
CVE-2026-124689: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode…7.1 HighN/AN/ANov 11, 2026
CVE-2026-124688: Progress Software Kendo UI for jQuery: In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a…7.1 HighN/AN/ANov 11, 2026
CVE-2026-124687: Progress Software Kendo UI for jQuery: In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton…7.1 HighN/AN/ANov 11, 2026
CVE-2026-122043: EnterpriseDB repmgr: repmgr 4.0.0 through 5.5.0 is affected by an OS command injection vulnerability (CWE-78) in event notificationsN/A6.0 MediumN/ANov 11, 2026
CVE-2026-121737: Facebook proxygen: When a remote, unauthenticated HTTP/1.1 client pipelined the start of a second request and then stopped reading,…N/AN/AN/ANov 11, 2026
CVE-2026-119723: Facebook HHVM: When parsing request variables such as query-string and form parameters, HHVM did not check that appending a nested…N/AN/AN/ANov 11, 2026
CVE-2026-119238: Lenovo XiangBangbang Application: A potential improper permissions vulnerability was reported in Lenovo XiangBangbang that could allow a local…3.3 Low4.8 MediumN/ANov 11, 2026
CVE-2026-119237: Facebook proxygen: In proxygen's HTTP/3 session, when a HEADERS block referenced QPACK dynamic table entries that had not yet been…N/AN/AN/ANov 11, 2026
CVE-2026-119236: Facebook mvfst: An mvfst QUIC server retained CRYPTO frame data received at an encryption level (Initial or Handshake) that the TLS…N/AN/AN/ANov 11, 2026
CVE-2026-119235: Facebook proxygen: proxygen's QPACK decoder enforced its size limit on a string literal in an encoder-stream instruction only after the…N/AN/AN/ANov 11, 2026
CVE-2026-119234: Facebook mvfst: mvfst did not adequately merge or compact out-of-order STREAM frame data, and a small received fragment could keep a…N/AN/AN/ANov 11, 2026
CVE-2026-119233: Facebook proxygen: proxygen's HTTP/3 codec buffered an incomplete non-DATA frame, such as a control-stream frame, a frame of an unknown or…N/AN/AN/ANov 11, 2026
CVE-2026-116633: Lenovo: A potential vulnerability was reported in some Lenovo Tablets that could allow a third-party application to perform an…7.1 High6.9 MediumN/ANov 11, 2026
CVE-2026-110697: Red Hat: A flaw was found in Quay where the robot account listing function constructs a SQL LIKE pattern from user-controlled…9.9 CriticalN/AN/ANov 11, 2026
CVE-2026-64855: hitoshyamamoto soapbar: soapbar is a SOAP library for Python — client, server, and WSDL handling8.2 HighN/AN/ANov 11, 2026
101-125 of 511254