The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-82509: vlang v: V programming language standard library net.http through version 0.5.2 prior to commit 4077484 contains a TLS…7.4 High9.1 CriticalN/ANov 10, 2026
CVE-2026-12708: Cloudflare tokio-quiche: Summary Cloudflare tokio-quiche was found to contain an uncontrolled resource consumption vulnerability in its HTTP/3…N/A8.7 HighN/ANov 10, 2026
CVE-2026-16478: TÜBİTAK BİLGEM Software Technologies Research Institute pardus-nvidia-installer: Permissive list of allowed inputs vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute…7.0 HighN/AN/ANov 10, 2026
CVE-2026-125871: MISP misp-modules: The sourcecache expansion module in MISP Modules (misp-modules) contains a Server-Side Request Forgery (SSRF)…N/A6.3 MediumN/ANov 10, 2026
CVE-2026-125745: madalinungureanu Custom Post Types and Custom Fields creator – WCK: Custom Post Types and Custom Fields creator (WCK) before 2.4.1 contains a missing authorization vulnerability that…4.3 Medium2.3 LowN/ANov 10, 2026
CVE-2026-125744: pretix: Our API endpoint for changing ticket layouts did not properly check permissions of the requesting user or API tokenN/A1.2 LowN/ANov 10, 2026
CVE-2026-124747: Red Hat: A flaw was found in BusyBox7.5 HighN/AN/ANov 10, 2026
CVE-2026-121267: TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote: Incorrect default permissions vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote…7.8 HighN/AN/ANov 10, 2026
CVE-2026-100962: NVIDIA Nemo Deploy: NVIDIA NeMo Export-Deploy for all platforms contains a vulnerability in multimodal deployment where an attacker could…5.3 MediumN/AN/ANov 10, 2026
CVE-2026-59082: Siemens: A vulnerability has been identified in SIMATIC WinCC V7.5 (All versions), SIMATIC WinCC V8.0 (All versions), SIMATIC…7.8 High8.5 HighN/ANov 10, 2026
CVE-2026-58114: Siemens: A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All…7.5 High7.7 HighN/ANov 10, 2026
CVE-2026-12574: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Server-side HTML/JavaScript…8.1 HighN/AN/ANov 10, 2026
CVE-2026-12573: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to Cisco IOS command injection via…8.8 HighN/AN/ANov 10, 2026
CVE-2026-12572: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central version below 6201 is vulnerable to SQL injection in HA replication username…7.2 HighN/AN/ANov 10, 2026
CVE-2026-12266: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central versions 6200 and below are vulnerable to LDAP bind password exposure through…7.6 HighN/AN/ANov 10, 2026
CVE-2026-125742: 7-Zip: 7-Zip before 26.06 contains a heap out-of-bounds write vulnerability in the LZX decoder that lets attackers corrupt…7.8 High8.5 HighN/ANov 10, 2026
CVE-2026-125715: Samsung Opensource mTower: Samsung mTower lacks access control for TA sessions, allowing a Normal World application to open TA sessions and invoke…5.3 MediumN/AN/ANov 10, 2026
CVE-2026-125712: Red Hat: A flaw was found in GStreamer's gst-plugins-base RTCP SDES packet parser7.5 HighN/AN/ANov 10, 2026
CVE-2026-125709: Red Hat: A flaw was found in libstdc++4.2 MediumN/AN/ANov 10, 2026
CVE-2026-125707: Red Hat, GStreamer: A flaw was found in GStreamer's MXF demuxer6.1 MediumN/AN/ANov 10, 2026
CVE-2026-125706: Red Hat, GStreamer: A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin5.5 MediumN/AN/ANov 10, 2026
CVE-2026-123717: Eclipse CSI otterdog: OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through…N/A8.8 HighN/ANov 10, 2026
CVE-2026-121191: TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote: Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows…6.5 MediumN/AN/ANov 10, 2026
CVE-2026-120350: vaadin: The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into…N/A5.1 MediumN/ANov 10, 2026
CVE-2026-120326: vaadin: DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header…N/A4.8 MediumN/ANov 10, 2026
101-125 of 427771
‹›