The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-91907: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Input During Web Page…6.8 MediumN/AN/ANov 2, 2026
CVE-2026-91906: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource…5.5 MediumN/AN/ANov 2, 2026
CVE-2026-91905: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Verification of Cryptographic Signature…6.4 MediumN/AN/ANov 2, 2026
CVE-2026-91904: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource…5.5 MediumN/AN/ANov 2, 2026
CVE-2026-91903: Dell OpenManage Enterprise: Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Limitation of a Pathname to a Restricted…6.1 MediumN/AN/ANov 2, 2026
CVE-2026-116606: Barracuda Networks Barracuda Email Security Gateway (ESG): An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated…N/A9.3 CriticalN/ANov 2, 2026
CVE-2026-111560: Barracuda Networks: Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance…N/A8.6 HighN/ANov 2, 2026
CVE-2024-12141: WSO2 WSO2 Identity Server: The product fails to sufficiently validate callback URLs, allowing them to be manipulated with malicious payloads when…4.3 MediumN/AN/ANov 2, 2026
CVE-2026-100140: qt: An integer overflow vulnerability in the Qt XML parsing (Qt5Compat / QXmlSimpleReader) functionality of Qt.N/A1.9 LowN/ANov 2, 2026
CVE-2024-9517: WSO2: The refresh token grant type in WSO2 products fails to re-validate account status before issuing new access tokens4.9 MediumN/AN/ANov 2, 2026
CVE-2026-8923: Zohocorp: Zohocorp ManageEngine Eventlog Analyzer and ManageEngine Log360 versions before 13062 are vulnerable to Authenticated…8.7 HighN/AN/ANov 2, 2026
CVE-2026-2613: WSO2: The Admin REST API accepts user-supplied input without adequately sanitizing it, allowing it to be included in the…8.7 HighN/AN/ANov 2, 2026
CVE-2026-120216: fastify: fastify is a web framework for Node.js5.9 MediumN/AN/ANov 2, 2026
CVE-2026-120215: @fastify/cors: @fastify/cors is the CORS plugin for the Fastify web framework3.7 LowN/AN/ANov 2, 2026
CVE-2026-120214: @fastify/http-proxy: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix5.9 MediumN/AN/ANov 2, 2026
CVE-2026-120213: @fastify/http-proxy: @fastify/http-proxy is a Fastify plugin that proxies HTTP requests to an upstream server under a configured prefix9.1 CriticalN/AN/ANov 2, 2026
CVE-2026-117549: @fastify/secure-session: @fastify/secure-session is a session plugin for Fastify that stores an encrypted session in a cookie4.2 MediumN/AN/ANov 2, 2026
CVE-2026-117531: @fastify/multipart: @fastify/multipart is the multipart form-data and file upload plugin for the Fastify web framework5.9 MediumN/AN/ANov 2, 2026
CVE-2026-117518: @fastify/reply-from: @fastify/reply-from is a Fastify plugin that forwards requests to an upstream HTTP server8.2 HighN/AN/ANov 2, 2026
CVE-2025-12544: WSO2: The Publisher portal fails to enforce proper validation on uploaded SVG files, allowing users with the Publisher role…4.8 MediumN/AN/ANov 2, 2026
CVE-2024-2372: WSO2: The affected components accept user-supplied input for constructing redirection URLs without enforcing expected…5.4 MediumN/AN/ANov 2, 2026
CVE-2026-18800: WSO2: When an Event Publisher output adapter is configured with properties that are irrelevant to its function, the affected…4.4 MediumN/AN/ANov 2, 2026
CVE-2026-118871: ZTE ElasticNet RNIA R18 NGI: SQL injection vulnerability classified as an internal threat level.Attackers can steal database information via SQL…6.5 MediumN/AN/ANov 2, 2026
CVE-2025-13647: WSO2: The affected component fails to enforce expected validation constraints on the `content-type` header when processing…5.8 MediumN/AN/ANov 2, 2026
CVE-2024-7075: WSO2: The user search function within the management console fails to properly encode user-supplied input before rendering it…4.6 MediumN/AN/ANov 2, 2026
126-150 of 574114
‹›