The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-124461: openemr: OpenEMR before 8.3.0 contains a missing authorization vulnerability in library/ajax/upload.php that allows any…8.1 High8.6 HighN/ANov 8, 2026
CVE-2026-124460: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in PortalPatientController::Read() that…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124459: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in many encounter-form view and save…8.1 High8.6 HighN/ANov 8, 2026
CVE-2026-124458: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability in the FHIR GET /fhir/Person/:uuid route that…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124457: openemr: OpenEMR before 8.3.0 contains a path traversal vulnerability in interface/billing/sl_eob_process.php that allows…7.6 High7.2 HighN/ANov 8, 2026
CVE-2026-124456: openemr: OpenEMR before 8.3.0 contains missing authorization and insecure direct object reference vulnerabilities in the…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-124455: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in OnsiteDocumentController::Query()…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124453: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in portal/lib/persist.php that allows…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-124452: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in interface/forms/eye_mag/report.php that…5.4 Medium5.1 MediumN/ANov 8, 2026
CVE-2026-124451: openemr: OpenEMR before 8.4.0 contains an authorization bypass vulnerability in its SMART on FHIR implementation because…5.3 Medium6.0 MediumN/ANov 8, 2026
CVE-2026-124450: openemr: OpenEMR before 8.3.0 contains a broken access control and path traversal vulnerability in the fax/sms module…9.9 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-124449: openemr: OpenEMR before 8.4.0 contains a missing authorization vulnerability in FHIR Media/:uuid and QuestionnaireResponse read…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124448: openemr: OpenEMR before 8.3.0 contains a stored cross-site scripting vulnerability in the CCDA/CCD preview stylesheets, where…7.6 High8.6 HighN/ANov 8, 2026
CVE-2026-124447: openemr: OpenEMR before 8.3.0 contains an insecure direct object reference vulnerability in…8.1 High8.6 HighN/ANov 8, 2026
CVE-2026-124446: openemr: OpenEMR before 8.3.0 contains a path traversal vulnerability in the FaxSMS module's RCFaxClient and SignalWireClient…8.8 High8.7 HighN/ANov 8, 2026
CVE-2026-124445: openemr: OpenEMR from 7.0.1 before 8.4.0 contains a flaw in src/Common/Auth/OneTimeAuth.php that ignores the enforce_onetime_use…9.8 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-124444: openemr: OpenEMR before 8.4.0 contains a mass assignment vulnerability in the patient portal OnsiteDocument query API that lets…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-124443: frappe: Frappe Framework before 15.121.1 and 16.x before 16.35.0 contains a broken access control vulnerability in File list…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-124442: AzuraCast: AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows users with station WebHooks…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-124441: kyverno: Kyverno before 1.19.2 contains an authorization bypass vulnerability that allows namespaced tenants to generate any…8.8 High8.7 HighN/ANov 8, 2026
CVE-2026-124440: kyverno: Kyverno from 1.19.1 before 1.19.2 contains an authorization bypass vulnerability in the apiCall namespace clamp that…9.9 Critical9.4 CriticalN/ANov 8, 2026
CVE-2026-124439: scriban: Scriban and Scriban.Signed before 7.5.3 contain uncontrolled recursion flaws in which postfix member, indexer, and call…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-124438: scriban: Scriban before 7.5.2 contains an information disclosure and object manipulation vulnerability that allows template…7.4 High9.1 CriticalN/ANov 8, 2026
CVE-2026-124437: scriban: Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-124436: openremote core: OpenRemote before 1.32.2 contains an improper authorization vulnerability that allows realm administrators to access…8.0 High8.6 HighN/ANov 8, 2026
126-150 of 418627
‹›