The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-82032: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/ANov 12, 2026
CVE-2026-16052: Python Software Foundation CPython: The http.cookies.Morsel class allows separator semicolons in attribute values and includes them verbatim in all output…N/A2.3 LowN/ANov 12, 2026
CVE-2026-127203: AppFlowy-IO AppFlowy-Cloud: AppFlowy Cloud through 0.9.64 contains a stored cross-site scripting vulnerability that allows authenticated workspace…5.4 Medium5.1 MediumN/ANov 12, 2026
CVE-2026-127202: mlflow: MLflow before 3.18.0 using the FileStore backend contains a path traversal vulnerability that allows unauthenticated…5.3 Medium6.3 MediumN/ANov 12, 2026
CVE-2026-127030: Red Hat: A flaw was found in freeradius7.5 HighN/AN/ANov 12, 2026
CVE-2026-127029: Red Hat: A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM)…7.5 HighN/AN/ANov 12, 2026
CVE-2026-126837: MongoDB Node.js Driver: A validation flaw in the DNS SRV host discovery of the MongoDB Node.js driver may cause the driver to connect to a host…7.4 High9.1 CriticalN/ANov 12, 2026
CVE-2026-126835: MongoDB Node.js Driver: The MongoDB Node.js driver does not consistently enforce its permitted-host restriction during OIDC authentication6.5 Medium5.9 MediumN/ANov 12, 2026
CVE-2026-126193: facelessuser soupsieve: Soup Sieve is a CSS selector library for Beautiful Soup5.3 MediumN/AN/ANov 12, 2026
CVE-2026-126192: facelessuser soupsieve: Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 4N/A6.3 MediumN/ANov 12, 2026
CVE-2026-126191: facelessuser soupsieve: Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 47.5 HighN/AN/ANov 12, 2026
CVE-2026-126190: facelessuser soupsieve: Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 47.5 HighN/AN/ANov 12, 2026
CVE-2026-126189: facelessuser soupsieve: Soup Sieve is a CSS selector library designed to be used with Beautiful Soup 45.3 MediumN/AN/ANov 12, 2026
CVE-2026-124698: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML7.1 HighN/AN/ANov 12, 2026
CVE-2026-124697: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML7.1 HighN/AN/ANov 12, 2026
CVE-2026-124696: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name…7.1 HighN/AN/ANov 12, 2026
CVE-2026-124695: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML7.1 HighN/AN/ANov 12, 2026
CVE-2026-124691: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML7.1 HighN/AN/ANov 12, 2026
CVE-2025-10698: OpenText Identity Console: Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity…N/A6.0 MediumN/ANov 12, 2026
CVE-2026-121876: Red Hat: A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in…7.9 HighN/AN/ANov 12, 2026
CVE-2026-91007: zephyrproject zephyr: The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the…7.8 HighN/AN/ANov 12, 2026
CVE-2026-70642: ToolJet: ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments…4.3 Medium5.3 MediumN/ANov 12, 2026
CVE-2026-70641: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of…N/AN/AN/ANov 12, 2026
CVE-2026-19809: zephyrproject zephyr: The user-mode system call verifier z_vrfy_charger_get_prop() in drivers/charger/charger_handlers.c declares an…3.3 LowN/AN/ANov 12, 2026
CVE-2026-127145: Alinto sogo: SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the…4.3 Medium5.3 MediumN/ANov 12, 2026
126-150 of 433023