The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-124697: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML7.1 HighN/AN/ANov 12, 2026
CVE-2026-124696: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name…7.1 HighN/AN/ANov 12, 2026
CVE-2026-124695: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML7.1 HighN/AN/ANov 12, 2026
CVE-2026-124691: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery Gantt, the task editor's Parent dropdown renders task titles as HTML7.1 HighN/AN/ANov 12, 2026
CVE-2025-10698: OpenText Identity Console: Incorrect default permissions and Product released in Non-Release configuration vulnerability in OpenText Identity…N/A6.0 MediumN/ANov 12, 2026
CVE-2026-121876: Red Hat: A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in…7.9 HighN/AN/ANov 12, 2026
CVE-2026-91007: zephyrproject zephyr: The user-mode syscall verifiers for the charger driver API in drivers/charger/charger_handlers.c did not inspect the…7.8 HighN/AN/ANov 12, 2026
CVE-2026-70642: ToolJet: ToolJet before 3.21.94, fixed in commit e5f387a, contains an authorization bypass vulnerability in the app environments…4.3 Medium5.3 MediumN/ANov 12, 2026
CVE-2026-70641: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority as a duplicate of…N/AN/AN/ANov 12, 2026
CVE-2026-19809: zephyrproject zephyr: The user-mode system call verifier z_vrfy_charger_get_prop() in drivers/charger/charger_handlers.c declares an…3.3 LowN/AN/ANov 12, 2026
CVE-2026-127145: Alinto sogo: SOGo before 5.12.13 contains a server-side request forgery vulnerability that allows authenticated users to make the…4.3 Medium5.3 MediumN/ANov 12, 2026
CVE-2026-127141: Alinto sogo: SOGo before 5.12.13 contains a denial of service vulnerability that allows authenticated attackers to exhaust all…6.5 Medium7.1 HighN/ANov 12, 2026
CVE-2026-127135: Alinto sogo: SOGo before 5.12.13 contains a Sieve script injection vulnerability that allows authenticated users to inject arbitrary…4.3 Medium5.3 MediumN/ANov 12, 2026
CVE-2026-127131: Alinto sogo: SOGo before 5.12.13 contains a missing rate limiting vulnerability in its web login TOTP verification that allows…7.4 High9.1 CriticalN/ANov 12, 2026
CVE-2026-127121: Alinto sogo: SOGo before 5.12.13 contains an improper cryptographic signature verification vulnerability that allows remote…6.5 Medium7.1 HighN/ANov 12, 2026
CVE-2026-127111: Alinto sogo: SOGo before 5.12.13 contains an improper restriction of excessive authentication attempts vulnerability that allows…7.4 High9.1 CriticalN/ANov 12, 2026
CVE-2026-127109: Promzard: A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property…N/AN/AN/ANov 12, 2026
CVE-2026-126330: Docker Docker Sandboxes: Docker Sandboxes can silently republish a sandbox service after an operator removes its automatically assigned…N/A2.4 LowN/ANov 12, 2026
CVE-2026-126329: Docker Docker Sandboxes: Docker Sandboxes reuses existing state and configuration directories without verifying their ownershipN/A7.3 HighN/ANov 12, 2026
CVE-2026-126998: n/a JeecgBoot: A security flaw has been discovered in JeecgBoot up to 3.9.57.3 High5.5 MediumN/ANov 12, 2026
CVE-2026-126997: n/a JeecgBoot: A vulnerability was identified in JeecgBoot up to 3.9.67.3 High5.5 MediumN/ANov 12, 2026
CVE-2026-126996: SakanaAI text-to-LoRA: A vulnerability was determined in SakanaAI text-to-LoRA 0.0.16.3 Medium2.1 LowN/ANov 12, 2026
CVE-2026-123790: ComfyUI-Easy-Use: ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST…N/AN/AN/ANov 12, 2026
CVE-2026-120150: n/a PostgreSQL: Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the…8.8 HighN/AN/ANov 12, 2026
CVE-2026-120149: n/a PostgreSQL: Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via…8.8 HighN/AN/ANov 12, 2026
126-150 of 433023