The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121431: AzuraCast: AzuraCast before 0.24.0 contains a server-side request forgery vulnerability that allows station users with WebHooks…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121430: AzuraCast: AzuraCast before 0.24.0 contains a missing authorization vulnerability in the GET and POST…5.4 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121427: AzuraCast: AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121426: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr…6.5 Medium8.3 HighN/ANov 3, 2026
CVE-2026-121425: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon…6.5 Medium8.3 HighN/ANov 3, 2026
CVE-2026-121423: surrealdb: SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121422: surrealdb: SurrealDB from 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability that allows database Owners to…4.1 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-121419: surrealdb: SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject…8.1 High8.6 HighN/ANov 3, 2026
CVE-2026-121418: surrealdb: SurrealDB from 3.1.0 before 3.3.0 contains an incorrect authorization vulnerability that allows record users to infer…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121415: parse-community parse-server: Parse Server before 8.6.111 and 9.0.0 before 9.10.6-alpha.3 on MongoDB skips field type validation for null-valued dot…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121414: parse-community parse-server: Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121411: FreeRDP: FreeRDP before 3.32.2 fails to bound server-supplied target dimensions and output origin in RDPGFX…3.1 Low2.3 LowN/ANov 3, 2026
CVE-2026-121410: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121407: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121406: FreeRDP: FreeRDP before 3.32.2 allows a client assertion abort because rdpgfx_on_data_received rejects only negative…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121403: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability where a malformed drive DEVICE_IOREQUEST with a…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121402: FreeRDP: FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121401: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability where rdg_process_packet dispatches a…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121399: FreeRDP: FreeRDP before 3.32.2 contains a memory allocation vulnerability in rdg_receive_packet that allows a malicious RD…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121398: FreeRDP: FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121397: FreeRDP: FreeRDP before 3.32.2 contains a heap buffer over-read vulnerability in save_png_to_buffer() that allows malicious RDP…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121395: FreeRDP: FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121394: FreeRDP: FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121393: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121391: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close…4.3 Medium5.3 MediumN/ANov 3, 2026
151-175 of 528356
‹›