The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121955: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in Emulate_SCardReleaseContext that frees the emulated…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121954: FreeRDP: FreeRDP before 3.32.2 has a heap out-of-bounds write in the planar codec because freerdp_bitmap_planar_context_reset…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-121953: FreeRDP: FreeRDP before 3.32.2 has a use-after-free in the client's rdpgfx dynamic virtual channel: a duplicate-name channel…9.8 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121952: FreeRDP: FreeRDP before 3.32.2 has an out-of-bounds write in the proxy because rdp_read_bitmap_cache_v2_capability_set rejects…9.8 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121951: FreeRDP: FreeRDP 3.0.0 before 3.32.2 server-side RDP peer input parsing skips the six-byte body of a slow-path input event with…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121950: FreeRDP: FreeRDP before 3.32.2 does not check the product of surface dimensions in gdi_CreateSurface when handling an RDPGFX…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-119746: ProSoft Technology: ProSoft Technology ICX35 devices (X35-HWC-A and ICX35-HWC-E) contain a login lockout bypass in the integrated module…5.9 Medium8.2 HighN/ANov 4, 2026
CVE-2026-109518: Debian, Ubuntu APT: On Debian, Ubuntu, and derivative Linux distributions, an on-path attacker who can manipulate the HTTP traffic…N/A7.7 HighN/ANov 4, 2026
CVE-2026-106554: FasterXML jackson-dataformat-cbor: One CBOR-parsing issue in jackson-dataformats-binary's CBOR module: an unbounded run of CBOR tags drives quadratic-time…N/AN/AN/ANov 4, 2026
CVE-2026-66736: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/ANov 4, 2026
CVE-2026-39431: n/a: On HP Poly EagleEye Cube USB 1.3.1-001267 devices, one of the API functions available on a management service…N/AN/AN/ANov 4, 2026
CVE-2026-39430: n/a: On HP Poly EagleEye Cube USB 1.3.1-001267 devices, the administrator authentication flow is broken: session management…N/AN/AN/ANov 4, 2026
CVE-2026-122008: oqtane oqtane.framework: Oqtane Framework before 10.3.0 contains a server-side request forgery vulnerability in the UploadFile endpoint of…5.0 Medium5.3 MediumN/ANov 4, 2026
CVE-2026-122007: oqtane oqtane.framework: Oqtane Framework before 10.3.0 contains a broken access control vulnerability in SettingController.cs that allows an…6.5 Medium7.4 HighN/ANov 4, 2026
CVE-2026-122006: rubyonrails Active Storage: The activestorage gem before 8.1.4.1 for Ruby on Rails, when ImageMagick attachment processing occurs, can allow server…9.8 CriticalN/AN/ANov 4, 2026
CVE-2026-121640: WatchGuard AuthPoint Authentication Gateway: An Authentication Bypass by Capture-replay vulnerability in WatchGuard AuthPoint Gateway allows an attacker who has…N/A9.1 CriticalN/ANov 4, 2026
CVE-2026-121639: WatchGuard AuthPoint Authentication Gateway: A Missing Authentication for Critical Function vulnerability in WatchGuard AuthPoint Gateway allows a remote…N/A9.2 CriticalN/ANov 4, 2026
CVE-2026-121638: WatchGuard AuthPoint Authentication Gateway: An Improper Certificate Validation vulnerability in WatchGuard AuthPoint Gateway allows an attacker with an on-path…N/A9.1 CriticalN/ANov 4, 2026
CVE-2026-121637: WatchGuard AuthPoint Authentication Gateway: An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a…N/A8.9 HighN/ANov 4, 2026
CVE-2026-121632: Cross-site Scripting (XSS)N/AN/AN/ANov 4, 2026
CVE-2026-121009: SQL InjectionN/AN/AN/ANov 4, 2026
CVE-2026-121008: Cross-site Scripting (XSS)N/AN/AN/ANov 4, 2026
CVE-2026-121007: SQL InjectionN/AN/AN/ANov 4, 2026
CVE-2026-120421: Eclipse Foundation Eclipse Mojarra: In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client…6.1 MediumN/AN/ANov 4, 2026
CVE-2026-119776: frrouting: In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets…N/A6.1 MediumN/ANov 4, 2026
151-175 of 418286
‹›