The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-122054: The GNU C Library glibc: Converting crafted BIG-HKSCS input to UCS-4 or the internal wide character encoding, for example with iconv, in the GNU…5.9 MediumN/AN/ANov 4, 2026
CVE-2026-121971: Exposure of Sensitive InformationN/A8.2 HighN/ANov 4, 2026
CVE-2026-121927: A vulnerability has been found in InfiniFlow RAGFlow up to 0.27.36.3 Medium2.1 LowN/ANov 4, 2026
CVE-2026-76506: Cisco Cisco Unified Computing System Central Software: A vulnerability in the web-based management interface of Cisco UCS Central Software could allow an authenticated,…7.6 HighN/AN/ANov 4, 2026
CVE-2026-76419: Cisco Cisco Unified Communications Manager: A vulnerability in the web-based management interface of Cisco Unified Communications Manager (Unified CM) and Cisco…6.1 MediumN/AN/ANov 4, 2026
CVE-2026-20241: Cisco: A vulnerability in the authorization mechanism of Cisco Identity Services Engine (ISE) and Cisco ISE Passive Identity…5.3 MediumN/AN/ANov 4, 2026
CVE-2026-121926: Improper Authentication7.3 High5.5 MediumN/ANov 4, 2026
CVE-2026-119749: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an improper input validation vulnerability that allows…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-119748: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an authorization bypass vulnerability that allows…6.5 Medium6.9 MediumN/ANov 4, 2026
CVE-2026-119747: AyeCode Ltd: The GetPaid plugin for WordPress before 2.8.63 contains an incorrect authorization vulnerability where the…7.1 High7.1 HighN/ANov 4, 2026
CVE-2026-92704: sharpemu: SharpEmu is an experimental PlayStation 5 emulator for Windows and Linux8.3 HighN/AN/ANov 4, 2026
CVE-2026-91168: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux6.8 MediumN/AN/ANov 4, 2026
CVE-2026-91163: warp-tech warpgate: Warpgate is an open source SSH, HTTPS, and MySQL bastion host for Linux3.7 LowN/AN/ANov 4, 2026
CVE-2026-122032: SPIP: SPIP before 4.4.29 contains a SQL injection vulnerability that allows authenticated attackers with back-office access…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-121967: coder: Coder 2.28.0 before 2.29.22, 2.30.0 before 2.34.13, 2.35.0 before 2.35.10, 2.36.0 before 2.36.8, 2.37.0 before 2.37.5,…4.9 Medium2.3 LowN/ANov 4, 2026
CVE-2026-121966: traefik: Traefik 2.x before 2.11.60 and 3.x before 3.7.16 sends ForwardAuth subrequests (and, in 3.7, Ingress NGINX auth-url…8.7 High7.0 HighN/ANov 4, 2026
CVE-2026-121965: parse-community parse-server: Parse Server before 8.6.113 and 9.0.0 before 9.10.6-alpha.5 contains a prototype pollution vulnerability when building…5.3 Medium6.0 MediumN/ANov 4, 2026
CVE-2026-121964: FreeRDP: FreeRDP before 3.32.2 contains a heap-based buffer overflow in the RD Gateway RPC client, where…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121963: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in the asynchronous dynamic rdpsnd channel that allows…5.9 Medium8.2 HighN/ANov 4, 2026
CVE-2026-121962: FreeRDP: FreeRDP before 3.32.2 contains a heap buffer overflow in transport_default_read_pdu when handling partial Early User…8.1 High7.2 HighN/ANov 4, 2026
CVE-2026-121961: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability in the freerdp-proxy DRDYNVC tracker when intercepting…5.9 Medium8.2 HighN/ANov 4, 2026
CVE-2026-121960: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the NLA-enabled shadow server when a CredSSP…7.5 High8.7 HighN/ANov 4, 2026
CVE-2026-121959: FreeRDP: FreeRDP before 3.32.2 contains an infinite loop vulnerability in websocket_context_read that fails to handle a zero BIO…6.5 Medium7.1 HighN/ANov 4, 2026
CVE-2026-121958: FreeRDP: FreeRDP through 3.32.1 has a heap out-of-bounds write in the RDPGFX client because the delete_surface callback…8.8 High8.7 HighN/ANov 4, 2026
CVE-2026-121957: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free vulnerability that allows malicious RDP servers to corrupt client…7.5 High8.7 HighN/ANov 4, 2026
151-175 of 418286
‹›