The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-112339: wazuh: Wazuh from 3.9.0 before 4.14.9 contains a missing TLS hostname verification vulnerability in the fluent-forward…5.9 Medium8.2 HighN/ANov 6, 2026
CVE-2026-112338: wazuh: Wazuh from 4.3.0 before 4.14.9 contains a server-side request forgery vulnerability in the GitHub module (wm_github.c)…5.9 Medium8.2 HighN/ANov 6, 2026
CVE-2026-112337: wazuh: Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle…3.7 Low6.3 MediumN/ANov 6, 2026
CVE-2026-112336: wazuh: Wazuh Manager from 3.0.0 before 4.14.9 contains a memory leak vulnerability in the generic JSON decoder that allows…6.5 Medium7.1 HighN/ANov 6, 2026
CVE-2026-112335: wazuh: Wazuh agent from 1.0.0 before 4.14.9 contains a stack-based buffer overflow in the logcollector snort-full log reader…5.5 Medium6.8 MediumN/ANov 6, 2026
CVE-2026-112334: wazuh: Wazuh from 1.0.0 before 4.14.9 contains an out-of-bounds write vulnerability in wazuh-execd that allows privileged…4.9 Medium6.9 MediumN/ANov 6, 2026
CVE-2026-106022: Johnson Controls EasyIO Neo IOManager and Tools Installer: Cleartext storage of sensitive information in memory vulnerability in Johnson Controls EasyIO Neo IOManager and Tools…N/A8.6 HighN/ANov 6, 2026
CVE-2026-106020: Johnson Controls EasyIO Neo IO Manager and Tools Installer: Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and…N/A8.6 HighN/ANov 6, 2026
CVE-2026-106019: Johnson Controls: Insertion of sensitive information into log file vulnerability in Johnson Controls C-CURE 9000, Victor allows Use of…N/A8.8 HighN/ANov 6, 2026
CVE-2026-123675: OpenBMB Internet of Agents: A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a8.3 High5.5 MediumN/ANov 6, 2026
CVE-2026-121880: Posit Software, PBC: Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC…N/A4.7 MediumN/ANov 6, 2026
CVE-2026-121881: Posit Software, PBC Posit Workbench: SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench…N/A5.7 MediumN/ANov 6, 2026
CVE-2026-123785: fluxbox: Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows…5.5 Medium6.8 MediumN/ANov 6, 2026
CVE-2026-123783: Skyvern-AI skyvern: Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by…8.8 High8.7 HighN/ANov 6, 2026
CVE-2026-123624: zhimaAi chatwiki: ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to…5.4 Medium5.3 MediumN/ANov 6, 2026
CVE-2026-123621: webmin usermin: Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote…8.8 High8.6 HighN/ANov 6, 2026
CVE-2026-123619: lektor: Lektor through 3.3.14 and 3.4.0b15 contains an absolute path traversal vulnerability in the admin API on Windows that…6.8 Medium5.9 MediumN/ANov 6, 2026
CVE-2026-123617: openwhyd: Openwhyd before 1.65.1 contains a NoSQL injection vulnerability that allows unauthenticated attackers to manipulate…5.3 Medium6.9 MediumN/ANov 6, 2026
CVE-2026-123487: parse-community parse-server: Parse Server before 8.6.115 and 9.0.0 before 9.10.7-alpha.1 validates user email address format with a regular…7.5 High8.7 HighN/ANov 6, 2026
CVE-2026-123485: sgoudelis ground-station: Ground Station from 0.6.0 before 0.8.20 does not restrict the get-orbital-sources Socket.IO handler (also exposed as…6.5 Medium7.1 HighN/ANov 6, 2026
CVE-2026-53980: charmbracelet wish: Charmbracelet wish before 2.0.5 contains a path traversal vulnerability in the git middleware (charm.land/wish/v2) that…8.1 High8.6 HighN/ANov 6, 2026
CVE-2026-119170: Python Software Foundation CPython: There was a regression in how FIPS algorithms were enforced for the hashlib moduleN/A8.2 HighN/ANov 6, 2026
CVE-2026-5345: HCL Software HCL AION: HCL AION is affected by a missing encryption vulnerability in a second WebSocket connection defined in the GenAI web…3.7 LowN/AN/ANov 6, 2026
CVE-2026-35113: HCL Software HCL AION: HCL AION is affected by a vulnerability where the Cross-Origin-Opener-Policy (COOP) header was missing or insecure,…4.8 MediumN/AN/ANov 6, 2026
CVE-2026-35112: HCL Software HCL AION: HCL AION is affected by a vulnerability where the Cross-Origin-Embedder-Policy (COEP) header was missing or insecure,…4.2 MediumN/AN/ANov 6, 2026
176-200 of 425038
‹›