The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121543: a466350665 smart-sso: smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121452: mlogclub bbs-go: bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers…6.5 Medium8.3 HighN/ANov 3, 2026
CVE-2026-118488: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an…5.9 MediumN/AN/ANov 3, 2026
CVE-2026-100493: AMD AMD Compressionator SDK: An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS…N/A6.9 MediumN/ANov 3, 2026
CVE-2026-40652: AMD AMD Compressionator SDK: An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a…N/A5.2 MediumN/ANov 3, 2026
CVE-2026-110265: runZero Platform: A specially crafted malformed search query could return results from outside a user's organization6.5 MediumN/AN/ANov 3, 2026
CVE-2026-118489: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…7.5 HighN/AN/ANov 3, 2026
CVE-2026-121448: Finsys dockhand: Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and…8.3 High8.7 HighN/ANov 3, 2026
CVE-2026-121444: darylldoyle svg-sanitizer: svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121440: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121436: froxlor: Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121433: AzuraCast: AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media…5.4 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-121432: AzuraCast: AzuraCast before 0.24.0 contains a CRLF injection vulnerability that allows low-privilege station users to inject…3.5 Low5.1 MediumN/ANov 3, 2026
CVE-2026-121429: AzuraCast: AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121428: AzuraCast: AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121424: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote…6.5 Medium8.3 HighN/ANov 3, 2026
CVE-2026-121421: surrealdb: SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121420: surrealdb: SurrealDB from 3.2.0 before 3.3.0 contains a server-side request forgery vulnerability in the FilteringResolver…3.3 Low4.8 MediumN/ANov 3, 2026
CVE-2026-121417: surrealdb: SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed…7.8 High8.8 HighN/ANov 3, 2026
CVE-2026-121416: surrealdb: SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming…7.1 High7.1 HighN/ANov 3, 2026
CVE-2026-121413: parse-community parse-server: Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade…3.1 Low2.3 LowN/ANov 3, 2026
CVE-2026-121412: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121409: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121408: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a…5.3 Medium6.0 MediumN/ANov 3, 2026
CVE-2026-121405: FreeRDP: FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious…4.3 Medium5.3 MediumN/ANov 3, 2026
176-200 of 528356
‹›