The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121391: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains a file descriptor leak in parallel_process_irp_create that fails to close…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121390: FreeRDP: FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121389: FreeRDP: FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious…3.1 Low2.3 LowN/ANov 3, 2026
CVE-2026-121388: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121387: FreeRDP: FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121386: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-118527: Ivanti Connect Secure: Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-106991: n/a: hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control7.1 HighN/AN/ANov 3, 2026
CVE-2026-73328: volmarg personal-management-system: Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121559: glpi-project GLPI: GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121555: DrizzleTime Foxel: Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121551: postfixadmin: PostfixAdmin through 4.0.5 contains a stored cross-site scripting vulnerability that allows authenticated mailbox users…5.4 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-121547: Canop dysk: Canop dysk before 3.8.2 contains a terminal escape sequence injection vulnerability that allows local users to inject…2.2 Low1.0 LowN/ANov 3, 2026
CVE-2026-121543: a466350665 smart-sso: smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121452: mlogclub bbs-go: bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers…6.5 Medium8.3 HighN/ANov 3, 2026
CVE-2026-118488: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an…5.9 MediumN/AN/ANov 3, 2026
CVE-2026-100493: AMD AMD Compressionator SDK: An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS…N/A6.9 MediumN/ANov 3, 2026
CVE-2026-40652: AMD AMD Compressionator SDK: An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a…N/A5.2 MediumN/ANov 3, 2026
CVE-2026-110265: runZero Platform: A specially crafted malformed search query could return results from outside a user's organization6.5 MediumN/AN/ANov 3, 2026
CVE-2026-118489: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…7.5 HighN/AN/ANov 3, 2026
CVE-2026-121448: Finsys dockhand: Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and…8.3 High8.7 HighN/ANov 3, 2026
CVE-2026-121444: darylldoyle svg-sanitizer: svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121440: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121436: froxlor: Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121433: AzuraCast: AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media…5.4 Medium5.1 MediumN/ANov 3, 2026
176-200 of 528356
‹›