The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121445: darylldoyle svg-sanitizer: darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121441: bytecodealliance wasmtime: Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121437: lepture mistune: Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-121425: nodemailer: Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon…6.5 Medium8.3 HighN/ANov 3, 2026
CVE-2026-121393: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-89295: Eclipse Foundation Eclipse Mnestix: In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the…N/AN/AN/ANov 3, 2026
CVE-2026-85035: zephyrproject zephyr: The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in…8.8 HighN/AN/ANov 3, 2026
CVE-2026-85034: zephyrproject zephyr: The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or…6.7 MediumN/AN/ANov 3, 2026
CVE-2026-85033: zephyrproject zephyr: The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a…4.6 MediumN/AN/ANov 3, 2026
CVE-2026-85032: zephyrproject zephyr: The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system…4.8 MediumN/AN/ANov 3, 2026
CVE-2026-120572: Mozilla Firefox: Incorrect boundary conditions in the Layout: Block and Inline component8.8 HighN/AN/ANov 3, 2026
CVE-2026-119742: Nagios Enterprises, LLC Nagios XI: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-119179: MongoDB Node.js Driver: A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the…7.0 High8.3 HighN/ANov 3, 2026
CVE-2026-99270: Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler()N/AN/AN/ANov 3, 2026
CVE-2026-76124: BuddyBoss BuddyBoss App: The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…8.8 HighN/AN/ANov 3, 2026
CVE-2026-65160: NVIDIA: NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero5.5 MediumN/AN/ANov 3, 2026
CVE-2026-121458: CoreBunch Instatic: Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-108060: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108059: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108058: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108057: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108056: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108055: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108054: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108053: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
176-200 of 528356
‹›