The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121637: WatchGuard AuthPoint Authentication Gateway: An improper integrity validation vulnerability in WatchGuard AuthPoint Gateway's LDAP authentication callback allows a…N/A8.9 HighN/ANov 4, 2026
CVE-2026-121632: Cross-site Scripting (XSS)N/AN/AN/ANov 4, 2026
CVE-2026-121009: SQL InjectionN/AN/AN/ANov 4, 2026
CVE-2026-121008: Cross-site Scripting (XSS)N/AN/AN/ANov 4, 2026
CVE-2026-121007: SQL InjectionN/AN/AN/ANov 4, 2026
CVE-2026-120421: Eclipse Foundation Eclipse Mojarra: In Eclipse Mojarra versions 2.2.0 through 4.0.28, 4.1.0 through 4.1.19, and 5.0.0-M1 through 5.0.0-M11, when URL client…6.1 MediumN/AN/ANov 4, 2026
CVE-2026-119776: frrouting: In all prior released versions of FRRouting, the OSPFv3 (for IPv6) implementation does not check that OSPFv3 packets…N/A6.1 MediumN/ANov 4, 2026
CVE-2026-114627: Cross-site Scripting (XSS)N/AN/AN/ANov 4, 2026
CVE-2026-100408: git-for-windows git: Git for Windows is the Windows port of Git4.4 MediumN/AN/ANov 4, 2026
CVE-2026-100407: git-for-windows git: Git for Windows is the Windows port of Git4.4 MediumN/AN/ANov 4, 2026
CVE-2026-121993: wedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan: wePOS (Point Of Sale for WooCommerce) before 2.0.3 contains a missing authorization vulnerability in the…4.3 Medium5.3 MediumN/ANov 4, 2026
CVE-2026-119745: Sender: Sender plugin for WordPress before 2.11.3 contains a missing authorization vulnerability that allows any authenticated…4.3 Medium5.3 MediumN/ANov 4, 2026
CVE-2026-118391: elixir-ecto ecto: Allocation of Resources Without Limits or Throttling vulnerability in elixir-ecto ecto allows an unauthenticated remote…N/A8.9 HighN/ANov 4, 2026
CVE-2026-65555: Uncanny Owl Uncanny Toolkit for LearnDash: Incorrect Privilege Assignment vulnerability in Uncanny Owl Uncanny Toolkit for LearnDash uncanny-learndash-toolkit…9.8 CriticalN/AN/ANov 4, 2026
CVE-2026-121970: wphostingdev Pay with Vipps and MobilePay for WooCommerce: Pay with Vipps and MobilePay for WooCommerce (woo-vipps) before 6.4.1 contains an improper cryptographic signature…3.7 Low6.3 MediumN/ANov 4, 2026
CVE-2026-121946: zbateson mail-mime-parser: zbateson mail-mime-parser before 3.0.9 and 4.x before 4.0.6 contains a CRLF header injection vulnerability in…7.2 High6.9 MediumN/ANov 4, 2026
CVE-2026-121945: CoopCycle coopcycle-web: CoopCycle coopcycle-web before 6.20.1 contains a broken access control vulnerability that allows any courier to read…7.6 High7.2 HighN/ANov 4, 2026
CVE-2026-121944: irontec sngrep: sngrep through 1.9.0 contains an infinite loop vulnerability in capture_packet_reasm_ip() in src/capture.c that allows…5.5 Medium6.8 MediumN/ANov 4, 2026
CVE-2026-121943: irontec sngrep: Irontec sngrep through 1.9.0 contains an out-of-bounds stack read vulnerability in sip_check_packet and…4.8 Medium6.3 MediumN/ANov 4, 2026
CVE-2026-121942: mchehab zbar: ZBar through 0.23.95 contains an out-of-bounds read vulnerability in _zbar_sq_decode() in zbar/sqcode.c that allows…6.1 Medium6.9 MediumN/ANov 4, 2026
CVE-2026-121941: munt libmt32emu: libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows…7.8 High8.5 HighN/ANov 4, 2026
CVE-2026-121940: Stonewuu ai-fusion-video: Stonewuu ai-fusion-video before 1.3.0 contains an insecure direct object reference vulnerability that allows…8.8 High8.7 HighN/ANov 4, 2026
CVE-2026-121939: David-Crty Databasement: Databasement before 1.10.9 contains an authentication bypass vulnerability in OAuthService::findOrCreateLocalUser()…8.1 High9.2 CriticalN/ANov 4, 2026
CVE-2026-121938: moyangzhan langchain4j-aideepin: langchain4j-aideepin before 3.31.0 contains an insecure direct object reference vulnerability that allows authenticated…5.3 Medium6.0 MediumN/ANov 4, 2026
CVE-2026-121937: blackholll loonflow: loonflow before r3.2.3 contains a missing authorization vulnerability in TicketFlowHistoryView that allows any…3.1 Low2.3 LowN/ANov 4, 2026
176-200 of 418286
‹›