The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125815: Noah Hearle We’re Open!: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Noah Hearle We’re Open!…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125801: Automattic WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in Automattic…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-121771: PublishPress Gutenberg Blocks: Insertion of Sensitive Information Into Sent Data vulnerability in PublishPress Gutenberg Blocks advanced-gutenberg…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-121721: PublishPress Gutenberg Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PublishPress…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-119518: WProyal Royal Elementor Addons: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WProyal Royal…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-107526: Dell: Dell PowerStore contains an improper input validation vulnerability4.6 MediumN/AN/ANov 13, 2026
CVE-2026-107525: Dell, Dwll: Dell PowerStore contains an information disclosure vulnerability5.3 MediumN/AN/ANov 13, 2026
CVE-2026-105880: Tobias WebinarIgnition: Authorization Bypass Through User-Controlled Key vulnerability in Tobias WebinarIgnition webinar-ignition allows…5.3 MediumN/AN/ANov 13, 2026
CVE-2025-41725: JBL Flip 4: Affected devices running firmware versions prior to 4.1.0 may crash and become unavailable when receiving specific…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125800: Brainstorm Force Spectra: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-112830: Brizy: Missing Authorization vulnerability in Brizy Brizy brizy allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125816: PT Norther Lights Production MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-125814: Rymera Web Co Product Feed PRO for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Rymera Web Co Product…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-125833: YITH YITH WooCommerce Ajax Product Filter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-128834: Brainstorm Force Spectra: Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting…5.3 MediumN/AN/ANov 13, 2026
CVE-2026-120221: frrouting: In FRRouting 8.4 and later, bgpd frees the same memory twice when dynamic BGP neighbors disconnect, if the peer-group…N/A8.2 HighN/ANov 13, 2026
CVE-2026-125659: eMudhra emBridge: This vulnerability exists in the eMudhra emBridge due to missing authorization checks in the FileBrowser API endpointsN/A2.1 LowN/ANov 13, 2026
CVE-2026-123338: Apache Software Foundation Apache DataSketches C++: Out-of-bounds Write vulnerability in Apache DataSketches C++N/AN/AN/ANov 13, 2026
CVE-2026-123274: Apache Software Foundation Apache DataSketches C++: Out-of-bounds Write vulnerability in Apache DataSketches C++N/AN/AN/ANov 13, 2026
CVE-2026-112182: OpenKM OpenKM Community Edition: Unauthorization vulnerability in the management of workflow definitions in OpenKM Community EditionN/A8.7 HighN/ANov 13, 2026
CVE-2026-109904: X.Org: A buffer overread caused by an integer-overflow in Proc/SProcXResQueryClientIds in X.Org xwayland before 24.1.15 and X…N/A6.9 MediumN/ANov 13, 2026
CVE-2026-109903: X.Org: A buffer overread caused by casting a negative integer to CARD32 in XvQueryImageAttributes in X.Org X Server before…7.8 HighN/AN/ANov 13, 2026
CVE-2026-75578: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability in luci/model/cbi/vpn/openvpn/client.lua, which…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-75577: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to…7.2 High8.6 HighN/ANov 13, 2026
CVE-2026-75576: Shenzhen Cudy Technology Co., Ltd. TR3000 1.0: Cudy TR3000 before 2.5.42 contains a command injection vulnerability that allows authenticated administrators to…7.2 High8.6 HighN/ANov 13, 2026
176-200 of 532044