The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121408: FreeRDP: FreeRDP before 3.32.2 contains a use-after-free in the urbdrc USB redirection channel because FindChannelById returns a…5.3 Medium6.0 MediumN/ANov 3, 2026
CVE-2026-121405: FreeRDP: FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121404: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121400: FreeRDP: FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121396: FreeRDP: FreeRDP clients from 3.0.0 before 3.32.2 built with verbose WinPR assertions contain a reachable assertion in…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121392: FreeRDP: FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that…7.4 High9.1 CriticalN/ANov 3, 2026
CVE-2026-89295: Eclipse Foundation Eclipse Mnestix: In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the…N/AN/AN/ANov 3, 2026
CVE-2026-120572: Mozilla Firefox: Incorrect boundary conditions in the Layout: Block and Inline component8.8 HighN/AN/ANov 3, 2026
CVE-2026-119742: Nagios Enterprises, LLC Nagios XI: Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the…7.2 High8.6 HighN/ANov 3, 2026
CVE-2026-121505: NTPsec: An out-of-bounds read in the NTS-KE client response parser (nts_client_process_response_core) in NTPsec before 1.2.4…3.7 LowN/AN/ANov 3, 2026
CVE-2026-85035: zephyrproject zephyr: The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in…8.8 HighN/AN/ANov 3, 2026
CVE-2026-85034: zephyrproject zephyr: The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or…6.7 MediumN/AN/ANov 3, 2026
CVE-2026-85033: zephyrproject zephyr: The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a…4.6 MediumN/AN/ANov 3, 2026
CVE-2026-85032: zephyrproject zephyr: The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system…4.8 MediumN/AN/ANov 3, 2026
CVE-2026-119179: MongoDB Node.js Driver: A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the…7.0 High8.3 HighN/ANov 3, 2026
CVE-2026-99270: Linux: In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler()N/AN/AN/ANov 3, 2026
CVE-2026-76124: BuddyBoss BuddyBoss App: The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including,…8.8 HighN/AN/ANov 3, 2026
CVE-2026-65160: NVIDIA: NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero5.5 MediumN/AN/ANov 3, 2026
CVE-2026-108060: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108059: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108058: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108057: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108056: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108055: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
CVE-2026-108054: AM System ALO Suite: A stored Cross-Site Scripting (XSS) vulnerability in Alosuite that affects the delivery note functionalityN/A5.1 MediumN/ANov 3, 2026
201-225 of 528356
‹›