The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-125372: getrebuild rebuild: REBUILD before 4.5.3 contains an authorization bypass vulnerability in FeedsListController fetchDetails and…4.3 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125371: tinyproxy: Tinyproxy through 1.11.3 contains an access control bypass vulnerability in acl_string_processing() in src/acl.c that…4.8 Medium6.3 MediumN/ANov 10, 2026
CVE-2026-125370: kubero-dev kubero: Kubero 3.0.0 through 3.1.1 contains an authentication bypass vulnerability that allows unauthenticated remote attackers…9.8 Critical9.3 CriticalN/ANov 10, 2026
CVE-2026-125369: fsinfuhh Bitpoll: Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers…5.3 Medium6.9 MediumN/ANov 10, 2026
CVE-2026-125368: YeQing17-2026 OmniAgent: OmniAgent through commit 12b98c5 contains an approval bypass vulnerability in ReflexionAgent._is_safe_bash_command that…7.5 High7.7 HighN/ANov 10, 2026
CVE-2026-125367: picosh pico: Pico through 4.1.2 contains a server-side request forgery vulnerability in the feeds service that allows signed-up…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125366: asciimoo omnom: Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125365: harung1993 dollardollar: DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-125364: frab: frab through 0.9.1 contains a privilege escalation vulnerability that allows authenticated crew users to grant…8.1 High8.6 HighN/ANov 10, 2026
CVE-2026-125363: SecOps-7 MikroDash: MikroDash before 0.8.79 contains a server-side request forgery vulnerability that allows any signed-in user, including…5.4 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125362: haiwen seahub: Seahub through 14.0.10 contains a weak randomness vulnerability in MultiShareLinksBatch.post() that generates batch…3.1 Low2.3 LowN/ANov 10, 2026
CVE-2026-125361: Tencent BrowserSkill: Tencent BrowserSkill through 0.4.2 contains a missing authentication vulnerability that allows local attackers to…6.3 Medium7.2 HighN/ANov 10, 2026
CVE-2026-125360: Southclaws storyden: Storyden through 1.26.16 contains a privilege escalation vulnerability that allows users holding MANAGE_ROLES to grant…7.2 High8.6 HighN/ANov 10, 2026
CVE-2026-125359: fancydirty mediary-scout: Mediary Scout before 2026.11.05 contains a server-side request forgery vulnerability that allows any authenticated…4.3 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-125358: rehan-remade universal-modder: Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation…8.1 High7.2 HighN/ANov 10, 2026
CVE-2026-125357: munin-monitoring munin: Munin munin-httpd 2.99.1 through 2.999.18 contains a path traversal vulnerability in the static file handler of…5.3 Medium6.9 MediumN/ANov 10, 2026
CVE-2026-125078: SourceCodester Smart Attendance System with QR Code Scanner: A security flaw has been discovered in SourceCodester Smart Attendance System with QR Code Scanner 1.06.3 Medium2.1 LowN/ANov 10, 2026
CVE-2026-125077: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability was determined in SourceCodester Smart Attendance System with QR Code Scanner 1.04.3 Medium2.1 LowN/ANov 10, 2026
CVE-2026-125076: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability was found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High5.5 MediumN/ANov 10, 2026
CVE-2026-117477: GMO Prime Strategy Co., Ltd.: KUSANAGI provided by GMO Prime Strategy Co., Ltd6.1 Medium5.1 MediumN/ANov 10, 2026
CVE-2026-125075: SourceCodester Smart Attendance System with QR Code Scanner: A vulnerability has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High6.9 MediumN/ANov 9, 2026
CVE-2026-115934: craftcms cms: An unauthenticated SQL injection can occur on the front end of any site that uses craft.search to perform a search,…9.8 Critical9.3 CriticalN/ANov 9, 2026
CVE-2026-125074: SourceCodester Smart Attendance System with QR Code Scanner: A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High6.9 MediumN/ANov 9, 2026
CVE-2026-125120: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment9.8 CriticalN/AN/ANov 9, 2026
CVE-2026-125119: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment7.5 HighN/AN/ANov 9, 2026
201-225 of 427771
‹›