The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-119755: arendst Tasmota: Tasmota through 16.0.0, fixed in commit 1cb7ebc, contains a cross-site request forgery vulnerability that allows…7.5 High7.5 HighN/ANov 9, 2026
CVE-2026-123368: tmatens compose-lint: compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deploymentN/A2.3 LowN/ANov 9, 2026
CVE-2026-123367: thorvg: Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine7.4 HighN/AN/ANov 9, 2026
CVE-2026-19706: Red Hat: During ABI bootstrap, the bootstrap node's approve-csr.service approves and signs every CSR without identity validation8.3 HighN/AN/ANov 9, 2026
CVE-2026-123364: OctoPrint: OctoPrint provides a web interface for controlling consumer 3D printersN/A2.4 LowN/ANov 9, 2026
CVE-2026-104989: Chaos Software V-Ray Swarm: Uncontrolled search path element in package upload feature in Chaos Software V-Ray versions through 2.0.19 allows…N/A9.3 CriticalN/ANov 9, 2026
CVE-2026-121576: AtlasAiDev MCP Server for WordPress: Incorrect Privilege Assignment vulnerability in AtlasAiDev MCP Server for WordPress ai-workflow-automation-ai-agent-hub…8.8 HighN/AN/ANov 9, 2026
CVE-2026-122664: VideoWhisper.com Broadcast Live Video: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com…7.1 HighN/AN/ANov 9, 2026
CVE-2026-123482: Crocoblock JetFormBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…7.1 HighN/AN/ANov 9, 2026
CVE-2026-121612: WPZOOM WPBruiser {no- Captcha anti-Spam}: Weak Authentication vulnerability in WPZOOM WPBruiser {no- Captcha anti-Spam} goodbye-captcha allows Authentication…4.3 MediumN/AN/ANov 9, 2026
CVE-2026-115340: Progress Software WS_FTP Server: Progress Software WS_FTP Server versions prior to 2025.0.5 on Windows may write sensitive user credential and session…7.1 HighN/AN/ANov 9, 2026
CVE-2026-115339: Progress Software WS_FTP Server: Insufficient resource limits in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an…7.5 HighN/AN/ANov 9, 2026
CVE-2026-115341: Progress Software WS_FTP Server: Improper access restrictions in the Thin Client Web Transfer component of Progress Software WS_FTP Server versions…7.7 HighN/AN/ANov 9, 2026
CVE-2026-115337: Progress Software WS_FTP Server: Improper access control in Progress WS_FTP Server versions prior to 2025.0.5 could allow an authenticated user with…6.3 MediumN/AN/ANov 9, 2026
CVE-2026-115336: Progress Software WS_FTP Server: Incorrect quota accounting in Progress Software WS_FTP Server releases prior to 2025.0.5 on Windows could allow an…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-115338: Progress Software WS_FTP Server: Insufficient protection of communications in Progress WS_FTP Server versions prior to 2025.0.5 could allow a network…8.1 HighN/AN/ANov 9, 2026
CVE-2026-112165: laservideo lasergest: The LaserGest mobile application disables TLS certificate and hostname verification via setServerTrustMode("nocheck"),…N/A6.9 MediumN/ANov 9, 2026
CVE-2026-121690: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) executes code with unnecessary privilegesN/AN/AN/ANov 9, 2026
CVE-2026-121689: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (v6.2.4_6.2.5_0.614.0) exposes sensitive credentials through multiple insecure…N/AN/AN/ANov 9, 2026
CVE-2026-121688: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains an insecure STM32 firmware update mechanismN/AN/AN/ANov 9, 2026
CVE-2026-121687: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains several local interfaces that are exposed…N/AN/AN/ANov 9, 2026
CVE-2026-121686: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) is vulnerable to unauthenticated, remote code…N/AN/AN/ANov 9, 2026
CVE-2026-121685: FrodoBots FrodoBots EarthRover Mini+ firmware: FrodoBots EarthRover Mini+ firmware (version 6.2.4_6.2.5_0.614.0) contains multiple sets of hard-coded credentialsN/AN/AN/ANov 9, 2026
CVE-2026-114594: Sandisk Sandisk Dashboard: A time-of-check to time-of-use (TOCTOU) race condition in the Sandisk Dashboard installer allows a local, authenticated…N/A5.4 MediumN/ANov 9, 2026
CVE-2026-112164: laservideo lasergest: The LaserGest mobile application encrypts stored assistance portal credentials with a hardcoded AES key and IV,…N/A6.6 MediumN/ANov 9, 2026
201-225 of 427771
‹›