The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121390: FreeRDP: FreeRDP 3.0.0 before 3.32.2 built with WITH_AAD=ON contains a reachable assertion because its ARM gateway response…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121389: FreeRDP: FreeRDP from 3.27.0 before 3.32.2 contains a denial of service vulnerability in rdpdr_dump_packet that allows malicious…3.1 Low2.3 LowN/ANov 3, 2026
CVE-2026-121388: FreeRDP: FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121387: FreeRDP: FreeRDP 2.0.0 before 3.32.2 contains an out-of-bounds read vulnerability in freerdp_dsp_decode_gsm610 that allows…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121386: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-118527: Ivanti Connect Secure: Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-118489: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the…7.5 HighN/AN/ANov 3, 2026
CVE-2026-106991: n/a: hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control7.1 HighN/AN/ANov 3, 2026
CVE-2026-118488: Eclipse Foundation Eclipse Vert.x: In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], when a malicious server keeps sending bytes on an…5.9 MediumN/AN/ANov 3, 2026
CVE-2026-100493: AMD AMD Compressionator SDK: An integer overflow in the DDS RGB888 loader of AMD Compressonator SDK could allow an attacker to supply a crafted DDS…N/A6.9 MediumN/ANov 3, 2026
CVE-2026-40652: AMD AMD Compressionator SDK: An out-of-bounds read condition in the AMD Compressonator SDK could allow an attacker with local access to supply a…N/A5.2 MediumN/ANov 3, 2026
CVE-2026-110265: runZero Platform: A specially crafted malformed search query could return results from outside a user's organization6.5 MediumN/AN/ANov 3, 2026
CVE-2026-121433: AzuraCast: AzuraCast before 0.24.0 contains a stored CSV formula injection vulnerability that allows station users with Media…5.4 Medium5.1 MediumN/ANov 3, 2026
CVE-2026-121429: AzuraCast: AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121421: surrealdb: SurrealDB 3.1.0 before 3.3.0 contains a server-side request forgery vulnerability in network-capability matching…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121417: surrealdb: SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed…7.8 High8.8 HighN/ANov 3, 2026
CVE-2026-121413: parse-community parse-server: Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 contains an authorization bypass in the session upgrade…3.1 Low2.3 LowN/ANov 3, 2026
CVE-2026-121409: FreeRDP: FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers…5.9 Medium8.2 HighN/ANov 3, 2026
CVE-2026-121405: FreeRDP: FreeRDP before 3.32.2 fails to cap the OutputBufferLength in serial device-control IRP requests, allowing malicious…4.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-89295: Eclipse Foundation Eclipse Mnestix: In Eclipse Mnestix AAS Generator versions 0.1.0 up until but excluding 1.5.0, a practical upper bound on the…N/AN/AN/ANov 3, 2026
CVE-2026-85035: zephyrproject zephyr: The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in…8.8 HighN/AN/ANov 3, 2026
CVE-2026-85034: zephyrproject zephyr: The Bluetooth host's GATT client passed the value of a received Handle Value Notification, Handle Value Indication or…6.7 MediumN/AN/ANov 3, 2026
CVE-2026-85033: zephyrproject zephyr: The AVRCP Target role in subsys/bluetooth/host/classic/avrcp.c keeps its vendor-dependent response transmit state in a…4.6 MediumN/AN/ANov 3, 2026
CVE-2026-85032: zephyrproject zephyr: The MCTP over USB device class in subsys/pmci/mctp/mctp_usb.c splits RX handling across two threads: the system…4.8 MediumN/AN/ANov 3, 2026
CVE-2026-120572: Mozilla Firefox: Incorrect boundary conditions in the Layout: Block and Inline component8.8 HighN/AN/ANov 3, 2026
201-225 of 528356
‹›