The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-120338: PrefectHQ prefab-ui: Prefab UI's Generative UI sandbox runs caller-supplied Python inside Pyodide, Python compiled to WebAssembly, in a Deno…9.9 CriticalN/AN/ANov 1, 2026
CVE-2026-120232: Horizon DataSys Reboot Restore Standard: A vulnerability was identified in Horizon DataSys Reboot Restore Standard up to 13.28.8 High8.5 HighN/ANov 1, 2026
CVE-2026-120231: WAVLINK WN553X1-B: A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.09.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-120230: WAVLINK WN701AE: A vulnerability was found in WAVLINK WN701AE 2601059.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-120233: ag-ui-protocol ag-ui: A security flaw has been discovered in ag-ui-protocol ag-ui up to 0.0.585.3 Medium6.9 MediumN/ANov 1, 2026
CVE-2026-120228: WAVLINK WN553X1-B: A flaw has been found in WAVLINK WN553X1-B V260403_2.0.09.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-117680: lud jsv: Improper Check for Unusual or Exceptional Conditions vulnerability in the pattern and patternProperties keywords in lud…N/A2.1 LowN/ANov 1, 2026
CVE-2026-120229: WAVLINK WN553X1-B: A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.09.1 Critical8.5 HighN/ANov 1, 2026
CVE-2026-120308: beam-cloud: A Beta9 tenant can attach a volume when deploying a function, endpoint, or task queue9.9 CriticalN/AN/ANov 1, 2026
CVE-2026-120307: beam-cloud Beta9 worker: The Beta9 worker serves the sandbox file API from outside the container9.9 CriticalN/AN/ANov 1, 2026
CVE-2026-120306: beam-cloud Beta9 worker: Beta9 turns each shell command in a tenant image definition into a Dockerfile RUN line and executes it with Buildah on…9.9 CriticalN/AN/ANov 1, 2026
CVE-2026-120227: WAVLINK WN701AE: A vulnerability was detected in WAVLINK WN701AE M01AE_V2601059.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-120226: Hangzhou Xiongmai Technology P2PAPI.dll: A security vulnerability has been detected in Hangzhou Xiongmai Technology P2PAPI.dll 1.3.3.32 on Windows3.3 Low1.9 LowN/ANov 1, 2026
CVE-2026-13575: CRLF InjectionN/AN/AN/ANov 1, 2026
CVE-2026-120225: Oray Pugongying X5 Pro: A weakness has been identified in Oray Pugongying X5 Pro up to 7.6.19.1 Critical8.5 HighN/ANov 1, 2026
CVE-2026-120224: Oray Pugongying X5 Pro: A security flaw has been discovered in Oray Pugongying X5 Pro up to 7.6.19.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-120223: Oray Pugongying X5 Pro: A vulnerability was identified in Oray Pugongying X5 Pro up to 7.6.13.1 Low1.3 LowN/ANov 1, 2026
CVE-2026-119627: Gitea: The web profile and RSS/Atom feed routes of users and organizations checked only whether a signed-in viewer could see a…N/AN/AN/ANov 1, 2026
CVE-2026-119625: Gitea: The `/{username}` web route accepted personal access tokens over HTTP Basic authentication without checking their scopeN/AN/AN/ANov 1, 2026
CVE-2026-119533: Gitea: Repository and organization project boards listed the pull requests that reference each issue on the board without…N/AN/AN/ANov 1, 2026
CVE-2026-119441: Gitea: `DELETE /api/v1/orgs/{org}/repos` deletes all repositories of an organization, but it did not enforce the public-only…N/AN/AN/ANov 1, 2026
CVE-2026-118504: Gitea: The web interface blocks issue and pull request changes on archived repositories, but several issue routes of the REST…N/AN/AN/ANov 1, 2026
CVE-2026-118395: Gitea: Gitea 1.27.3 stopped personal access tokens restricted to public resources (`public-only`) from creating repositories…N/AN/AN/ANov 1, 2026
CVE-2026-118394: Gitea: The OAuth2 userinfo endpoint (`/login/oauth/userinfo`) decided whether to limit the `groups` claim to public…N/AN/AN/ANov 1, 2026
CVE-2026-117685: Gitea: The OCI registry's cross-repository blob mount checked the target package against the token's `public-only`…N/AN/AN/ANov 1, 2026
1-25 of 420636
›