The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2022-30267: Emerson Ovation: Emerson Ovation was found to have no authentication of firmware signing and relies on an insecure checksum for integrity7.5 High8.7 HighN/ANov 3, 2026
CVE-2022-29966: Emerson Ovation: Emerson Ovation has several protocols that have no authentication, which could allow an attacker to change controller…9.8 Critical9.3 CriticalN/ANov 3, 2026
CVE-2026-121582: n/a Umami: A vulnerability has been found in Umami up to 3.4.16.5 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121736: nocodb: NocoDB 0.300.0 before 2026.08.0 contains a missing authentication vulnerability in the POST /api/v2/oauth/authorize…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121735: blueprintue blueprintue-self-hosted-edition: blueprintUE self-hosted edition before 4.3.4 contains an insufficient session expiration vulnerability that allows…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121734: zane-ops: ZaneOps 1.14.0 before 1.15.2 contains an authorization bypass vulnerability that allows any workspace administrator to…6.5 Medium6.0 MediumN/ANov 3, 2026
CVE-2026-121733: Webkul Bagisto: Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload…5.4 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121732: francoisjacquet RosarioSIS: RosarioSIS before 12.9 contains an improper authorization vulnerability that allows school-scoped administrators to…2.7 Low2.1 LowN/ANov 3, 2026
CVE-2026-121731: francoisjacquet RosarioSIS: RosarioSIS before 12.9 contains a sql injection vulnerability that allows authenticated non-student users, including…8.8 High8.7 HighN/ANov 3, 2026
CVE-2026-121730: 0xdps emailflare: emailflare before commit cf31f33 contains a missing authorization vulnerability in POST /api/inbox/compose that allows…6.5 Medium7.1 HighN/ANov 3, 2026
CVE-2026-121729: 0xdps emailflare: emailflare before commit cf31f33 contains a missing authorization vulnerability in the inbox service /api/keys routes…8.3 High7.2 HighN/ANov 3, 2026
CVE-2026-121728: SourceHut meta.sr.ht: SourceHut meta.sr.ht 0.56.11 before 0.89.0 contains an authorization bypass vulnerability that allows unauthenticated…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121727: jorisvink kore: Kore before 4.3.0 contains an integer underflow vulnerability in HTTP request body handling that allows unauthenticated…7.5 High8.7 HighN/ANov 3, 2026
CVE-2026-109836: ALCPU Core Temp: The Core Temp kernel driver provided by ALCPU is vulnerable to insufficient access control in an exposed IOCTL, which…6.7 Medium8.4 HighN/ANov 3, 2026
CVE-2026-118237: GitHub Enterprise Server: An out-of-bounds read vulnerability was identified in GitHub Enterprise Server in the Git service (babeld)N/A5.3 MediumN/ANov 3, 2026
CVE-2026-110288: GitHub Enterprise Server: A cross-site request forgery vulnerability was identified in GitHub Enterprise Server that allowed an unauthenticated…N/A5.3 MediumN/ANov 3, 2026
CVE-2026-104608: GitHub Enterprise Server: A remote code execution vulnerability was identified in GitHub Enterprise Server in the Git service (babeld)N/A7.7 HighN/ANov 3, 2026
CVE-2026-121581: n/a ArcReel: A vulnerability has been found in ArcReel 0.32.0/0.33.0/0.34.04.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121539: miroslavpejic85 MiroTalk P2P: A vulnerability was found in miroslavpejic85 MiroTalk P2P up to 2.0.87/2.1.386.3 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121524: sumiie24 School-Management-System: A flaw has been found in sumiie24 School-Management-System up to d946d649c7c95e101fc5679ecd91999533bb10d77.3 High5.5 MediumN/ANov 3, 2026
CVE-2026-120930: Google Chrome: Incorrect authorization in Blink in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin…N/AN/AN/ANov 3, 2026
CVE-2026-119084: AWS amazon-redshift-jdbc-driver: Unsafe reflection in the connection parameter and credentials profile handling of Amazon Redshift JDBC Driver before…8.1 High9.2 CriticalN/ANov 3, 2026
CVE-2026-116661: Tanium Enforce: Tanium addressed an improper access controls vulnerability in Enforce.6.5 MediumN/AN/ANov 3, 2026
CVE-2026-116650: Tanium Threat Response: Tanium addressed an unauthorized code execution vulnerability in Threat Response.7.5 HighN/AN/ANov 3, 2026
CVE-2026-116668: Tanium Discover: Tanium addressed an uncontrolled resource consumption vulnerability in Discover.4.3 MediumN/AN/ANov 3, 2026
1-25 of 528356
›