The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-12067: Gen Digital: Missing exception handlers in AvastSvc native message dispatcher (ashServ.dll) on Windows allow a local, unprivileged…N/AN/AN/ANov 6, 2026
CVE-2026-58141: langgenius dify: Dify before 1.15.0 contains a server-side request forgery vulnerability that allows any authenticated console user to…7.6 High7.2 HighN/ANov 6, 2026
CVE-2026-66986: HCL Software HCL AION: HCL AION is affected by a vulnerability where user sessions did not expire after a sufficient period of inactivity3.3 LowN/AN/ANov 6, 2026
CVE-2026-123677: xxyopen, 201206030 novel: A vulnerability was found in xxyopen/201206030 novel up to 3.5.04.3 Medium5.3 MediumN/ANov 6, 2026
CVE-2026-90436: Apache Software Foundation Apache Axis 1.x (EOL): ** UNSUPPORTED WHEN ASSIGNED ** Deserialization of an inbound SOAP fault in Apache Axis 1.x allows unauthenticated…N/AN/AN/ANov 6, 2026
CVE-2026-66987: HCL Software HCL AION: HCL AION is affected by a vulnerability where the account lockout mechanism did not sufficiently restrict repeated…5.3 MediumN/AN/ANov 6, 2026
CVE-2026-66982: HCL Software HCL AION: HCL AION is affected by a vulnerability where browser autocomplete was enabled on sensitive login form fields, allowing…3.3 LowN/AN/ANov 6, 2026
CVE-2026-66984: HCL Software HCL AION: HCL AION is affected by a vulnerability where certain application responses revealed internal server file system paths3.1 LowN/AN/ANov 6, 2026
CVE-2026-123676: xxyopen, 201206030 novel: A vulnerability has been found in xxyopen/201206030 novel up to 3.5.05.3 Medium6.9 MediumN/ANov 6, 2026
CVE-2026-66981: HCL Software HCL AION: HCL AION is affected by a vulnerability where the application trusted the value of the HTTP Host header supplied in…6.5 MediumN/AN/ANov 6, 2026
CVE-2026-21834: HCL Software HCL AION: HCL AION is affected by a vulnerability where the Content-Security-Policy (CSP) security response header was missing…3.1 LowN/AN/ANov 6, 2026
CVE-2026-123792: sensiolabs symfony: The Symfony Yaml components Inline and Parser, parse some YAML documents inefficiently, so that a small crafted…N/A8.7 HighN/ANov 6, 2026
CVE-2026-123623: gridaco grida: Grida through 0.0.24 contains a missing authorization vulnerability in the Forms file-preview API routes that allows…5.9 Medium8.2 HighN/ANov 6, 2026
CVE-2026-123675: OpenBMB Internet of Agents: A flaw has been found in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a8.3 High6.9 MediumN/ANov 6, 2026
CVE-2026-121880: Posit Software, PBC: Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC…N/A4.7 MediumN/ANov 6, 2026
CVE-2026-121881: Posit Software, PBC Posit Workbench: SQL injection vulnerability in the get_last_seen code-server session-state RPC in Posit Software, PBC Posit Workbench…N/A5.7 MediumN/ANov 6, 2026
CVE-2026-123786: Agenta-AI agenta: Agenta before 0.122.5 contains a server-side request forgery vulnerability that allows workspace members with workflow…8.5 High8.4 HighN/ANov 6, 2026
CVE-2026-123785: fluxbox: Fluxbox through 1.3.7 contains an infinite loop vulnerability in Menu::updateMenu() in src/FbTk/Menu.cc that allows…5.5 Medium6.8 MediumN/ANov 6, 2026
CVE-2026-123784: fluxbox: Fluxbox through 1.3.7 contains an OS command injection vulnerability in RootTheme::reconfigTheme() that allows…7.8 High8.5 HighN/ANov 6, 2026
CVE-2026-123783: Skyvern-AI skyvern: Skyvern through 1.0.56 contains a sandbox bypass vulnerability that allows authenticated users to execute code by…8.8 High8.7 HighN/ANov 6, 2026
CVE-2026-123782: zhimaAi chatwiki: ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability in SaveFormField and…4.3 Medium5.3 MediumN/ANov 6, 2026
CVE-2026-123624: zhimaAi chatwiki: ChatWiki before 2.10.0 contains an insecure direct object reference vulnerability that allows authenticated users to…5.4 Medium5.3 MediumN/ANov 6, 2026
CVE-2026-123622: webmin usermin: Usermin through 2.570 contains a cross-site scripting vulnerability in mailbox/detach.cgi that allows remote attackers…6.1 Medium5.1 MediumN/ANov 6, 2026
CVE-2026-123621: webmin usermin: Usermin through 2.570 contains a path traversal vulnerability in mailbox/detachall.cgi that allows remote…8.8 High8.6 HighN/ANov 6, 2026
CVE-2026-123620: webmin usermin: Usermin through 2.570 contains an OS command injection vulnerability in the Read Mail module that allows authenticated…7.5 High7.7 HighN/ANov 6, 2026
1-25 of 419530
›