The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-127277: Linksys EA8100: A security flaw has been discovered in Linksys EA8100 1.0.3.21694010.0 Critical10.0 CriticalN/ANov 13, 2026
CVE-2026-127916: mcu-tools mcuboot: bootutil_img_hash() computes the image digest over ih_hdr_size + ih_img_size + ih_protect_tlv_size bytes, all three…2.9 LowN/AN/ANov 13, 2026
CVE-2026-127915: mcu-tools mcuboot: The MCUboot TLV iterator bootutil_tlv_iter_next() in boot/bootutil/src/tlv.c walks image trailer TLVs with a single…2.0 LowN/AN/ANov 13, 2026
CVE-2026-16664: mcu-tools mcuboot: MCUboot's Zephyr serial-recovery upload handler bs_upload() in boot/boot_serial/src/boot_serial.c decodes the…5.1 MediumN/AN/ANov 13, 2026
CVE-2026-16659: mcu-tools mcuboot: MCUboot's serial-recovery image-upload handler bs_upload() in boot/boot_serial/src/boot_serial.c declares const struct…4.0 MediumN/AN/ANov 13, 2026
CVE-2026-16671: mcu-tools mcuboot: split_image_check() in boot/bootutil/src/loader.c declares a fixed uint8_t loader_hash[32] buffer and passes it as the…2.9 LowN/AN/ANov 13, 2026
CVE-2026-16662: mcu-tools mcuboot: boot_save_boot_status() in boot/bootutil/src/boot_record.c reads the image's EXPECTED_HASH_TLV into a stack buffer…2.4 LowN/AN/ANov 13, 2026
CVE-2026-128091: mcu-tools mcuboot: When MCUboot is built with the TinyCrypt crypto backend (MCUBOOT_USE_TINYCRYPT), bootutil_aes_ctr_drop() in…2.0 LowN/AN/ANov 13, 2026
CVE-2026-127928: mcu-tools mcuboot: In MCUboot's serial-recovery encrypted-image support (boot/boot_serial/src/boot_serial_encryption.c),…2.0 LowN/AN/ANov 13, 2026
CVE-2026-93335: HashiCorp: Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths…6.5 MediumN/AN/ANov 13, 2026
CVE-2026-93333: HashiCorp: Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce…2.7 LowN/AN/ANov 13, 2026
CVE-2026-92735: HashiCorp: HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow…5.9 MediumN/AN/ANov 13, 2026
CVE-2026-128067: python-pillow Pillow: Pillow is a Python imaging libraryN/A8.4 HighN/ANov 13, 2026
CVE-2026-128066: python-pillow Pillow: Pillow is a Python imaging libraryN/A8.7 HighN/ANov 13, 2026
CVE-2026-128065: grpc grpc-node: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addonN/A6.9 MediumN/ANov 13, 2026
CVE-2026-127275: Linksys EA8100: A vulnerability was determined in Linksys EA8100 1.0.3.21694010.0 Critical9.3 CriticalN/ANov 13, 2026
CVE-2026-127274: Linksys EA8100: A vulnerability was found in Linksys EA8100 1.0.3.2169403.7 Low2.9 LowN/ANov 13, 2026
CVE-2026-127273: Linksys EA8100: A vulnerability has been found in Linksys EA8100 1.0.3.2169404.3 Medium2.1 LowN/ANov 13, 2026
CVE-2026-127212: dokploy: Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that…4.3 Medium5.3 MediumN/ANov 13, 2026
CVE-2026-126982: MongoDB C# Driver: A type allow-list bypass in the BSON serialization library of the MongoDB C# Driver allows a type-restriction check to…7.5 High7.7 HighN/ANov 13, 2026
CVE-2026-126839: MongoDB C# Driver: A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used…4.2 Medium2.3 LowN/ANov 13, 2026
CVE-2026-126792: MongoDB Libmongocrypt Driver: A memory-safety flaw in the key-management request-building component of the library can lead to an out-of-bounds write…4.7 Medium5.7 MediumN/ANov 13, 2026
CVE-2026-126367: grpc grpc-node: @grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon4.8 MediumN/AN/ANov 13, 2026
CVE-2026-126366: msgpack msgpack-ruby: MessagePack for Ruby is an implementation of the MessagePack binary serialization format7.5 HighN/AN/ANov 13, 2026
CVE-2026-126365: withastro, @astrojs: Astro is a web framework for content-driven websites5.4 MediumN/AN/ANov 13, 2026
1-25 of 433023
›