The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
CVE-2026-81578:PaperCut NG/MF Critical Zero-Day Exploited in the Wild
Blog ↗CVE details
CVE-2026-63520:Rapid7 Analysis: Microsoft SharePoint Remote Code Execution (CVE-2026-63520)
Blog ↗CVE details
CVE-2026-19490:Critical Vulnerability Affecting Citrix NetScaler ADC and NetScaler Gateway
Blog ↗CVE details
CVE-2026-55040:Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)
Blog ↗CVE details
CVE-2026-63520:Microsoft SharePoint Remote Code Execution (FIXED)
Blog ↗CVE details
CVE-2026-63077:Rapid7 Analysis: Unauthenticated Remote Code Execution in JetBrains TeamCity (CVE-2026-63077)
Blog ↗CVE details
TitleEitWModules
CVE-2026-82549: Linux Foundation Magma: A vulnerability was identified in Linux Foundation Magma 1.9.08.3 High6.9 MediumN/AAug 30, 2026
CVE-2026-82658: admidio: Admidio versions before 5.0.12 contain a broken access control vulnerability in profile_function.php that allows…4.3 Medium5.3 MediumN/AAug 30, 2026
CVE-2026-82657: admidio: Admidio before 5.0.12 fails to enforce login-only module restrictions in RSS feed endpoints for forum and announcements…7.5 High8.7 HighN/AAug 30, 2026
CVE-2026-82656: admidio: Admidio before 5.0.12 fails to sanitize album names in the photo ZIP download functionality, allowing authenticated…2.6 Low2.1 LowN/AAug 30, 2026
CVE-2026-82655: admidio: Admidio before 5.0.12 contains a blind SQL injection vulnerability in the relation_type_list parameter of…7.5 High8.7 HighN/AAug 30, 2026
CVE-2026-82654: siyuan-note siyuan: SiYuan before v3.8.1 fails to properly escape block name, alias, and memo fields in hint, backlink, and breadcrumb…8.9 High9.3 CriticalN/AAug 30, 2026
CVE-2026-82653: siyuan-note siyuan: SiYuan before v3.8.1 contains a stored cross-site scripting vulnerability in confirmDialog() where unescaped package…8.9 High9.3 CriticalN/AAug 30, 2026
CVE-2026-82652: siyuan-note siyuan: SiYuan before v3.8.1 fails to filter invisible-tier content from SQL embed blocks, attribute-view keys, and…5.3 Medium6.9 MediumN/AAug 30, 2026
CVE-2026-82651: siyuan-note siyuan: SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the…4.9 Medium6.9 MediumN/AAug 30, 2026
CVE-2026-82650: siyuan-note siyuan: SiYuan 3.8.0 contains a path traversal / sensitive file exposure vulnerability in the RenderTemplate function…4.4 Medium5.9 MediumN/AAug 30, 2026
CVE-2026-82649: siyuan-note siyuan: SiYuan Windows installer before version 3.8.1 (affected versions >= 2.0.14) contains an uncontrolled search path…N/A7.0 HighN/AAug 30, 2026
CVE-2026-82648: WWBN AVideo: WWBN AVideo contains a server-side request forgery filter bypass vulnerability in the isSSRFSafeURL function that fails…7.1 High7.1 HighN/AAug 30, 2026
CVE-2026-82647: WWBN AVideo: WWBN AVideo contains a cross-site request forgery vulnerability in sendEmail.json.php that allows authenticated…6.1 Medium5.3 MediumN/AAug 30, 2026
CVE-2026-82646: WWBN AVideo: WWBN AVideo contains an unauthenticated reflected cross-site scripting vulnerability in the url2Embed.json.php endpoint…6.1 Medium5.3 MediumN/AAug 30, 2026
CVE-2026-82645: WWBN AVideo: AVideo (current commit e01e41ecc and earlier) exposes stream credentials through the…8.6 High9.2 CriticalN/AAug 30, 2026
CVE-2026-82644: WWBN AVideo: WWBN AVideo (current e01e41ecc and earlier) contains a brute-force rate limiting bypass in enforceRateLimit(), which…7.5 High8.7 HighN/AAug 30, 2026
CVE-2026-82643: WWBN AVideo: WWBN AVideo contains an unauthenticated credential submission vulnerability in plugin/Live/api/preauthorize.json.php…6.5 Medium6.9 MediumN/AAug 30, 2026
CVE-2026-82548: Linux Foundation Magma: A vulnerability was determined in Linux Foundation Magma 1.9.05.3 Medium5.5 MediumN/AAug 30, 2026
CVE-2026-82547: Linux Foundation Magma: A vulnerability was found in Linux Foundation Magma 1.9.06.5 Medium5.5 MediumN/AAug 30, 2026
CVE-2026-82545: itsourcecode Sales and Inventory System: A vulnerability has been found in itsourcecode Sales and Inventory System 1.06.3 Medium2.1 LowN/AAug 30, 2026
CVE-2026-78699: ash-project ash_postgres: Unchecked Return Value vulnerability in ash-project ash_postgres allows a user who can drive a tenant rename to a name…N/A7.2 HighN/AAug 30, 2026
CVE-2026-82642: readest: Readest is an open-source e-book reader built on Tauri8.8 HighN/AN/AAug 30, 2026
CVE-2026-82641: keploy: keploy versions 3.1.0 through 3.6.25 bind the agent control-plane HTTP server to all interfaces without authentication,…8.6 High8.8 HighN/AAug 30, 2026
CVE-2026-82640: browser-use web-ui: browser-use web-ui versions 2.0.0 through 3.0.0 write configured LLM API keys to disk in cleartext without encryption…5.5 Medium6.8 MediumN/AAug 30, 2026
CVE-2026-82639: ChatGPTNextWeb NextChat: NextChat versions from 2.15.8 through 2.16.1 contain an improper URL validation vulnerability in the proxy endpoint…7.5 High8.7 HighN/AAug 30, 2026
1-25 of 386293