The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123586: hickory-dns: Hickory DNS 0.25.0-alpha.3 through 0.25.2 contains a query amplification vulnerability in its recursive resolver, which…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123585: hickory-dns: The hickory-resolver component of Hickory DNS 0.25.0 before 0.26.2 follows irrelevant CNAME records when resolving…5.3 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123584: hickory-dns: The hickory-net crate in Hickory DNS 0.26.0 before 0.26.2 stops listening and returns an error when a client UDP…5.9 Medium8.2 HighN/ANov 8, 2026
CVE-2026-123583: hickory-dns: The recursive resolver in Hickory DNS hickory-recursor 0.25.0 through 0.25.2 and hickory-resolver 0.26.0 before 0.26.2…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123582: hickory-dns: The validating recursive resolver and validating forwarder in Hickory DNS (hickory-server) 0.25.0 before 0.26.2 do not…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123581: hickory-dns: Hickory DNS hickory-proto through 0.26.0-alpha.1 and hickory-net 0.26.0-beta.1 before 0.26.2 contain a DNSSEC…5.3 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123580: hickory-dns: Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 perform insufficient…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123579: hickory-dns: DNSSEC validation in Hickory DNS hickory-net 0.26.0-beta.1 before 0.26.2 and hickory-proto through 0.26.0-alpha.1 does…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123578: hickory-dns: Hickory DNS hickory-net 0.26.0 before 0.26.2 and hickory-proto 0.25.0 through 0.25.2 skip the check that a UDP…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123577: hickory-dns: Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123576: hickory-dns: Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123575: hickory-dns: Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123574: hickory-dns: The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123573: hickory-dns: hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123572: hickory-dns: Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123571: hickory-dns: Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123570: hickory-dns: The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123569: sveltejs devalue: The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123568: sveltejs devalue: Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object…4.4 Medium2.1 LowN/ANov 8, 2026
CVE-2026-123567: sveltejs devalue: Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123566: sveltejs devalue: Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123565: sveltejs devalue: Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123564: sveltejs devalue: Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123563: sveltejs devalue: Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123562: sveltejs devalue: devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when…7.5 High8.7 HighN/ANov 8, 2026
226-250 of 429748
‹›