The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123552: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs…6.5 Medium6.3 MediumN/ANov 8, 2026
CVE-2026-123551: OpenIdentityPlatform OpenAM: OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers…10.0 Critical10.0 CriticalN/ANov 8, 2026
CVE-2026-123550: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts…9.8 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-123549: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous…9.8 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-123548: OpenIdentityPlatform OpenAM: OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and…4.7 Medium2.3 LowN/ANov 8, 2026
CVE-2026-123547: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites…4.7 Medium2.3 LowN/ANov 8, 2026
CVE-2026-123546: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to…6.1 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123545: OpenIdentityPlatform OpenAM: OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-123544: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP…6.8 Medium6.1 MediumN/ANov 8, 2026
CVE-2026-123543: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123542: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code…6.8 Medium7.6 HighN/ANov 8, 2026
CVE-2026-123541: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML…4.7 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123540: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to…2.0 Low2.0 LowN/ANov 8, 2026
CVE-2026-123539: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject…4.8 Medium4.8 MediumN/ANov 8, 2026
CVE-2026-123538: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as…6.6 Medium7.5 HighN/ANov 8, 2026
CVE-2026-123537: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource…5.0 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123536: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including…4.1 Medium5.1 MediumN/ANov 8, 2026
CVE-2026-123535: tornadoweb tornado: Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by…4.2 Medium2.3 LowN/ANov 8, 2026
CVE-2026-123534: tornadoweb tornado: Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows…6.5 Medium8.3 HighN/ANov 8, 2026
CVE-2026-123533: GitoxideLabs gitoxide: gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because…5.5 Medium6.8 MediumN/ANov 8, 2026
CVE-2026-123532: GitoxideLabs gitoxide: gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123531: go-vikunja vikunja: Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated…8.8 High8.7 HighN/ANov 8, 2026
CVE-2026-123530: go-vikunja vikunja: Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to…5.9 Medium6.0 MediumN/ANov 8, 2026
CVE-2026-123529: go-vikunja vikunja: Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write…4.6 Medium5.1 MediumN/ANov 8, 2026
CVE-2026-123528: go-vikunja vikunja: Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access…6.8 Medium7.6 HighN/ANov 8, 2026
226-250 of 418627
‹›