The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123561: sveltejs devalue: devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123560: ZcashFoundation zebra: Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123559: ZcashFoundation zebra: Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123558: ZcashFoundation zebra: Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123557: ZcashFoundation zebra: ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated…5.9 Medium8.2 HighN/ANov 8, 2026
CVE-2026-123556: ZcashFoundation zebra: ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring…5.3 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123555: ZcashFoundation zebra: Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123554: ZcashFoundation zebra: Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123553: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService…6.5 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123552: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a server-side request forgery vulnerability in certificate CRL checking that fetches CRLs…6.5 Medium6.3 MediumN/ANov 8, 2026
CVE-2026-123551: OpenIdentityPlatform OpenAM: OpenAM from 14.0.0 before 16.1.4 contains an information disclosure vulnerability that allows unauthenticated attackers…10.0 Critical10.0 CriticalN/ANov 8, 2026
CVE-2026-123550: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts…9.8 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-123549: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 fails to enforce the Valid Creation Attributes list during self-registration, allowing anonymous…9.8 Critical9.3 CriticalN/ANov 8, 2026
CVE-2026-123548: OpenIdentityPlatform OpenAM: OpenIdentityPlatform OpenAM before 16.1.4 contains an open redirect because WS-Federation logout, SAML v2.0 logout and…4.7 Medium2.3 LowN/ANov 8, 2026
CVE-2026-123547: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an open redirect vulnerability that allows attackers to redirect users to external sites…4.7 Medium2.3 LowN/ANov 8, 2026
CVE-2026-123546: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to…6.1 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123545: OpenIdentityPlatform OpenAM: OpenAM from 14.5.1 before 16.1.4 contains a cross-site request forgery vulnerability in the OAuth 2.0 device…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-123544: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 and its client SDK fail to sufficiently validate responses on the internal server-to-server SOAP…6.8 Medium6.1 MediumN/ANov 8, 2026
CVE-2026-123543: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123542: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code…6.8 Medium7.6 HighN/ANov 8, 2026
CVE-2026-123541: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an open redirect vulnerability that allows remote attackers to redirect users after SAML…4.7 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123540: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an incomplete output encoding vulnerability that allows a SAML 1.x identity provider to…2.0 Low2.0 LowN/ANov 8, 2026
CVE-2026-123539: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a stored cross-site scripting vulnerability that allows privileged attackers to inject…4.8 Medium4.8 MediumN/ANov 8, 2026
CVE-2026-123538: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as…6.6 Medium7.5 HighN/ANov 8, 2026
CVE-2026-123537: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows parties registering UMA resource…5.0 Medium5.3 MediumN/ANov 8, 2026
251-275 of 418627
‹›