The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-125703: Red Hat, GStreamer: A flaw was found in the GStreamer gst-plugins-bad MXF plugin5.5 MediumN/AN/ANov 10, 2026
CVE-2026-120999: nerves-hub nerves_hub_web: Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an…N/A7.4 HighN/ANov 10, 2026
CVE-2026-120997: nerves-hub nerves_hub_web: Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in…N/A2.3 LowN/ANov 10, 2026
CVE-2026-120730: nerves-hub nerves_hub_web: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device…N/A8.6 HighN/ANov 10, 2026
CVE-2026-120295: nerves-hub nerves_hub_web: Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an…N/A7.1 HighN/ANov 10, 2026
CVE-2026-120286: nerves-hub nerves_hub_web: Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an…N/A5.3 MediumN/ANov 10, 2026
CVE-2026-119446: nerves-hub nerves_hub_web: Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to…N/A9.4 CriticalN/ANov 10, 2026
CVE-2026-125672: Red Hat: A flaw was found in cockpit-storaged6.6 MediumN/AN/ANov 10, 2026
CVE-2026-104619: PackageKit: Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing…7.8 HighN/A0%Nov 10, 2026
CVE-2026-124503: sooperset mcp-atlassian: A vulnerability was identified in sooperset mcp-atlassian up to 0.24.04.3 Medium2.1 Low1%Nov 10, 2026
CVE-2026-60045: MB connect line, Helmholz: A high privileged remote attacker can upload arbitrary files to a guessable location4.9 Medium6.9 Medium0%Nov 10, 2026
CVE-2026-60044: MB connect line, Helmholz: The backups created by the application use a weak static password allowing an unauthenticated remote attacker to access…7.5 High8.7 High0%Nov 10, 2026
CVE-2026-60043: MB connect line, Helmholz: An unauthenticated remote attacker can perform a XSS attack on a logged in backend user allowing for execution of…9.3 Critical6.4 Medium0%Nov 10, 2026
CVE-2026-60042: MB connect line, Helmholz: An unauthenticated remote attacker can perform an authentication bypass on the com_check function, potentially…5.3 Medium6.9 Medium0%Nov 10, 2026
CVE-2026-60040: MB connect line, Helmholz: An unauthenticated remote attacker can perform a DoS in the backends backup creation function7.5 High8.7 High0%Nov 10, 2026
CVE-2026-60039: MB connect line, Helmholz: A high privileged remote attacker can perform a code injection in the backends backup restore function leading to code…7.2 High8.6 High0%Nov 10, 2026
CVE-2026-60038: MB connect line, Helmholz: A high privileged remote attacker can perform an OpenSSL code injection in the backends ImportPKCS12 function leading…7.2 High8.6 High0%Nov 10, 2026
CVE-2026-60037: MB connect line, Helmholz: A high privileged remote attacker can perform an OpenSSL code injection in the frontends device importer function…7.2 High8.6 High0%Nov 10, 2026
CVE-2026-60035: MB connect line, Helmholz: A high privileged remote attacker can perform a code injection in the backends network auth function leading to code…7.2 High8.6 High0%Nov 10, 2026
CVE-2026-120013: SAP_SE SAP Cloud SDK for Python: The agent_memory module accepts a caller-supplied tenant parameter in create_client(tenant=...)7.5 HighN/A0%Nov 10, 2026
CVE-2026-120012: SAP_SE SAP Cloud SDK for AI(JavaScript): SAP Cloud SDK for AI (Node.js) could inadvertently include sensitive authentication credentials in error messages…7.5 HighN/A0%Nov 10, 2026
CVE-2026-106025: Unknown Cargo Shipping Location for WooCommerce: The Cargo Shipping Location for WooCommerce WordPress plugin before 6.0 does not properly restrict access to a REST API…5.3 MediumN/A0%Nov 10, 2026
CVE-2026-106007: Unknown FraudLabs Pro SMS Verification: The FraudLabs Pro SMS Verification WordPress plugin through 1.12.1 does not enforce its SMS-retry limit on the server…5.3 MediumN/A0%Nov 10, 2026
CVE-2026-60046: MB connect line, Helmholz: An unauthenticated remote attacker can perform password resets for any user with known username and email without rate…7.5 High8.7 High0%Nov 10, 2026
CVE-2026-60041: MB connect line, Helmholz: An unauthenticated remote attacker can perform a CSRF attack on a logged in backend user allowing for execution of…8.1 High5.3 Medium0%Nov 10, 2026
276-300 of 517528