The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120367: Apache Software Foundation Apache Axis2/Java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/JavaN/AN/AN/ANov 9, 2026
CVE-2026-96285: Apache Software Foundation Apache Airflow: Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a…N/AN/AN/ANov 9, 2026
CVE-2026-92683: Neo4j @neo4j/graphql: Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions…N/A8.6 HighN/ANov 9, 2026
CVE-2026-86829: Apache Software Foundation Apache Airflow: Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependenciesN/AN/AN/ANov 9, 2026
CVE-2026-86468: Apache Software Foundation Apache Airflow: Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported…N/AN/AN/ANov 9, 2026
CVE-2026-82440: Apache Software Foundation Apache Storm Nimbus: Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling itN/AN/AN/ANov 9, 2026
CVE-2026-82436: Apache Software Foundation Apache Storm Client: Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class…N/AN/AN/ANov 9, 2026
CVE-2026-82337: Apache Software Foundation Apache Airflow: Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class…N/AN/AN/ANov 9, 2026
CVE-2026-76185: Apache Software Foundation Apache Airflow Task SDK: Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters,…N/AN/AN/ANov 9, 2026
CVE-2026-68982: Apache Software Foundation Apache Airflow: Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without…N/AN/AN/ANov 9, 2026
CVE-2026-50204: Apache Software Foundation Apache Airflow: Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because…N/AN/AN/ANov 9, 2026
CVE-2026-40913: Apache Software Foundation Apache Airflow: Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the…N/AN/AN/ANov 9, 2026
CVE-2026-124637: Kompini Tankuam Places: A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom…N/A5.3 MediumN/ANov 9, 2026
CVE-2026-124589: lxtGH OMG-Seg: A weakness has been identified in lxtGH OMG-Seg up to f3b26b609bae919760cd3ccf09c36179bb8624a06.3 Medium2.1 LowN/ANov 9, 2026
CVE-2026-124588: huggingface finetrainers: A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.06.3 Medium2.1 LowN/ANov 9, 2026
CVE-2026-124587: elizaOS eliza: A vulnerability was identified in elizaOS eliza 2.0.3-beta.74.3 Medium2.1 LowN/ANov 9, 2026
CVE-2026-124586: Tencent RapidJSON: A vulnerability was determined in Tencent RapidJSON 1.1.07.3 High5.5 MediumN/ANov 9, 2026
CVE-2026-113508: Apache Software Foundation Apache Airflow: Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during…N/AN/AN/ANov 9, 2026
CVE-2026-113504: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered…N/AN/AN/ANov 9, 2026
CVE-2026-111455: Apache Software Foundation Apache Airflow: Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission…N/AN/AN/ANov 9, 2026
CVE-2026-111454: Apache Software Foundation Apache Airflow: Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset…N/AN/AN/ANov 9, 2026
CVE-2026-111452: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under…N/AN/AN/ANov 9, 2026
CVE-2026-111395: Apache Software Foundation Apache Airflow: Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`N/AN/AN/ANov 9, 2026
CVE-2026-107474: Apache Software Foundation Apache Airflow: The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed…N/AN/AN/ANov 9, 2026
CVE-2026-101031: Apache Software Foundation Apache Airflow: The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with…N/AN/AN/ANov 9, 2026
276-300 of 427771
‹›