The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123536: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains a server-side request forgery vulnerability that allows administrators, including…4.1 Medium5.1 MediumN/ANov 8, 2026
CVE-2026-123535: tornadoweb tornado: Tornado before 6.6 does not validate the max_age argument of RequestHandler.set_cookie (also called by…4.2 Medium2.3 LowN/ANov 8, 2026
CVE-2026-123534: tornadoweb tornado: Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows…6.5 Medium8.3 HighN/ANov 8, 2026
CVE-2026-123533: GitoxideLabs gitoxide: gix-commitgraph before 0.42.0, as used in gitoxide before 0.61.0, contains a denial of service vulnerability because…5.5 Medium6.8 MediumN/ANov 8, 2026
CVE-2026-123532: GitoxideLabs gitoxide: gix-fs in gitoxide before 0.24.1 contains a credential disclosure vulnerability that allows remote attackers to capture…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123531: go-vikunja vikunja: Vikunja from 1.0.0 before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated…8.8 High8.7 HighN/ANov 8, 2026
CVE-2026-123530: go-vikunja vikunja: Vikunja before 2.7.1 contains a missing authentication vulnerability that allows attackers holding a stolen session to…5.9 Medium6.0 MediumN/ANov 8, 2026
CVE-2026-123529: go-vikunja vikunja: Vikunja before 2.7.1 contains a stored CSS injection vulnerability that allows authenticated users with project write…4.6 Medium5.1 MediumN/ANov 8, 2026
CVE-2026-123528: go-vikunja vikunja: Vikunja before 2.7.1 contains an insufficient session expiration vulnerability that allows holders of revoked access…6.8 Medium7.6 HighN/ANov 8, 2026
CVE-2026-123527: go-vikunja vikunja: Vikunja from 2.4.0 before 2.7.1 contains an authorization bypass vulnerability that allows token holders to perform…5.4 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123526: go-vikunja vikunja: Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only…5.4 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123525: go-vikunja vikunja: Vikunja before 2.7.1 allocates memory without limits in its Trello, Todoist and Microsoft To Do migration importers,…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123524: go-vikunja vikunja: Vikunja from 0.23.0 before 2.7.1 contains an information disclosure vulnerability that allows project collaborators…5.7 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123523: go-vikunja vikunja: Vikunja before 2.7.1 contains an uncontrolled resource consumption vulnerability that allows authenticated users to…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123522: go-vikunja vikunja: Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-123521: go-vikunja vikunja: Vikunja before 2.7.1 contains an improper restriction of excessive authentication attempts vulnerability that allows…5.9 Medium6.0 MediumN/ANov 8, 2026
CVE-2026-123520: go-vikunja vikunja: Vikunja from 0.18.0 before 2.7.1 contains a privilege escalation vulnerability that allows team owners to gain admin or…7.1 High7.1 HighN/ANov 8, 2026
CVE-2026-123519: go-vikunja vikunja: Vikunja before 2.7.1 contains a denial of service vulnerability that allows authenticated users to exhaust API process…6.5 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123518: go-vikunja vikunja: Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123517: go-vikunja vikunja: Vikunja before 2.7.1 contains an information disclosure vulnerability that allows authenticated users to determine…4.3 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123516: go-vikunja vikunja: Vikunja before 2.7.1 contains a resource exhaustion vulnerability in the vikunja-file ZIP importer that allows…4.3 Medium7.1 HighN/ANov 8, 2026
CVE-2026-123515: go-vikunja vikunja: Vikunja before 2.7.1 contains a client-side request forgery vulnerability that allows users with write access to make…4.1 Medium5.1 MediumN/ANov 8, 2026
CVE-2026-123514: go-vikunja vikunja: Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned…4.3 Medium5.3 MediumN/ANov 8, 2026
CVE-2026-123513: go-vikunja vikunja: Vikunja before 2.7.1 contains a credential exposure vulnerability that allows attackers to steal stored auth tokens by…6.8 Medium7.6 HighN/ANov 8, 2026
CVE-2026-123512: go-vikunja vikunja: Vikunja before 2.7.1 embeds live password-reset, email-confirmation and account-deletion tokens in the URL query string…6.1 Medium8.4 HighN/ANov 8, 2026
276-300 of 422465
‹›