The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123562: sveltejs devalue: devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when…7.5 High8.7 High0%Nov 8, 2026
CVE-2026-123558: ZcashFoundation zebra: Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint…7.5 High8.7 High0%Nov 8, 2026
CVE-2026-123554: ZcashFoundation zebra: Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because…7.5 High8.7 High0%Nov 8, 2026
CVE-2026-123550: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an authentication bypass vulnerability in its SAML v2.0 service provider that accepts…9.8 Critical9.3 Critical1%Nov 8, 2026
CVE-2026-123546: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 contains an open redirect and cross-site scripting vulnerability that allows remote attackers to…6.1 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123542: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 fails to enforce PKCE in the OAuth 2.0 device authorization flow, never validating the code…6.8 Medium7.6 High0%Nov 8, 2026
CVE-2026-123538: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 does not verify that a signed SAML 1.x assertion or response was signed by the partner named as…6.6 Medium7.5 High0%Nov 8, 2026
CVE-2026-123534: tornadoweb tornado: Tornado before 6.6 contains a path traversal vulnerability in RequestHandler.static_url() and get_version() that allows…6.5 Medium8.3 High0%Nov 8, 2026
CVE-2026-123526: go-vikunja vikunja: Vikunja before 2.7.1 contains a mass assignment vulnerability that allows any authenticated user to set the read-only…5.4 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123522: go-vikunja vikunja: Vikunja before 2.7.1 contains an authorization bypass vulnerability that allows authenticated users to read any task by…7.1 High7.1 High0%Nov 8, 2026
CVE-2026-123518: go-vikunja vikunja: Vikunja before 2.7.1 contains an incorrect authorization vulnerability in TaskBucket.CanUpdate, which checks write…4.3 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123514: go-vikunja vikunja: Vikunja before 2.7.1 contains an improper resource cleanup vulnerability that leaves full-data export archives orphaned…4.3 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123510: go-vikunja vikunja: Vikunja before 2.7.1 fails to re-anchor PluginsDir and LogPath to service.rootpath, allowing plugins to load from and…3.3 Low1.0 Low0%Nov 8, 2026
CVE-2026-123506: go-vikunja vikunja: Vikunja from 2.2.0 before 2.7.1 contains an authorization bypass vulnerability that allows holders of tokens scoped…5.4 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123502: go-vikunja vikunja: Vikunja before 2.7.1 contains an information exposure vulnerability that allows log readers to obtain link-share hashes…5.2 Medium6.9 Medium0%Nov 8, 2026
CVE-2026-123498: go-vikunja vikunja: Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to…3.7 Low2.1 Low0%Nov 8, 2026
CVE-2026-123494: go-vikunja vikunja: Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data…3.5 Low5.1 Medium0%Nov 8, 2026
CVE-2026-124422: jihong88 suneditor: SunEditor from 3.0.0 before 3.4.0 contains a stored cross-site scripting vulnerability in html.clean() that rebuilds…6.1 Medium5.3 Medium0%Nov 8, 2026
CVE-2026-123616: imgproxy: imgproxy from 3.3.0 before 4.0.16 contains an unbounded memory allocation vulnerability in the ICO loader that fails to…7.5 High8.7 High0%Nov 8, 2026
CVE-2026-123615: imgproxy: imgproxy 3.3.0 before 4.0.17 contains an out-of-bounds heap read and write in the ICO loader's BMP header…7.5 High8.7 High1%Nov 8, 2026
CVE-2026-123613: rustls: Rustls from 0.23.13 before 0.23.45 accepts TLS 1.3 handshake messages at the wrong encryption level when they follow a…5.3 Medium6.9 Medium0%Nov 8, 2026
CVE-2026-123612: rustls: rustls 0.23.44 and 0.23.45 contain an information disclosure vulnerability that sends application data buffered before…2.3 Low4.6 Medium0%Nov 8, 2026
CVE-2026-123611: rustls: rustls before 0.23.46 contains a key exchange downgrade vulnerability that allows network attackers to poison the…3.7 Low6.3 Medium0%Nov 8, 2026
CVE-2026-123609: rustls: Rustls before 0.23.46 and 0.24.0-dev.1 before 0.24.0-dev.2 contains an information disclosure vulnerability where…4.0 Medium4.1 Medium0%Nov 8, 2026
CVE-2026-123608: hickory-dns: Hickory DNS hickory-proto from 0.3.1 before 0.26.1 contains a denial of service vulnerability in BinEncoder that allows…7.5 High8.7 High0%Nov 8, 2026
401-425 of 418829
‹›