The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-125074: SourceCodester Smart Attendance System with QR Code Scanner: A flaw has been found in SourceCodester Smart Attendance System with QR Code Scanner 1.07.3 High6.9 Medium0%Nov 9, 2026
CVE-2026-125120: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment9.8 CriticalN/A1%Nov 9, 2026
CVE-2026-125119: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment7.5 HighN/A1%Nov 9, 2026
CVE-2026-125118: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment6.5 MediumN/A0%Nov 9, 2026
CVE-2026-124035: Amazon amazon-braket-schemas: Unsafe reflection in the error mitigation schema validation in Amazon Braket Schemas before 1.32.2 might allow a remote…7.1 High7.5 High1%Nov 9, 2026
CVE-2026-124034: AWS amazon-braket-sdk: Relative path traversal in the local hybrid job input data download in Amazon Braket SDK before 1.127.7 might allow a…6.4 Medium5.9 Medium0%Nov 9, 2026
CVE-2026-125117: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment8.2 HighN/A1%Nov 9, 2026
CVE-2026-125116: Automattic mongoose: Mongoose is a MongoDB object modeling tool designed to work in an asynchronous environment4.8 MediumN/A0%Nov 9, 2026
CVE-2026-115864: Memory Allocation with Excessive Size ValueN/AN/A0%Nov 9, 2026
CVE-2026-113970: Undefined Security Weakness8.8 HighN/A0%Nov 9, 2026
CVE-2026-125115: novuhq, @novu: Novu provides an API for sending notifications through multiple channels6.8 MediumN/A0%Nov 9, 2026
CVE-2026-125114: novuhq novu: Novu provides an API for sending notifications through multiple channelsN/A8.3 High0%Nov 9, 2026
CVE-2026-125113: xrootd: The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data…5.3 MediumN/A0%Nov 9, 2026
CVE-2026-125112: djust-org djust: djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performanceN/A2.3 Low0%Nov 9, 2026
CVE-2026-90591: zephyrproject zephyr: The NXP ENET-QOS Ethernet driver's receive work handler eth_nxp_enet_qos_rx() in drivers/ethernet/eth_nxp_enet_qos…7.5 HighN/A0%Nov 9, 2026
CVE-2026-90590: zephyrproject zephyr: The NXP ENET QoS Ethernet driver in drivers/ethernet/eth_nxp_enet_qos serialises transmission with a binary semaphore,…6.5 MediumN/A0%Nov 9, 2026
CVE-2026-90589: zephyrproject zephyr: When CONFIG_THREAD_STACK_MEM_MAPPED is enabled, each thread stack is mapped into the kernel virtual address space with…5.5 MediumN/A0%Nov 9, 2026
CVE-2026-90588: zephyrproject zephyr: The HTTP client's debug helper print_header_field() in subsys/net/lib/http/http_client.c formatted an http_parser…3.7 LowN/A0%Nov 9, 2026
CVE-2026-90587: zephyrproject zephyr: usbh_device_init() in subsys/usb/host/usbh_device.c rejects a device whose device descriptor advertises…4.6 MediumN/A0%Nov 9, 2026
CVE-2026-90586: zephyrproject zephyr: The Xtensa MMU userspace port never initialized the per-thread page-table pointer thread->arch.ptables during thread…7.8 HighN/A0%Nov 9, 2026
CVE-2026-90585: zephyrproject zephyr: The Renesas RA SCI UART driver's receive-error ISR, uart_ra_sci_eri_isr() in drivers/serial/uart_renesas_ra_sci.c,…4.6 MediumN/A0%Nov 9, 2026
CVE-2026-125111: rack: Rack is a modular Ruby web server interface7.5 HighN/A0%Nov 9, 2026
CVE-2026-125110: rack: Rack is a modular Ruby web server interface5.3 MediumN/A0%Nov 9, 2026
CVE-2026-124999: n/a braindecode: A security vulnerability has been detected in braindecode up to 1.8.26.3 Medium5.3 Medium0%Nov 9, 2026
CVE-2026-125109: rack: Rack is a modular Ruby web server interface4.8 MediumN/A0%Nov 9, 2026
401-425 of 517528