The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-126078: rails: Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML6.1 MediumN/AN/ANov 10, 2026
CVE-2026-126077: rails: Action Pack is a framework for handling and responding to web requests6.8 MediumN/AN/ANov 10, 2026
CVE-2026-126076: rails: Action Pack is a framework for handling and responding to web requests4.2 MediumN/AN/ANov 10, 2026
CVE-2026-126075: rails: Active Support is a collection of utility classes and standard library extensions used by Rails and other Ruby projects4.7 MediumN/AN/ANov 10, 2026
CVE-2026-126074: rails: Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record…4.3 MediumN/AN/ANov 10, 2026
CVE-2026-126073: rails: Action Pack is a framework for handling and responding to web requests4.8 MediumN/AN/ANov 10, 2026
CVE-2026-126072: rails: Action Pack is a framework for handling and responding to web requests5.9 MediumN/AN/ANov 10, 2026
CVE-2026-126071: rails: Active Storage makes it simple to upload and reference files in cloud services and attach those files to Active Record…5.3 MediumN/AN/ANov 10, 2026
CVE-2026-126070: rails: Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML6.1 MediumN/AN/ANov 10, 2026
CVE-2026-126069: rails: Action View is a framework for handling view template lookup and rendering and provides view helpers for building HTML4.7 MediumN/AN/ANov 10, 2026
CVE-2026-126068: rails: Action Mailbox routes incoming emails to controller-like mailboxes for processing in Rails3.7 LowN/AN/ANov 10, 2026
CVE-2026-126067: rails: Action Pack is a framework for handling and responding to web requests3.1 LowN/AN/ANov 10, 2026
CVE-2026-126066: NaturalIntelligence fast-xml-parser: fast-xml-parser allows users to process XML from JS object without C/C++ based libraries or callbacks3.7 LowN/AN/ANov 10, 2026
CVE-2026-126065: openobserve: OpenObserve is a cloud-native observability platform9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-126064: sparklemotion nokogiri: Nokogiri is an open source XML and HTML library for the Ruby programming languageN/A2.0 LowN/ANov 10, 2026
CVE-2026-126063: sparklemotion nokogiri: Nokogiri is an open source XML and HTML library for the Ruby programming languageN/A2.3 LowN/ANov 10, 2026
CVE-2026-120828: MongoDB MongoDB Server: A replica-set database server node does not limit or reclaim internal wait records created while handling a…7.5 High8.7 HighN/ANov 10, 2026
CVE-2026-120826: MongoDB MongoDB Server: An authorization flaw in the aggregation and view-definition handling of sharded deployments may allow a user holding…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-120825: MongoDB MongoDB Server: An authorization weakness in the aggregation framework of MongoDB Server may allow an authenticated user holding only…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-120824: MongoDB MongoDB Server: A use-after-free in the time-series collection component of MongoDB Server can occur when the server validates a…8.8 High8.7 HighN/ANov 10, 2026
CVE-2026-120823: MongoDB MongoDB Server: A missing authorization check in the aggregation framework of MongoDB Server may allow a user holding any valid…4.3 Medium2.3 LowN/ANov 10, 2026
CVE-2026-120822: MongoDB MongoDB Server: MongoDB Server may omit an authorization check on the resource that a replication-related administrative command…6.7 Medium8.6 HighN/ANov 10, 2026
CVE-2026-120821: MongoDB MongoDB Server: A use-after-free in the aggregation framework of MongoDB Server can occur when certain expressions are evaluated in an…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-120820: MongoDB MongoDB Server: MongoDB Server maintains an in-memory table of per-namespace statistics for operations that carry encrypted-field…4.3 Medium5.3 MediumN/ANov 10, 2026
CVE-2026-120819: MongoDB MongoDB Server: A memory-management flaw in the server-side JavaScript execution component of MongoDB Server can allow an authenticated…4.3 Medium5.3 MediumN/ANov 10, 2026
476-500 of 511254