The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-126133: Mozilla Thunderbird: When a CalDAV or ICS calendar was accessed through an HTTP proxy that requested authentication, Thunderbird could…N/AN/AN/ANov 10, 2026
CVE-2026-126132: Mozilla Thunderbird: When a message was forwarded inline, edited as new, or had an attachment dragged into a compose window, a specially…N/AN/AN/ANov 10, 2026
CVE-2026-126087: AWS: Untrusted search path in the cross-user process launcher in Open Job Description (OpenJD) Sessions for Python before…8.8 High9.4 CriticalN/ANov 10, 2026
CVE-2026-125336: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript7.4 HighN/AN/ANov 10, 2026
CVE-2026-125335: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript3.7 LowN/AN/ANov 10, 2026
CVE-2026-125334: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript5.9 MediumN/AN/ANov 10, 2026
CVE-2026-125333: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript5.9 MediumN/AN/ANov 10, 2026
CVE-2026-125332: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript5.9 MediumN/AN/ANov 10, 2026
CVE-2026-125331: harnessrouter: HarnessRouter is a self-hosted unified API for running agent harnesses with sessions, streaming, files, cancellation,…9.1 CriticalN/AN/ANov 10, 2026
CVE-2026-125330: harnessrouter: HarnessRouter is a self-hosted unified API for agent harnesses7.5 HighN/AN/ANov 10, 2026
CVE-2026-125329: usekaneo kaneo: Kaneo is a project management application with boards, Gantt charts, and GitHub integration that can be self-hosted or…N/A8.4 HighN/ANov 10, 2026
CVE-2026-125328: pgEdge pgedge-go-llm-lib: pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries,…5.8 MediumN/AN/ANov 10, 2026
CVE-2026-125327: pgEdge pgedge-rag-server: pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector7.5 HighN/AN/ANov 10, 2026
CVE-2026-122475: Microsoft: Untrusted pointer dereference in Windows Storage Spaces Controller allows an unauthorized attacker to execute code over…8.8 HighN/AN/ANov 10, 2026
CVE-2026-122297: Microsoft: Use of uninitialized resource in Kernel Transaction Manager allows an authorized attacker to disclose information…5.5 MediumN/AN/ANov 10, 2026
CVE-2026-122183: Microsoft: Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-122182: Microsoft: Improper link resolution before file access ('link following') in Windows Maps allows an authorized attacker to elevate…7.0 HighN/AN/ANov 10, 2026
CVE-2026-122179: Microsoft: Heap-based buffer overflow in Windows Internet Connection Sharing (ICS) allows an authorized attacker to elevate…7.0 HighN/AN/ANov 10, 2026
CVE-2026-122177: Microsoft: Improper link resolution before file access ('link following') in Windows iSCSI allows an unauthorized attacker to…7.5 HighN/AN/ANov 10, 2026
CVE-2026-122176: Microsoft: Heap-based buffer overflow in Windows SMB allows an authorized attacker to execute code over a network.8.8 HighN/AN/ANov 10, 2026
CVE-2026-122175: Microsoft Windows 11 version 26H1: Use after free in Windows Autopilot allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-122174: Microsoft: Improper link resolution before file access ('link following') in Windows Task Scheduler allows an authorized attacker…7.0 HighN/AN/ANov 10, 2026
CVE-2026-122173: Microsoft: Heap-based buffer overflow in HID Parser Library allows an unauthorized attacker to elevate privileges with a physical…6.8 MediumN/AN/ANov 10, 2026
CVE-2026-122172: Microsoft: Use after free in Microsoft Trace Data Helper allows an authorized attacker to elevate privileges locally.7.8 HighN/AN/ANov 10, 2026
CVE-2026-122171: Microsoft: Heap-based buffer overflow in Microsoft XPS Document Converter allows an unauthorized attacker to execute code over a…8.8 HighN/AN/ANov 10, 2026
651-675 of 511254