The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-49393: tinyhumansai openhuman: OpenHuman is an open-source agent harness available as a desktop application and Rust library8.4 HighN/A0%Nov 5, 2026
CVE-2026-120499: h5io: h5io before 0.2.6 contains a code injection vulnerability in read_hdf5() that allows attackers to execute arbitrary…7.8 High8.5 High0%Nov 5, 2026
CVE-2026-119083: AWS gluonts: Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted…7.8 High8.4 High0%Nov 5, 2026
CVE-2026-118517: sensiolabs symfony: The Symfony HtmlSanitizer component UrlSanitizer parses URLs differently from browsers, allowing the allowLinkHosts()…4.3 Medium2.3 Low0%Nov 5, 2026
CVE-2026-104867: immich-app immich: Immich is a high-performance self-hosted photo and video management solution4.3 MediumN/A0%Nov 5, 2026
CVE-2026-97847: Red Hat: A flaw was found in the protocol mapper and identity resolution components of Keycloak7.1 HighN/A0%Nov 5, 2026
CVE-2026-97174: Red Hat: A flaw was found in the Client-Initiated Backchannel Authentication (CIBA) implementation of Keycloak6.8 MediumN/A0%Nov 5, 2026
CVE-2026-96453: Red Hat: A flaw was found in the Keycloak Admin CLI kcadm tool, which is used by administrators to manage Keycloak servers from…8.0 HighN/A0%Nov 5, 2026
CVE-2026-93998: Red Hat: A flaw was found in the SAML adapter component of Keycloak, which is used to secure applications with SAML-based…7.4 HighN/A0%Nov 5, 2026
CVE-2026-92857: Red Hat: Keycloak provides a Dynamic Client Registration feature that allows users with specific tokens to register their own…8.1 HighN/A0%Nov 5, 2026
CVE-2026-92855: Red Hat: A flaw was found in the SAML identity broker component of Keycloak, which is used to delegate authentication to…7.4 HighN/A0%Nov 5, 2026
CVE-2026-120859: PyMoDAQ: PyMoDAQ before 4.4.13, and pymodaq_data, pymodaq_gui, and pymodaq_utils before 5.1.15, 5.2.x before 5.2.14, and 5.3.x…7.8 High8.5 High0%Nov 5, 2026
CVE-2026-82965: Red Hat: A flaw was found in the SAML implementation of Keycloak, an open-source identity and access management solution7.5 HighN/A0%Nov 5, 2026
CVE-2026-76077: esa asn1scc: ASN1SCC is an open source ASN.1 compiler for embedded systems8.1 HighN/A0%Nov 5, 2026
CVE-2026-75615: esa asn1scc: ASN1SCC is an open source ASN.1 compiler for embedded systems5.3 MediumN/A0%Nov 5, 2026
CVE-2026-111253: Red Hat Red Hat Hardened Images: A flaw was found in dnf5daemon-server6.6 MediumN/A0%Nov 5, 2026
CVE-2026-123158: OpenBSD OpenSSH: sshd in OpenSSH before 10.6p2 on Linux, when musl libc is used without PAM, lacks a workaround for a password…8.1 HighN/A1%Nov 5, 2026
CVE-2026-123125: sensiolabs symfony: The Symfony Validator component IpValidator incompletely classifies internal addresses in the filtered modes of the Ip…6.5 Medium6.3 Medium0%Nov 5, 2026
CVE-2026-122330: Blosc c-blosc2: Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in…5.5 Medium6.8 Medium0%Nov 5, 2026
CVE-2026-122326: Chevereto: Chevereto before 4.5.8 contains an authorization bypass vulnerability in the get-album-contents action of the /json…5.3 Medium6.9 Medium1%Nov 5, 2026
CVE-2026-121139: Rapid7 Metasploit Framework: The Rapid7 Metasploit msf-ws suffers from a missing authentication vulnerability whereby the REST API grants an…7.8 High7.3 High0%Nov 5, 2026
CVE-2026-119751: keywordrush Content Egg – Affiliate Product Importer & Price Comparison: Content Egg plugin for WordPress before 12.1.0 contains a broken access control vulnerability that allows…5.3 Medium6.9 Medium0%Nov 5, 2026
CVE-2026-119345: ultravioletrs cocos: Cocos AI is a confidential computing system for AIN/A7.2 High0%Nov 5, 2026
CVE-2026-115739: Trellix DLP on-prem extensions: Hard-coded Cryptographic Key vulnerability exists in the DLP on-prem extensions version 11.13.1 and earlier allows a…6.5 Medium6.0 Medium0%Nov 5, 2026
CVE-2026-102523: MariaDB server: MariaDB server is a community developed fork of MySQL server8.0 HighN/A1%Nov 5, 2026
651-675 of 425038
‹›