The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-57500: opencloud-eu reva: REVA is an interoperability platform6.3 MediumN/AN/ANov 11, 2026
CVE-2026-126781: webmin: Webmin through 2.670 contains a users file injection vulnerability in acl/cert_issue.cgi that allows authenticated…7.5 High7.7 HighN/ANov 11, 2026
CVE-2026-126780: webmin: Webmin through 2.670 contains a privilege escalation vulnerability in acl/save_group.cgi that allows delegated…7.2 High8.6 HighN/ANov 11, 2026
CVE-2026-126779: spatie browsershot: Spatie Browsershot 2.2.0 before 5.5.0 contains a local file read vulnerability that allows attackers to read server…7.5 High8.7 HighN/ANov 11, 2026
CVE-2026-126778: ellite Wallos: Wallos 4.4.0 before 5.10.3 contains a stored cross-site scripting vulnerability in…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126777: Traccar: Traccar 3.15 before 6.17.0 contains an authentication bypass vulnerability in LdapProvider.login() that fails to reject…7.4 High9.1 CriticalN/ANov 11, 2026
CVE-2026-126776: siyuan-note siyuan: SiYuan 3.7.0 before 3.8.10 on Windows contains a path traversal vulnerability in kernel/util/webfetch.go that allows…5.3 Medium6.0 MediumN/ANov 11, 2026
CVE-2026-126775: python-social-auth social-auth-core: Social-auth-core 4.7.0 before 7.0.0 contains a login cross-site request forgery vulnerability in the SAML backend that…4.2 Medium2.3 LowN/ANov 11, 2026
CVE-2026-126774: tinacms @tinacms/mdx: @tinacms/mdx before 2.4.2 contains a code injection vulnerability in its MDX serializer, which writes rich-text values…8.2 High8.8 HighN/ANov 11, 2026
CVE-2026-126772: OpsTree Solutions REMS: OpsTree REMS through 1.0.0 contains an improper attribution vulnerability that allows authenticated users to post…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126771: OpsTree Solutions REMS: OpsTree REMS through 1.0.0 contains a stored cross-site scripting vulnerability that allows authenticated attackers to…5.4 Medium5.1 MediumN/ANov 11, 2026
CVE-2026-126770: OpsTree Solutions REMS: OpsTree REMS through 1.0.0 contains a server-side request forgery vulnerability that allows authenticated users to make…5.0 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126769: OpsTree Solutions REMS: OpsTree REMS through 1.0.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers…7.5 High8.7 HighN/ANov 11, 2026
CVE-2026-126768: OpsTree Solutions REMS: OpsTree REMS through 1.0.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to…9.8 Critical9.3 CriticalN/ANov 11, 2026
CVE-2026-126767: OpsTree Solutions REMS: OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126766: OpsTree Solutions REMS: OpsTree REMS through 1.0.0 contains an improper authorization vulnerability that allows authenticated users to set an…4.3 Medium5.3 MediumN/ANov 11, 2026
CVE-2026-126051: nodejs node: A deferred-callback use-after-destroy in Node.js TLS server handshake handling allows a remote, unauthenticated…7.5 HighN/AN/ANov 11, 2026
CVE-2026-123877: nodejs node: A certificate validation bypass in Node.js https.Agent lets a cached TLS session authenticated under one CA policy be…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-123875: nodejs node: A NULL pointer dereference in Node.js HTTP/2 lets an unauthenticated client crash the server, over both TLS and…5.9 MediumN/AN/ANov 11, 2026
CVE-2026-123874: nodejs node: A use-after-free in Node.js HTTP/2 lets an unauthenticated client corrupt server memory, over both TLS and cleartext,…7.5 HighN/AN/ANov 11, 2026
CVE-2026-123872: nodejs node: A client certificate authentication bypass in Node.js TLS lets a client change the servername during TLS 1.2…8.1 HighN/AN/ANov 11, 2026
CVE-2026-123871: nodejs node: Node.js discloses proxy credentials in ERR_PROXY_INVALID_CONFIG error messages6.2 MediumN/AN/ANov 11, 2026
CVE-2026-123868: nodejs node: An unauthenticated HTTP/2 client can exhaust Node.js server memory because inbound DATA queued on an undrained stream…5.9 MediumN/AN/ANov 11, 2026
CVE-2026-123867: nodejs node: A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a…4.2 MediumN/AN/ANov 11, 2026
CVE-2026-123866: nodejs node: A use-after-free in Node.js HTTP/2 stream teardown can leak response memory, including the contents of other…7.5 HighN/AN/ANov 11, 2026
176-200 of 511254