The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123577: hickory-dns: Hickory DNS from 0.24.0 before 0.26.2 contains a resource exhaustion vulnerability that allows remote attackers to…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123576: hickory-dns: Hickory DNS 0.24.0 through 0.26.1 contains a memory exhaustion vulnerability that allows remote attackers to consume…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123575: hickory-dns: Hickory DNS before 0.26.2 contains a resource exhaustion vulnerability in its DNS-over-HTTPS HTTP/2 server that lacks…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123574: hickory-dns: The zone file parser in the hickory-proto crate of Hickory DNS 0.24.0 before 0.26.2 panics when a single token in a…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123573: hickory-dns: hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123572: hickory-dns: Hickory-dns from 0.20.1 before 0.26.2 contains a denial of service vulnerability in the hickory-proto SVCB and HTTPS…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123571: hickory-dns: Hickory DNS from 0.26.0 before 0.26.2 contains an integer underflow vulnerability in TSIG RDATA decoding that allows…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123570: hickory-dns: The DNS wire-format message parser in hickory-proto (Hickory DNS) 0.18 before 0.26.2 preallocates record vectors sized…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123569: sveltejs devalue: The devalue package for npm before 5.6.3 can consume excessive CPU and memory when serializing sparse arrays with…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123568: sveltejs devalue: Sveltejs devalue before 5.6.3 contains a prototype pollution vulnerability that allows attackers to alter object…4.4 Medium2.1 LowN/ANov 8, 2026
CVE-2026-123567: sveltejs devalue: Sveltejs devalue before 5.6.4 contains a prototype injection vulnerability that allows attackers to inject __proto__…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123566: sveltejs devalue: Sveltejs devalue before 5.9.3 contains a denial of service vulnerability that allows attackers to cause CPU…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123565: sveltejs devalue: Sveltejs devalue before 5.9.3 contains a resource exhaustion vulnerability where repeated primitive strings cause…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123564: sveltejs devalue: Sveltejs devalue from 1.0.0 before 5.9.3 contains a memory exhaustion flaw in uneval, whose generated code for sparse…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123563: sveltejs devalue: Devalue before 5.9.3 contains a validation bypass vulnerability that allows custom ArrayBuffer revivers to skip…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123562: sveltejs devalue: devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123561: sveltejs devalue: devalue before 5.9.3 allows malformed null-prototype object keys to bypass parse's __proto__ rejection through…3.7 Low6.3 MediumN/ANov 8, 2026
CVE-2026-123560: ZcashFoundation zebra: Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123559: ZcashFoundation zebra: Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123558: ZcashFoundation zebra: Zebra zebrad before 7.0.0 contains a denial of service vulnerability that allows a malicious peer to stall checkpoint…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123557: ZcashFoundation zebra: ZcashFoundation Zebra zebrad before 7.0.0 contains a reachable assertion race condition that allows unauthenticated…5.9 Medium8.2 HighN/ANov 8, 2026
CVE-2026-123556: ZcashFoundation zebra: ZcashFoundation Zebra from 4.5.0 before 7.0.0 contains a protection mechanism failure that bans honest peers by scoring…5.3 Medium6.9 MediumN/ANov 8, 2026
CVE-2026-123555: ZcashFoundation zebra: Zebra from 2.3.0 before 7.0.0 contains a denial of service vulnerability that allows unauthenticated peers to evade…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123554: ZcashFoundation zebra: Zebra zebrad 6.4.0 before 7.0.0 performs quadratic work in the mempool coinbase-maturity check because…7.5 High8.7 HighN/ANov 8, 2026
CVE-2026-123553: OpenIdentityPlatform OpenAM: OpenAM before 16.1.4 ships built-in identities in the Top Level Realm (demo, anonymous, wsc, wsp, SecurityTokenService…6.5 Medium6.9 MediumN/ANov 8, 2026
201-225 of 418627
‹›