The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-125706: Red Hat, GStreamer: A flaw was found in GStreamer's gst-plugins-bad MPEG Program Stream demuxer and resindvd DVD-playback plugin5.5 MediumN/AN/ANov 10, 2026
CVE-2026-123717: Eclipse CSI otterdog: OS command injection in the pass and bitwarden credential providers in Eclipse Foundation Eclipse Otterdog through…N/A8.8 HighN/ANov 10, 2026
CVE-2026-121191: TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote: Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-remote allows…6.5 MediumN/AN/ANov 10, 2026
CVE-2026-120350: vaadin: The Vaadin Rich Text Editor exports a video embed without escaping its value, and then parses the resulting HTML into…N/A5.1 MediumN/ANov 10, 2026
CVE-2026-120326: vaadin: DownloadEvent.setFileName(String) in Vaadin Flow writes the download file name into the Content-Disposition header…N/A4.8 MediumN/ANov 10, 2026
CVE-2026-112137: Siemens: A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro…5.4 Medium5.1 MediumN/ANov 10, 2026
CVE-2026-112136: Siemens: A vulnerability has been identified in Mendix Studio Pro 11 (All versions >= V11.15.0 < V11.16.0), Mendix Studio Pro…8.8 High9.2 CriticalN/ANov 10, 2026
CVE-2026-109097: Siemens ROS#: A vulnerability has been identified in ROS# (All versions < V2.3.1)8.2 High8.6 HighN/ANov 10, 2026
CVE-2026-101275: pretix pretix-adyen: Our payment integration with Adyen did not properly validate payment status responsesN/A6.3 MediumN/ANov 10, 2026
CVE-2026-109830: Siemens meta-iot2050: A vulnerability has been identified in meta-iot2050 (All versions >= V01.03.01)7.3 High7.0 HighN/ANov 10, 2026
CVE-2026-125707: Red Hat, GStreamer: A flaw was found in GStreamer's MXF demuxer6.1 MediumN/AN/ANov 10, 2026
CVE-2026-95651: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to an unauthenticated GSS-TSIG keytab…7.5 HighN/AN/ANov 10, 2026
CVE-2026-95646: Zohocorp DDI Central: Zoho Corporation ManageEngine DDI Central versions 6500 and below are vulnerable to a Unicode-based command injection…8.0 HighN/AN/ANov 10, 2026
CVE-2026-125704: Red Hat: A use-after-free flaw was found in GStreamer core buffer value deserialization7.5 HighN/AN/ANov 10, 2026
CVE-2026-125703: Red Hat, GStreamer: A flaw was found in the GStreamer gst-plugins-bad MXF plugin5.5 MediumN/AN/ANov 10, 2026
CVE-2026-125672: Red Hat: A flaw was found in cockpit-storaged6.6 MediumN/AN/ANov 10, 2026
CVE-2026-120999: nerves-hub nerves_hub_web: Improper Authentication vulnerability in Google sign-in and email confirmation in nerves-hub nerves_hub_web allows an…N/A7.4 HighN/ANov 10, 2026
CVE-2026-120997: nerves-hub nerves_hub_web: Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in…N/A2.3 LowN/ANov 10, 2026
CVE-2026-120730: nerves-hub nerves_hub_web: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in the device API, device…N/A8.6 HighN/ANov 10, 2026
CVE-2026-120295: nerves-hub nerves_hub_web: Incorrect Authorization vulnerability in the devices page bulk move in nerves-hub nerves_hub_web allows an…N/A7.1 HighN/ANov 10, 2026
CVE-2026-120286: nerves-hub nerves_hub_web: Missing Authorization vulnerability in the device and deployment group pages in nerves-hub nerves_hub_web allows an…N/A5.3 MediumN/ANov 10, 2026
CVE-2026-119446: nerves-hub nerves_hub_web: Session Fixation vulnerability in the CLI login flow in nerves-hub nerves_hub_web allows an unauthenticated attacker to…N/A9.4 CriticalN/ANov 10, 2026
CVE-2026-124503: sooperset mcp-atlassian: A vulnerability was identified in sooperset mcp-atlassian up to 0.24.04.3 Medium2.1 Low1%Nov 10, 2026
CVE-2026-104619: PackageKit: Untrusted users could roll back security updates when using the PackageKit Zypp Backend before 1.4.1, allowing…7.8 HighN/A0%Nov 10, 2026
CVE-2026-60046: MB connect line, Helmholz: An unauthenticated remote attacker can perform password resets for any user with known username and email without rate…7.5 High8.7 High0%Nov 10, 2026
201-225 of 517528