The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-20183: Cisco Cisco Identity Services Engine Software: A vulnerability in the web-based management interface of Cisco Identity Services Engine (ISE) could allow an…4.3 MediumN/AN/ANov 10, 2026
CVE-2026-126261: Fortinet FortiManager: A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager…9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-126187: react: React is a JavaScript library for building user interfacesN/A9.5 CriticalN/ANov 10, 2026
CVE-2026-123084: Red Hat: An **expression language injection** has been found in the HeaderContentGuard.permit function in publication.py of the…6.5 MediumN/AN/ANov 10, 2026
CVE-2026-0480: AMD: Missing Authentication for Critical Function in AMD Secure Encrypted Virtualization (SEV) firmware could allow a…N/A6.0 MediumN/ANov 10, 2026
CVE-2026-0454: AMD: An out-of-bounds write in the AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious hypervisor to…N/A4.6 MediumN/ANov 10, 2026
CVE-2026-0435: AMD: Operation on a resource after expiration or release in the AMD Secure Encrypted Virtualization (SEV) firmware could…N/A6.0 MediumN/ANov 10, 2026
CVE-2026-0003: AMD: Use of a per-part static key in the ASP Bootloader could allow an attacker to downgrade the Secure Encrypted…N/A5.9 MediumN/ANov 10, 2026
CVE-2025-48504: AMD: Operation on a resource after expiration or release in the Secure Encrypted Virtualization (SEV) firmware could allow a…N/A6.8 MediumN/ANov 10, 2026
CVE-2025-29941: AMD: Incorrect usage of seeds in pseudo-random number generator in the Secure Encrypted Virtualization (SEV) firmware could…N/A6.0 MediumN/ANov 10, 2026
CVE-2025-0008: AMD: Insufficient verification of data authenticity may allow a local attacker to bypass Secure Debug Unlock (SDU),…N/A8.4 HighN/ANov 10, 2026
CVE-2024-36309: AMD: Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally…N/A4.6 MediumN/ANov 10, 2026
CVE-2026-96437: Kong Inc. Kong Gateway Enterprise: The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the…N/A8.2 HighN/ANov 10, 2026
CVE-2026-92558: Kong Inc.: The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator…N/A6.3 MediumN/ANov 10, 2026
CVE-2026-92545: Kong Inc.: The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request…N/A8.7 HighN/ANov 10, 2026
CVE-2026-92443: Kong Inc.: The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying…N/A8.2 HighN/ANov 10, 2026
CVE-2026-92442: Kong Inc.: The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key,…N/A8.3 HighN/ANov 10, 2026
CVE-2026-92441: Kong Inc.: Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the…N/A7.8 HighN/ANov 10, 2026
CVE-2026-92439: Kong Inc.: The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for…N/A7.8 HighN/ANov 10, 2026
CVE-2026-91000: N-able N-central: Missing authentication for critical function vulnerability in N-able N-central allows Privilege EscalationN/A8.4 HighN/ANov 10, 2026
CVE-2026-90834: zephyrproject zephyr: The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the…5.5 MediumN/AN/ANov 10, 2026
CVE-2026-90833: zephyrproject zephyr: The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with…7.8 HighN/AN/ANov 10, 2026
CVE-2026-90832: zephyrproject zephyr: bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and…4.3 MediumN/AN/ANov 10, 2026
CVE-2026-89324: XTemos Basel Post Types: The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,…9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-87042: zephyrproject zephyr: The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received…6.5 MediumN/AN/ANov 10, 2026
1-25 of 557027
›