The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-50204: Apache Software Foundation Apache Airflow: Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because…N/AN/AN/ANov 9, 2026
CVE-2026-68982: Apache Software Foundation Apache Airflow: Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without…N/AN/AN/ANov 9, 2026
CVE-2026-76185: Apache Software Foundation Apache Airflow Task SDK: Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters,…N/AN/AN/ANov 9, 2026
CVE-2026-86829: Apache Software Foundation Apache Airflow: Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependenciesN/AN/AN/ANov 9, 2026
CVE-2026-82337: Apache Software Foundation Apache Airflow: Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class…N/AN/AN/ANov 9, 2026
CVE-2026-86468: Apache Software Foundation Apache Airflow: Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported…N/AN/AN/ANov 9, 2026
CVE-2026-96285: Apache Software Foundation Apache Airflow: Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a…N/AN/AN/ANov 9, 2026
CVE-2026-113508: Apache Software Foundation Apache Airflow: Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during…N/AN/AN/ANov 9, 2026
CVE-2026-124588: huggingface finetrainers: A security flaw has been discovered in huggingface finetrainers 0.1.0/0.2.06.3 Medium5.3 MediumN/ANov 9, 2026
CVE-2026-101031: Apache Software Foundation Apache Airflow: The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with…N/AN/AN/ANov 9, 2026
CVE-2026-92683: Neo4j @neo4j/graphql: Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions…N/A8.6 HighN/ANov 9, 2026
CVE-2026-124587: elizaOS eliza: A vulnerability was identified in elizaOS eliza 2.0.3-beta.74.3 Medium5.3 MediumN/ANov 9, 2026
CVE-2026-113504: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered…N/AN/AN/ANov 9, 2026
CVE-2026-107474: Apache Software Foundation Apache Airflow: The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed…N/AN/AN/ANov 9, 2026
CVE-2026-111395: Apache Software Foundation Apache Airflow: Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`N/AN/AN/ANov 9, 2026
CVE-2026-94249: TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk: Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows…8.1 HighN/AN/ANov 9, 2026
CVE-2026-92606: TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer: Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research…6.0 MediumN/AN/ANov 9, 2026
CVE-2026-124585: Chengdu Feiyuxing Technology: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r117759.9 Critical8.6 HighN/ANov 9, 2026
CVE-2026-124584: wummel patool: A vulnerability has been found in wummel patool 4.1.04.4 Medium4.8 MediumN/ANov 9, 2026
CVE-2026-124582: n/a WebTorrent: A vulnerability was identified in WebTorrent up to 2.8.5/3.0.214.3 Medium2.1 LowN/ANov 9, 2026
CVE-2026-124581: itsourcecode Airline Reservation System: A vulnerability was determined in itsourcecode Airline Reservation System 1.07.3 High5.5 MediumN/ANov 9, 2026
CVE-2026-123870: Eclipse Foundation otterdog: The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval()N/A9.5 CriticalN/ANov 9, 2026
CVE-2026-116337: qt Qt Framework: Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt…N/A0.6 LowN/ANov 9, 2026
CVE-2026-124637: Kompini Tankuam Places: A stored Cross-Site Scripting (XSS) vulnerability was identified in the profile editing form, in the parameters: cliNom…N/A5.3 MediumN/ANov 9, 2026
CVE-2026-111421: Apache Software Foundation Apache Airflow: Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied…N/AN/AN/ANov 9, 2026
1-25 of 418829
›