The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119710: pipeshub-ai: PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119709: goniszewski grimoire: Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata…5.8 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119708: colinin abp-next-admin: abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119707: SonicJs-Org sonicjs: SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…9.8 Critical9.3 CriticalN/AOct 30, 2026
CVE-2026-119705: towfiqi serpbear: SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119704: BastilleBSD bastille: Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that…6.8 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119703: xinnan-tech xiaozhi-esp32-server: xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that…4.8 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-119702: WPGraphQL: WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119701: WPGraphQL: WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119700: WPGraphQL: WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119699: WPGraphQL WPGraphQL Smart Cache: WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119479: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119369: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119291: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno5.5 MediumN/AN/AOct 30, 2026
CVE-2026-119290: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.5 HighN/AN/AOct 30, 2026
CVE-2026-119289: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.1 HighN/AN/AOct 30, 2026
CVE-2026-119288: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.0 HighN/AN/AOct 30, 2026
CVE-2026-119287: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno8.0 HighN/AN/AOct 30, 2026
CVE-2026-118238: Tenda W18E: The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature…7.2 HighN/AN/AOct 30, 2026
CVE-2026-117184: n/a: An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a…N/AN/AN/AOct 30, 2026
CVE-2026-117183: n/a: A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape…N/AN/AN/AOct 30, 2026
CVE-2026-117182: n/a: An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0…N/AN/AN/AOct 30, 2026
CVE-2026-116407: Webba Plugins Webba Booking: Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-105456: Best Practical Solutions RT for Incident Response: RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that…N/A5.3 MediumN/AOct 30, 2026
226-250 of 418318