The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-100164: Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis: Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co7.5 HighN/AN/AOct 27, 2026
CVE-2026-90732: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0…4.9 MediumN/AN/AOct 27, 2026
CVE-2026-90731: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…4.9 MediumN/AN/AOct 27, 2026
CVE-2026-90730: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.5 MediumN/AN/AOct 27, 2026
CVE-2026-90729: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.7 MediumN/AN/AOct 27, 2026
CVE-2026-90728: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.3 MediumN/AN/AOct 27, 2026
CVE-2026-56084: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…5.8 MediumN/AN/AOct 27, 2026
CVE-2026-4337: PuMuKIT: Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user…N/A8.8 HighN/AOct 27, 2026
CVE-2026-41022: Eaton easySoft: Eaton easySoft improperly validates TLS certificates presented by easyE4 devices5.9 MediumN/AN/AOct 27, 2026
CVE-2026-41021: Eaton easyE4: Eaton easyE4 uses an insufficiently strong password policy7.5 HighN/AN/AOct 27, 2026
CVE-2026-41020: Eaton easyE4: Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to…7.5 HighN/AN/AOct 27, 2026
CVE-2026-13162: Hitachi Energy: An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute…N/A7.7 HighN/AOct 27, 2026
CVE-2026-117499: @fastify/session: @fastify/session is a session plugin for Fastify3.7 LowN/AN/AOct 27, 2026
CVE-2026-115408: Eclipse Foundation Eclipse KeyPont: In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions…5.5 MediumN/AN/AOct 27, 2026
CVE-2026-115216: Eclipse Foundation Eclipse ioFog: In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator…N/A9.1 CriticalN/AOct 27, 2026
CVE-2026-113644: Eclipse Foundation Eclipse ioFog: In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA…N/A5.5 MediumN/AOct 27, 2026
CVE-2026-112362: @fastify/express: @fastify/express is a Fastify plugin that runs Express middleware inside Fastify9.1 CriticalN/AN/AOct 27, 2026
CVE-2026-10756: Hitachi Energy TRO600 Series Firmware: TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access…N/A7.7 HighN/AOct 27, 2026
CVE-2026-10752: hwk-fr Advanced Custom Fields: Extended: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to,…4.8 MediumN/AN/AOct 27, 2026
CVE-2026-109995: wplakeorg Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode: The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 27, 2026
CVE-2026-106087: Hitachi Energy TRO600 Series Firmware: TRO600 contains an arbitrary file read vulnerabilityN/A8.7 HighN/AOct 27, 2026
CVE-2026-105323: Kulga Software and Telecommunications Limited Company Kulga News Software: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software…6.1 MediumN/AN/AOct 27, 2026
CVE-2026-102800: dj-extensions.com DJ-HelpfulArticles extension for Joomla: Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article…N/A8.7 HighN/AOct 27, 2026
CVE-2026-117541: darylldoyle svg-sanitizer: svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-117540: darylldoyle svg-sanitizer: svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that…7.5 High8.7 HighN/AOct 27, 2026
251-275 of 522616