The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119699: WPGraphQL WPGraphQL Smart Cache: WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119479: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119369: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119291: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno5.5 MediumN/AN/AOct 30, 2026
CVE-2026-119290: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.5 HighN/AN/AOct 30, 2026
CVE-2026-119289: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.1 HighN/AN/AOct 30, 2026
CVE-2026-119288: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.0 HighN/AN/AOct 30, 2026
CVE-2026-119287: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno8.0 HighN/AN/AOct 30, 2026
CVE-2026-118238: Tenda W18E: The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature…7.2 HighN/AN/AOct 30, 2026
CVE-2026-117184: n/a: An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a…N/AN/AN/AOct 30, 2026
CVE-2026-117183: n/a: A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape…N/AN/AN/AOct 30, 2026
CVE-2026-117182: n/a: An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0…N/AN/AN/AOct 30, 2026
CVE-2026-116407: Webba Plugins Webba Booking: Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-105456: Best Practical Solutions RT for Incident Response: RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that…N/A5.3 MediumN/AOct 30, 2026
CVE-2026-105455: Best Practical Solutions RT for Incident Response: RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident…N/A5.3 MediumN/AOct 30, 2026
CVE-2026-105454: Best Practical Solutions Request Tracker: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the linkN/A5.3 MediumN/AOct 30, 2026
CVE-2026-104615: SUSE Rancher: A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before…7.9 HighN/AN/AOct 30, 2026
CVE-2026-104067: Scribus: Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104066: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104065: Scribus: Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104064: Scribus: Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104063: Scribus: Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when…6.1 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-104062: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104061: Scribus: Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-93327: Google Cloud Application Integration: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…N/A9.4 CriticalN/AOct 30, 2026
276-300 of 418318