The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
Red Hat: CVE-2026-114613: msgpack: msgpack: Denial of Service via memory leak during map deserialization7.5 HighN/A0%Oct 22, 2026
CVE-2026-114612: BerriAI litellm: LiteLLM is a proxy server (AI Gateway) to call LLM APIs in OpenAI (or native) format9.9 CriticalN/A0%Oct 22, 2026
CVE-2026-114519: Roskus Prospero Flow CRM: Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with…N/A8.6 High0%Oct 22, 2026
CVE-2026-113876: SmileCDR HAPI FHIR: SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-113875: SmileCDR HAPI FHIR: On a SmileCDR HAPI FHIR server with REST-hook subscriptions enabled, if a user is granted subscription-creation…3.1 Low2.3 Low0%Oct 22, 2026
CVE-2025-69723: n/a: A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary…6.1 MediumN/A0%Oct 22, 2026
CVE-2026-115508: unclecode crawl4ai: Crawl4AI 0.7.0 before 0.9.5 contains an inefficient regular expression complexity vulnerability in the Docker API…6.5 Medium7.1 High0%Oct 22, 2026
CVE-2026-115504: HEASARC cfitsio: CFITSIO through 4.7.0 contains an out-of-bounds write vulnerability in ffgcls2() in getcols.c that trusts…7.8 High8.5 High0%Oct 22, 2026
CVE-2026-115396: NationalSecurityAgency ghidra: Ghidra 10.3 before 12.2 contains an improper handling of highly compressed data vulnerability in…5.5 Medium6.8 Medium0%Oct 22, 2026
CVE-2026-115392: bytecodealliance wasmtime: Wasmtime before 24.0.13, 25.0.0 before 36.0.14, 37.0.0 before 46.0.3, and 47.0.0 before 47.0.4 allows a filesystem…7.9 High8.8 High0%Oct 22, 2026
CVE-2026-115388: bytecodealliance wasmtime: wasmtime-wasi-http in Wasmtime before 36.0.16, 37.0.0 before 48.0.3, and 49.0.0 before 49.0.1 does not enforce the…6.2 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-115384: bytecodealliance wasmtime: Wasmtime 39.0.0 before 48.0.4 and 49.0.0 before 49.0.2 contains a stack buffer overflow vulnerability that allows…9.9 Critical9.4 Critical0%Oct 22, 2026
CVE-2026-114645: MongoDB C Driver: A 32-bit integer wraparound in the MongoDB C Driver's Windows-only Kerberos/SSPI authentication code can cause an…5.2 Medium5.7 Medium0%Oct 22, 2026
CVE-2026-115376: lxc incus: Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows…7.7 High8.3 High0%Oct 22, 2026
CVE-2026-115372: lxc incus: Incus from 7.3.0 before 7.5.0 contains a project restriction bypass that allows restricted project users to set…8.5 High9.0 Critical0%Oct 22, 2026
CVE-2026-115362: openbao: OpenBao before 2.6.4 and 2.7.x before 2.7.1 does not check Secret ID expiration at use in the AppRole auth method,…2.2 Low2.1 Low0%Oct 22, 2026
CVE-2026-115358: openbao: OpenBao before 2.6.3 contains an information disclosure vulnerability that allows attackers to leak sensitive data into…2.0 Low2.0 Low0%Oct 22, 2026
CVE-2026-115354: lepture mistune: Mistune before 3.3.0 contains a path traversal vulnerability in the opt-in Include directive that allows attackers to…6.5 Medium7.1 High0%Oct 22, 2026
CVE-2026-115350: lepture mistune: Mistune before 3.3.0 contains a cross-site scripting vulnerability in the Include directive that emits included .html,…6.1 Medium5.3 Medium0%Oct 22, 2026
CVE-2022-51026: Authentication Bypass by Spoofing9.8 Critical9.3 Critical1%Oct 22, 2026
CVE-2026-97635: Agent Zero: The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads8.1 High8.6 High0%Oct 22, 2026
CVE-2026-93336: Canonical Juju: Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a…N/A7.1 High0%Oct 22, 2026
CVE-2026-77157: Missing Support for Integrity Check6.4 Medium6.3 Medium0%Oct 22, 2026
CVE-2026-77156: Checkmarx github.com/checkmarx/ast-cli: Incomplete validation of extracted archive entry paths in ast-cli's tar extraction logic on Linux and macOS (used when…6.4 Medium6.3 Medium0%Oct 22, 2026
CVE-2026-54532: CloudPirates-io helm-charts: CloudPirates Open Source Helm Charts is a collection of Helm charts6.9 MediumN/A0%Oct 22, 2026
3101-3125 of 413066