The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-107052: n/a: Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized…7.5 HighN/AN/AOct 29, 2026
CVE-2026-107051: n/a: Insecure permissions in klassm AndFHEM v2.4.1 (versionCode 241, the verified build) allows unauthorized attackers to…N/AN/AN/AOct 29, 2026
CVE-2026-107050: n/a: An issue in libretro RetroArch v1.22.2 allows attackers to force another user into loading attacker-supplied code in…N/AN/AN/AOct 29, 2026
CVE-2026-107049: n/a: An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via…N/AN/AN/AOct 29, 2026
CVE-2026-107048: n/a: An issue in the WebView rendering path component of MotionCreative Motion UI versionCode 101 allows attackers to…N/AN/AN/AOct 29, 2026
CVE-2026-107047: n/a: Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the…7.5 HighN/AN/AOct 29, 2026
CVE-2026-107046: n/a: A Server-Side Request Forgery (SSRF) in the url/title/author/coverUrl component of FocusPodcast versionCode 70allows…N/AN/AN/AOct 29, 2026
CVE-2026-107045: n/a: Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized…N/AN/AN/AOct 29, 2026
CVE-2026-107044: n/a: Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily…N/AN/AN/AOct 29, 2026
CVE-2026-107043: n/a: Insecure permissions in Code Catcher versionCode 131 allow unauthorized attackers to arbitrarily manipulate the app's…N/AN/AN/AOct 29, 2026
CVE-2025-12523: Centreon: Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user6.5 MediumN/AN/AOct 29, 2026
CVE-2023-7357: Revera FlexNet Publisher: A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interfaceN/A8.6 HighN/AOct 29, 2026
CVE-2026-115805: Rapid7 Insight Agent: Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local…7.8 HighN/AN/AOct 29, 2026
CVE-2026-96187: Microsoft Microsoft Edge (Chromium-based): Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized…7.4 HighN/AN/AOct 29, 2026
CVE-2026-93571: Krajowa Izba Rozliczeniowa Szafir: Szafir is vulnerable to Path Traversal in the uploaded filenameN/A2.3 LowN/AOct 29, 2026
CVE-2026-93570: Krajowa Izba Rozliczeniowa: Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injectionN/A8.2 HighN/AOct 29, 2026
CVE-2026-90991: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-90871: Progress Software WS_FTP Server: Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-90870: Progress Software WS_FTP Server: A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-90869: Progress Software WS_FTP Server: A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress…7.5 HighN/AN/AOct 29, 2026
CVE-2026-90862: Progress Software WS_FTP Server: Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-88078: Microsoft Microsoft Edge (Chromium-based): Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-85330: Microsoft Microsoft Edge (Chromium-based): Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-84294: Progress Software WS_FTP Server: Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to…7.7 HighN/AN/AOct 29, 2026
CVE-2026-77819: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to…6.5 MediumN/AN/AOct 29, 2026
301-325 of 548327