The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-93570: Krajowa Izba Rozliczeniowa: Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injectionN/A8.2 HighN/AOct 29, 2026
CVE-2026-90991: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-90871: Progress Software WS_FTP Server: Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-90870: Progress Software WS_FTP Server: A missing release of backend receiver sessions in the Ad Hoc Transfer component of Progress Software WS_FTP Server…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-90869: Progress Software WS_FTP Server: A remote attacker who knows a valid account's enrolled SSH public key can terminate the shared SSH service in Progress…7.5 HighN/AN/AOct 29, 2026
CVE-2026-90862: Progress Software WS_FTP Server: Improper authentication in the Web Transfer Module of Progress Software WS_FTP Server versions prior to 2024.0.7 and…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-88078: Microsoft Microsoft Edge (Chromium-based): Improper verification of cryptographic signature in Microsoft Edge (Chromium-based) allows an unauthorized attacker to…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-85330: Microsoft Microsoft Edge (Chromium-based): Incorrect authorization in Microsoft Edge for Android allows an unauthorized attacker to bypass a security feature over…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-84294: Progress Software WS_FTP Server: Improper limitation of pathname in the Ad Hoc Transfer component of Progress Software WS_FTP Server versions prior to…7.7 HighN/AN/AOct 29, 2026
CVE-2026-77819: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.3 could allow a remote authenticated attacker to overwrite arbitrary files due to…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-77817: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to obtain sensitive information due…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-66912: Synacor Zimbra Collaboration: Zimbra is vulnerable to Stored Cross-Site Scripting (XSS) via the From email header during HTML reply composition in…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-66911: Synacor Zimbra Collaboration: Zimbra is vulnerable to stored cross-site scripting (XSS) via the Content-Location MIME header in email attachmentsN/A5.3 MediumN/AOct 29, 2026
CVE-2026-62131: Zoho Flow: Unauthenticated PHP Object Injection in Zoho Flow <= 2.14.5 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62018: ThemeREX Gunslinger: Unauthenticated PHP Object Injection in Gunslinger <= 1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62017: ThemeREX Good Homes: Unauthenticated PHP Object Injection in Good Homes <= 1.3.13 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62016: ThemeREX Gamic: Unauthenticated PHP Object Injection in Gamic <= 1.19 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62015: ThemeREX Gamezone: Unauthenticated PHP Object Injection in Gamezone <= 1.1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62014: ThemeREX EmojiNation: Unauthenticated PHP Object Injection in EmojiNation <= 1.0.12 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62013: ThemeREX Edge Decor: Unauthenticated PHP Object Injection in Edge Decor <= 2.9 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62012: ThemeREX Coinpress: Unauthenticated PHP Object Injection in Coinpress <= 1.0.15 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62011: ThemeREX Bonbon: Unauthenticated PHP Object Injection in Bonbon <= 1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62010: ThemeREX Avventure: Unauthenticated PHP Object Injection in Avventure <= 1.1.12 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62009: ThemeREX Filmax: Unauthenticated PHP Object Injection in Filmax <= 1.1.11 versions.9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-62008: ThemeREX Orpheus: Unauthenticated PHP Object Injection in Orpheus <= 1.8 versions.9.8 CriticalN/AN/AOct 29, 2026
301-325 of 538495