The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-107019: n/a: Insecure permissions in the feiertage.ImportActivity component of Arbeitszeiterfassung2 versionCode 159 allows…N/AN/AN/AOct 29, 2026
CVE-2026-107018: n/a: Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read…N/AN/AN/AOct 29, 2026
CVE-2026-107017: n/a: Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers…N/AN/AN/AOct 29, 2026
CVE-2026-107016: n/a: Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.N/AN/AN/AOct 29, 2026
CVE-2026-107015: n/a: Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in…N/AN/AN/AOct 29, 2026
CVE-2026-107014: n/a: Insecure permissions in Bander Notepad (bander.notepad) versionCode 12 allow unauthorized attackers to write and read…N/AN/AN/AOct 29, 2026
CVE-2026-93010: Red Hat: A flaw was found in dnsmasq4.3 MediumN/AN/AOct 29, 2026
CVE-2026-93009: Red Hat: A flaw was found in dnsmasq4.3 MediumN/AN/AOct 29, 2026
CVE-2026-79589: n/a: The WIFI4 N300 router (Model: T1 Pro) v1.0.0 by U-speed contains an insecure access control flaw that allows an…N/AN/AN/AOct 29, 2026
CVE-2026-54862: Codection Import and export users and customers: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codection Import…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-48202: Brave: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brave Brave…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-48195: bPlugins PDF Poster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins PDF…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-42707: HivePress HivePress Claim Listings: Missing Authorization vulnerability in HivePress HivePress Claim Listings hivepress-claim-listings allows Exploiting…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-39782: Kaliforms Kali Forms: Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-39736: Crocoblock JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock…8.5 HighN/AN/AOct 29, 2026
CVE-2026-25467: ThemeGrill User Registration: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in ThemeGrill User…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-119054: Themeisle Multiple Pages Generator by Themeisle: Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows…5.4 Medium5.1 MediumN/AOct 29, 2026
CVE-2026-119053: lwIP: lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119052: ggml-org llama.cpp: llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows…7.5 High8.7 HighN/AOct 29, 2026
CVE-2026-119051: hughsk flat: flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to…5.9 Medium8.2 HighN/AOct 29, 2026
CVE-2026-119050: agno-agi agno: Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke…8.1 High9.2 CriticalN/AOct 29, 2026
CVE-2026-119049: idinging FreeMail: FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another…7.6 High7.2 HighN/AOct 29, 2026
CVE-2026-119048: thinkgem JeeSite: JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that…4.2 Medium2.3 LowN/AOct 29, 2026
CVE-2026-118425: Red Hat: A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management…6.8 MediumN/AN/AOct 29, 2026
CVE-2026-116857: Crocoblock JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/AOct 29, 2026
301-325 of 538495