The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-116152: ImageMagick: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the MAT decoder that fails to release allocated…5.3 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116150: ImageMagick: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust…3.1 Low2.3 LowN/AOct 25, 2026
CVE-2026-116149: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a stack-based buffer overflow in the handling of bzip2…8.1 High7.2 HighN/AOct 25, 2026
CVE-2026-116148: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains an injection vulnerability in the MVG encoder, which does…3.6 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116146: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release…3.7 Low6.3 MediumN/AOct 25, 2026
CVE-2026-116145: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-32 contains a security policy bypass caused by an incomplete fix for…3.9 Low1.8 LowN/AOct 25, 2026
CVE-2026-116144: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116142: ImageMagick: ImageMagick before 7.1.2-33 contains a heap buffer over-read vulnerability that allows attackers to read beyond…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116141: ImageMagick: ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade…5.3 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116140: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116139: WWBN AVideo: WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated…5.4 Medium5.1 MediumN/AOct 25, 2026
CVE-2026-116053: dbcli mycli: A weakness has been identified in dbcli mycli up to 2.29.4/2.30.15.3 Medium1.9 LowN/AOct 25, 2026
CVE-2026-116207: yeswiki: YesWiki 4.6.0 before 4.7.0 and 5.0.0-alpha1 before 5.0.0-alpha4 contains an unauthenticated SQL injection vulnerability…9.1 Critical8.8 HighN/AOct 25, 2026
CVE-2026-116203: yeswiki: YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes…6.1 Medium5.3 MediumN/AOct 25, 2026
CVE-2026-116199: grokability snipe-it: Snipe-IT before 8.6.3 contains an authentication bypass in GoogleAuthController::handleGoogleCallback, which logs in…8.1 High9.2 CriticalN/AOct 25, 2026
CVE-2026-116195: rclone: Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims…6.1 Medium7.0 HighN/AOct 25, 2026
CVE-2026-116191: rclone: Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116187: rclone: Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows…5.0 Medium6.1 MediumN/AOct 25, 2026
CVE-2026-116183: thorsten phpMyFAQ: phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116179: vllm-project vllm: vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116175: vllm-project vllm: vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path…6.5 Medium7.1 HighN/AOct 25, 2026
CVE-2026-116171: siyuan-note siyuan: SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116167: siyuan-note siyuan: SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page…6.8 Medium7.6 HighN/AOct 25, 2026
CVE-2026-116163: parse-community parse-server: Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the…7.4 High9.1 CriticalN/AOct 25, 2026
CVE-2026-116159: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision…3.3 Low4.8 MediumN/AOct 25, 2026
351-375 of 546512
‹›