The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-104592: n/a: libosmocore through 1.14.1 contains an out-of-bounds read in the CBSP WRITE-REPLACE decoder in src/gsm/cbsp.cN/AN/AN/AOct 26, 2026
CVE-2026-104591: n/a: libosmocore through 1.14.1 contains a buffer overflow in osmo_iuup_compute_payload_crc() in src/gsm/iuup.cN/AN/AN/AOct 26, 2026
CVE-2026-81509: nosduco nforwardauth: nforwardauth is a forward auth service that allows the use of a single authentication middleware for multiple sites6.1 MediumN/AN/AOct 26, 2026
CVE-2026-72758: NLnet Labs Routinator: When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the…7.5 HighN/AN/AOct 26, 2026
CVE-2026-72757: NLnet Labs Routinator: Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-72756: NLnet Labs Routinator: Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as…7.5 HighN/AN/AOct 26, 2026
CVE-2026-72755: NLnet Labs Routinator: Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a…3.8 LowN/AN/AOct 26, 2026
CVE-2026-72754: NLnet Labs Routinator: When Routinator encounters a CRL with many entries, it may hang or run out of memory7.5 HighN/AN/AOct 26, 2026
CVE-2026-72753: NLnet Labs Routinator: When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed,…8.2 HighN/AN/AOct 26, 2026
CVE-2026-72752: NLnet Labs Routinator: Routinator runs out of memory when the JSON output is requested many times concurrently6.5 MediumN/AN/AOct 26, 2026
CVE-2026-70379: WolfVision: When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an…6.5 Medium7.1 HighN/AOct 26, 2026
CVE-2026-50096: Esri ArcGIS Server: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may…6.1 MediumN/AN/AOct 26, 2026
CVE-2026-50095: Esri ArcGIS Server: There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some…6.1 MediumN/AN/AOct 26, 2026
CVE-2026-33522: Esri ArcGIS Server: Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata5.3 MediumN/AN/AOct 26, 2026
CVE-2026-33521: Esri ArcGIS Server: There is s denial of service vulnerability in Esri ArcGIS Server versions 12.0 and prior that may allow a remote,…7.5 HighN/AN/AOct 26, 2026
CVE-2026-33520: Esri ArcGIS Server: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may…6.1 MediumN/AN/AOct 26, 2026
CVE-2026-116634: cheaper-inference OmniRoute: OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to…5.9 Medium8.2 HighN/AOct 26, 2026
CVE-2026-116463: FastStone Image Viewer: A vulnerability was identified in FastStone Image Viewer up to 8.56.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116461: Omega Solution Restro POS: A vulnerability was determined in Omega Solution Restro POS up to 202610264.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116408: WP Chill Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116400: bPlugins Button Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116398: bPlugins Content Slider Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116385: Bdtask Garage 24 Garage Management Software: A security vulnerability has been detected in Bdtask Garage 24 Garage Management Software 1.03.5 Low2.0 LowN/AOct 26, 2026
CVE-2026-115966: bPlugins Typing Text – Give your texts many typing effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115923: backstage: Backstage is an open framework for building developer portals6.5 MediumN/AN/AOct 26, 2026
376-400 of 416032