The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116196: rclone: Rclone before v1.75.2 contains a credential exposure vulnerability in the b2 backend that leaks the live account…5.3 Medium6.0 MediumN/AOct 25, 2026
CVE-2026-116195: rclone: Rclone before 1.75.2 contains a path traversal vulnerability in the local backend's translateLink function, which trims…6.1 Medium7.0 HighN/AOct 25, 2026
CVE-2026-116194: rclone: Rclone from 1.52.0 before 1.75.2 contains a cross-site request forgery vulnerability in the pCloud backend's localhost…6.8 Medium7.6 HighN/AOct 25, 2026
CVE-2026-116193: rclone: Rclone from 1.64.0 before 1.75.2 contains an authentication bypass vulnerability in serve webdav that lets…5.3 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116192: rclone: rclone from 1.37 before 1.74.2 contains a server-side request forgery vulnerability that allows unauthenticated…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116191: rclone: Rclone before 1.75.2 contains a path traversal vulnerability in serve webdav that allows unauthenticated attackers to…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116190: rclone: rclone from v1.56.0 before v1.75.2 contains an information disclosure vulnerability in the WebDAV backend that forwards…3.7 Low6.3 MediumN/AOct 25, 2026
CVE-2026-116189: rclone: rclone from 1.55.0 before 1.75.2 contains a signature verification bypass in stable selfupdate that trusts checksums…7.5 High7.7 HighN/AOct 25, 2026
CVE-2026-116188: rclone: rclone serve s3 versions 1.75.0 before 1.75.2 contain an integer overflow vulnerability in multipart reorder-memory…5.3 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116187: rclone: Rclone from v1.68.0 before v1.75.2 contains an authorization bypass vulnerability in serve s3 --auth-proxy that allows…5.0 Medium6.1 MediumN/AOct 25, 2026
CVE-2026-116186: openremote core: OpenRemote core (openremote-manager) before 1.31.0 does not perform realm or gateway-descendant authorization on…N/A2.3 LowN/AOct 25, 2026
CVE-2026-116185: openremote core: OpenRemote core before 1.31.0 contains an authorization bypass vulnerability that allows authenticated users to read…5.0 Medium5.3 MediumN/AOct 25, 2026
CVE-2026-116184: openremote core: OpenRemote before 1.31.0 contains an authorization bypass vulnerability that allows realm admins to impersonate…N/A2.1 LowN/AOct 25, 2026
CVE-2026-116183: thorsten phpMyFAQ: phpMyFAQ before 4.1.10 contains an object-level authorization bypass vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116182: thorsten phpMyFAQ: phpMyFAQ before 4.1.10 contains a server-side request forgery vulnerability in the PDF export feature that fetches…5.0 Medium5.3 MediumN/AOct 25, 2026
CVE-2026-116181: vllm-project vllm: vLLM from 0.20.1 before 0.29.0 contains an improper input validation vulnerability that allows remote attackers to…6.5 Medium7.1 HighN/AOct 25, 2026
CVE-2026-116179: vllm-project vllm: vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116177: vllm-project vllm: vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116176: vllm-project vllm: vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force…8.2 High8.8 HighN/AOct 25, 2026
CVE-2026-116175: vllm-project vllm: vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path…6.5 Medium7.1 HighN/AOct 25, 2026
CVE-2026-116174: vllm-project vllm: vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116172: vllm-project vllm: vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116171: siyuan-note siyuan: SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116170: siyuan-note siyuan: SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by…4.9 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116169: siyuan-note siyuan: SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit…5.4 Medium5.1 MediumN/AOct 25, 2026
401-425 of 416032