The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-115919: onnx: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability6.2 MediumN/AN/AOct 26, 2026
CVE-2026-115918: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115917: vllm-project vllm: vLLM is an inference and serving engine for large language models3.4 LowN/AN/AOct 26, 2026
CVE-2026-115916: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115915: vllm-project vllm: vLLM is an inference and serving engine for large language models8.1 HighN/AN/AOct 26, 2026
CVE-2026-115914: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115804: HashiCorp: HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may…6.4 MediumN/AN/AOct 26, 2026
CVE-2026-112839: VillaTheme Customer Coupons for WooCommerce: Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows…4.3 MediumN/AN/AOct 26, 2026
CVE-2026-111404: VillaTheme Photo Reviews for WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme…3.7 LowN/AN/AOct 26, 2026
CVE-2026-10757: Esri ArcGIS Server: There is a SQL injection vulnerability in Esri ArcGIS Server versions 12.1 and earlier on Windows and Linux that may…9.8 CriticalN/AN/AOct 26, 2026
CVE-2026-105765: HashiCorp: HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's…7.5 HighN/AN/AOct 26, 2026
CVE-2026-105626: HashiCorp: HashiCorp Consul and Consul Enterprise are vulnerable to a denial of service in the HTTP API that may allow an…7.5 HighN/AN/AOct 26, 2026
CVE-2026-105608: HashiCorp: HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in service mesh proxy registration8.8 HighN/AN/AOct 26, 2026
CVE-2026-102649: padok-team burrito: Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator9.9 CriticalN/AN/AOct 26, 2026
CVE-2026-82390: zephyrproject zephyr: The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to…3.7 LowN/AN/AOct 26, 2026
CVE-2026-82389: zephyrproject zephyr: In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-82388: zephyrproject zephyr: bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-81039: zephyrproject zephyr: The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every…4.3 MediumN/AN/AOct 26, 2026
CVE-2026-81038: zephyrproject zephyr: The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send()…7.1 HighN/AN/AOct 26, 2026
CVE-2026-71456: Johnson Controls Kantech Entrapass: Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto…N/A8.5 HighN/AOct 26, 2026
CVE-2026-71455: Johnson Controls Kantech Entrapass: Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows…N/A5.3 MediumN/AOct 26, 2026
CVE-2026-19742: zephyrproject zephyr: The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers…3.7 LowN/AN/AOct 26, 2026
CVE-2026-116612: GStreamer project gst-editing-services: A flaw was found in GStreamer Editing Services (gst-editing-services)7.8 HighN/AN/AOct 26, 2026
CVE-2026-116596: Pyrus Pyrus Sync: Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in…N/AN/AN/AOct 26, 2026
CVE-2026-116403: Awesomemotive Easy Digital Downloads: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in…5.9 MediumN/AN/AOct 26, 2026
401-425 of 416032