The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-77930: EvoScientist: EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell…9.8 Critical9.3 Critical1%Oct 20, 2026
CVE-2026-77926: apconw Aix-DB: Aix-DB 1.2.4 contains a remote code execution vulnerability that allows authenticated non-admin users to run operating…8.8 High8.7 High1%Oct 20, 2026
CVE-2026-75128: chatchat-space Langchain-Chatchat: Langchain-Chatchat through 0.3.1.3 exposes a POST /tools/call API endpoint that invokes any registered tool by name…9.8 Critical9.3 Critical1%Oct 20, 2026
CVE-2026-28850: Apple: An authorization issue was addressed with improved state management5.5 MediumN/A0%Oct 20, 2026
CVE-2026-109444: Tracer-Cloud opensre: OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute…9.8 Critical9.3 Critical1%Oct 20, 2026
CVE-2026-109443: jd-opensource JoySafeter: JoySafeter through 1.0.0 contains a remote code execution vulnerability that allows authenticated users to run…8.8 High8.7 High1%Oct 20, 2026
CVE-2026-109442: cas-bigdatalab piflow: piflow 2.0.0 through 2.0.1 contains a remote code execution vulnerability in its DeepAgents chat agent, whose POST…9.8 Critical9.3 Critical1%Oct 20, 2026
CVE-2026-109441: ginlix-ai LangAlpha: LangAlpha through 2026.09.07 contains an improper isolation vulnerability that places all tenants' sandbox containers…5.8 Medium6.9 Medium0%Oct 20, 2026
CVE-2026-109440: ginlix-ai LangAlpha: LangAlpha through 2026.09.07 contains an indirect prompt injection vulnerability that allows remote attackers to…8.8 High8.7 High1%Oct 20, 2026
CVE-2026-109395: ning compress-lzf: Ning compress-lzf before 1.2.0 contains an out-of-bounds memory access vulnerability in the sun.misc.Unsafe based…9.1 Critical8.8 High1%Oct 20, 2026
CVE-2026-105298: Cloudflare https://github.com/cloudflare/pingora: Summary Before version 0.9.0, Pingora accepted HTTP/2 requests whose Host header differed from the :authority…N/A6.3 Medium1%Oct 20, 2026
CVE-2026-105297: Cloudflare https://github.com/cloudflare/pingora: Summary Before version 0.8.1, Pingora's HTTP/2 server used the h2 crate's default limits unless the application set its…7.5 HighN/A0%Oct 20, 2026
CVE-2026-86981: Apple macOS: An out-of-bounds write issue was addressed with improved bounds checkingN/AN/A0%Oct 20, 2026
CVE-2026-86979: Apple macOS: A privacy issue was addressed with improved checksN/AN/A0%Oct 20, 2026
CVE-2026-86977: Apple iOS and iPadOS: An authorization issue was addressed with improved network restrictionsN/AN/A0%Oct 20, 2026
CVE-2026-86976: Apple: An authorization issue was addressed with improved state managementN/AN/A0%Oct 20, 2026
CVE-2026-86975: Apple: An out-of-bounds read was addressed with improved bounds checkingN/AN/A0%Oct 20, 2026
CVE-2026-86963: Apple iOS and iPadOS: A denial-of-service issue was addressed with improved input validationN/AN/A0%Oct 20, 2026
CVE-2026-86962: Apple: A double free issue was addressed with improved memory managementN/AN/A0%Oct 20, 2026
CVE-2026-86961: Apple: A race condition was addressed with additional validationN/AN/A0%Oct 20, 2026
CVE-2026-86959: Apple: An input validation issue was addressed with improved input validationN/AN/A0%Oct 20, 2026
CVE-2026-86957: Apple: An out-of-bounds read was addressed with improved bounds checkingN/AN/A0%Oct 20, 2026
CVE-2026-86955: Apple iOS and iPadOS: An authorization issue was addressed with improved state managementN/AN/A0%Oct 20, 2026
CVE-2026-86953: Apple: An out-of-bounds write issue was addressed with improved bounds checkingN/AN/A0%Oct 20, 2026
CVE-2026-86944: Apple: An out-of-bounds write issue was addressed with improved bounds checkingN/AN/A0%Oct 20, 2026
4451-4475 of 417478