The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116803: cure53 DOMPurify: DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers…6.1 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-116802: cure53 DOMPurify: DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL…6.1 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-116801: parse-community parse-server: Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo…4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-116800: WWBN AVideo: WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to…6.2 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116604: SourceCodester Online Food Ordering System: A vulnerability has been found in SourceCodester Online Food Ordering System 1.06.5 Medium5.5 MediumN/AOct 27, 2026
CVE-2026-116603: SourceCodester Online Food Ordering System: A flaw has been found in SourceCodester Online Food Ordering System 1.04.7 Medium2.0 LowN/AOct 27, 2026
CVE-2026-111422: Apache Software Foundation Apache Airflow SSH provider: In apache-airflow-providers-ssh before 7.0.1, SSHRemoteJobOperator quoted the values of its templated `environment`…N/AN/AN/AOct 27, 2026
CVE-2026-76654: Kubernetes: An NTLM coercion vulnerability exists on Windows nodes when the subPath supplied in a pod's volumeMounts is set to a…5.8 MediumN/AN/AOct 26, 2026
CVE-2026-2270: Kubernetes: A confused deputy attack exists in the StatefulSet controller that allows a user with namespace-scoped write…5.9 MediumN/AN/AOct 26, 2026
CVE-2026-116602: SourceCodester Online Food Ordering System: A vulnerability was detected in SourceCodester Online Food Ordering System 1.06.5 Medium5.5 MediumN/AOct 26, 2026
CVE-2026-116556: n/a Argilla: A vulnerability was found in Argilla up to 2.8.02.4 Low1.9 LowN/AOct 26, 2026
CVE-2026-116555: n/a Argilla: A vulnerability has been found in Argilla up to 2.8.02.4 Low1.9 LowN/AOct 26, 2026
CVE-2026-116554: n/a Argilla: A flaw has been found in Argilla up to 2.8.03.5 Low2.0 LowN/AOct 26, 2026
CVE-2026-116746: qloapps: QloApps 1.6.0 through 1.7.0 contains a missing authorization vulnerability in the qlohotelreview module's AddReview…5.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-116742: samtools htslib: HTSlib through 1.24 contains a heap out-of-bounds write and read vulnerability in bgzf_index_load_hfile() in bgzf.c…4.4 Medium4.8 MediumN/AOct 26, 2026
CVE-2026-116738: kisli vmime: VMime through 0.9.2 contains an integer underflow in the uuEncoder::decode function that allows remote attackers to…8.8 High8.7 HighN/AOct 26, 2026
CVE-2026-116734: dvidelabs flatcc: flatcc through 0.6.4 contains an integer overflow vulnerability in the check_header function of the FlatBuffers…3.7 Low6.3 MediumN/AOct 26, 2026
CVE-2026-116730: tildearrow furnace: Furnace through 0.6.8.3 contains an out-of-bounds heap read vulnerability in DivEngine::loadFTM() in…5.5 Medium6.8 MediumN/AOct 26, 2026
CVE-2026-116729: libyal libfvde: libfvde through 20260923 contains a heap out-of-bounds read vulnerability in…3.3 Low4.8 MediumN/AOct 26, 2026
CVE-2026-116728: libyal libfvde: libfvde through 20260923 contains a heap out-of-bounds read vulnerability in…5.5 Medium6.8 MediumN/AOct 26, 2026
CVE-2026-116727: mmitch gbsplay: gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in vgm_open() in gbs.c that walks the VGM…3.3 Low4.8 MediumN/AOct 26, 2026
CVE-2026-116726: mmitch gbsplay: Gbsplay through 0.0.103 contains a heap out-of-bounds read vulnerability in gbr_open() in gbs.c that fails to verify…3.3 Low4.8 MediumN/AOct 26, 2026
CVE-2026-116725: mmitch gbsplay: gbsplay through 0.0.103 contains an out-of-bounds read vulnerability in mapper_map() in mapper.c that fails to reject…5.5 Medium6.8 MediumN/AOct 26, 2026
CVE-2026-116724: fltk: FLTK through 1.4.5 contains an integer overflow vulnerability in Fl_BMP_Image::load_bmp_() that causes undersized pixel…7.8 High8.5 HighN/AOct 26, 2026
CVE-2026-116723: fltk: FLTK through 1.4.5 contains a stack-based buffer overflow vulnerability in Fl_BMP_Image::load_bmp_() that allows…7.8 High8.5 HighN/AOct 26, 2026
426-450 of 522616