The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-115539: moby, Docker: SwarmKit's Cluster-API proxy can overwrite a forwarded client's TLS identity with an intermediary manager's identityN/A7.7 HighN/ANov 10, 2026
CVE-2026-115538: Docker, Moby: Moby's overlay network driver does not restore the iptables rules for encrypted overlay networks after firewalld…N/A7.0 HighN/ANov 10, 2026
CVE-2026-115483: wpeverest: The Everest Forms plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.6.3…7.5 HighN/AN/ANov 10, 2026
CVE-2026-104060: worklenz: Worklenz before 3.3.0 contains an SQL injection vulnerability in the reporting members endpoints that allows…6.5 Medium7.1 HighN/ANov 10, 2026
CVE-2026-102166: Arista Networks Wi-Fi Access Point: Arista C-260 and C-250 access points ship with fleet-wide static cryptographic keys used for firmware image…8.8 High9.4 CriticalN/ANov 10, 2026
CVE-2026-0195: Google Android: In fill of dma.rs, there is a possible way to trigger an out of bounds stack read during direct memory access fills due…N/AN/AN/ANov 10, 2026
CVE-2026-0193: Google Android: In handle_rx_msg of tipc_virtio_dev, there is a possible Double Fetch TOCTOU due to Double FetchN/AN/AN/ANov 10, 2026
CVE-2026-0191: Google Android: In event_set_sub of acropora_event.c, there is a possible Logic error due to a logic error in the codeN/AN/AN/ANov 10, 2026
CVE-2026-0178: Google Android: In multiple functions of arm-smmu-v3.c, there is a possible way to bypass direct memory access isolation via stale…N/AN/AN/ANov 10, 2026
CVE-2026-0175: Google Android: In multiple locations, there is a possible way to bypass key authorization policies during wrapped key import due to a…N/AN/AN/ANov 10, 2026
CVE-2026-0169: Google Android: In multiple functions of Android.bp, there is a possible way to bind to a privileged debug overlay service due to test…N/AN/AN/ANov 10, 2026
CVE-2025-61625: Fortinet: An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet…8.1 HighN/AN/ANov 10, 2026
CVE-2026-99288: Linux: In the Linux kernel, the following vulnerability has been resolved: inet: reject unhashed sockets during established…N/AN/AN/ANov 10, 2026
CVE-2026-99287: Linux: In the Linux kernel, the following vulnerability has been resolved: xen-netback: Zero out sring pointers on unmap If…N/AN/AN/ANov 10, 2026
CVE-2026-99286: Linux: In the Linux kernel, the following vulnerability has been resolved: xen-netback: Fix XenBus connection failure cleanup…N/AN/AN/ANov 10, 2026
CVE-2026-97015: Microsoft: Heap-based buffer overflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a…6.8 MediumN/AN/ANov 10, 2026
CVE-2026-97013: Microsoft: Access of resource using incompatible type ('type confusion') in Windows Shell allows an authorized attacker to elevate…7.8 HighN/AN/ANov 10, 2026
CVE-2026-97006: Microsoft: Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.4.9 MediumN/AN/ANov 10, 2026
CVE-2026-97002: Microsoft: Out-of-bounds read in Windows VMSwitch allows an authorized attacker to elevate privileges locally.7.5 HighN/AN/ANov 10, 2026
CVE-2026-97000: Microsoft: Null pointer dereference in Windows USM Communication Manager allows an authorized attacker to elevate privileges…7.0 HighN/AN/ANov 10, 2026
CVE-2026-96994: Microsoft: Use after free in Winsock allows an authorized attacker to elevate privileges locally.7.0 HighN/AN/ANov 10, 2026
CVE-2026-96993: Microsoft: Release of invalid pointer or reference in Windows Performance Monitor allows an unauthorized attacker to execute code…7.5 HighN/AN/ANov 10, 2026
CVE-2026-96992: Microsoft: Use after free in Windows PCI Bus Driver allows an unauthorized attacker to elevate privileges with a physical attack.6.4 MediumN/AN/ANov 10, 2026
CVE-2026-96989: Microsoft: Out-of-bounds read in Secondary Logon allows an authorized attacker to disclose information locally.5.5 MediumN/AN/ANov 10, 2026
CVE-2026-96988: Microsoft: Out-of-bounds read in Windows DNS allows an authorized attacker to disclose information over a network.4.9 MediumN/AN/ANov 10, 2026
426-450 of 557027