The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116141: ImageMagick: ImageMagick before 7.1.2-33 contains a policy bypass vulnerability in the UHDR decoder that allows attackers to evade…5.3 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116140: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 incorrectly parses delegate invocations, which can allow an…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116053: dbcli mycli: A weakness has been identified in dbcli mycli up to 2.29.4/2.30.15.3 Medium1.9 LowN/AOct 25, 2026
CVE-2026-116180: vllm-project vllm: vLLM from 0.8.5 before 0.31.0 has a denial of service flaw7.7 High8.3 HighN/AOct 25, 2026
CVE-2026-116178: vllm-project vllm: vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116173: vllm-project vllm: vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116158: ImageMagick: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing…2.5 Low2.0 LowN/AOct 25, 2026
CVE-2026-116157: ImageMagick: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116156: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116154: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in its XML parsing code, where allocated…5.3 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116150: ImageMagick: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the FPX encoder that allows attackers to exhaust…3.1 Low2.3 LowN/AOct 25, 2026
CVE-2026-116146: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the MSL decoder that fails to release…3.7 Low6.3 MediumN/AOct 25, 2026
CVE-2026-116144: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains uncontrolled recursion in the MVG decoder that can lead…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116139: WWBN AVideo: WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated…5.4 Medium5.1 MediumN/AOct 25, 2026
CVE-2026-116052: LinkStackOrg LinkStack: A security flaw has been discovered in LinkStackOrg LinkStack up to 4.8.84.3 Medium5.3 MediumN/AOct 25, 2026
CVE-2026-116137: cthackers adm-zip: adm-zip through 0.6.1 contains a duplicate-entry validation bypass that allows attackers to evade the readEntries()…3.7 Low6.3 MediumN/AOct 25, 2026
CVE-2026-116136: ProjectSend: ProjectSend 2.0.0 through 2.7.1 contains an incomplete authorization vulnerability in FileVersions::link() that allows…5.9 Medium6.0 MediumN/AOct 25, 2026
CVE-2026-116073: leon-ai leon: Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers…6.5 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116072: Docile-Alligator Infinity for Reddit: Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to…5.4 Medium5.3 MediumN/AOct 25, 2026
CVE-2026-116071: rotki: rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116070: dqzboy Docker-Proxy: Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows…6.5 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116069: Albert-Weasker niubigeo: NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote…6.5 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116067: ananthakumaran paisa: Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and…8.2 High8.8 HighN/AOct 25, 2026
CVE-2026-116066: Firecrawl: Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy…6.8 Medium7.0 HighN/AOct 25, 2026
CVE-2026-116068: dokploy: Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization…8.8 High8.7 HighN/AOct 25, 2026
451-475 of 416032