The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116692: mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models9.8 CriticalN/AN/AOct 27, 2026
CVE-2026-116691: mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models6.5 MediumN/AN/AOct 27, 2026
CVE-2026-116690: mlflow: MLflow is an open source AI engineering platform for agents, large language models, and machine learning models7.5 HighN/AN/AOct 27, 2026
CVE-2026-116689: follow-redirects: follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects5.9 MediumN/AN/AOct 27, 2026
CVE-2026-116688: ckeditor ckeditor5: CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture8.1 HighN/AN/AOct 27, 2026
CVE-2026-116687: ckeditor ckeditor5: CKEditor 5 is a modern JavaScript rich-text editor with an MVC architecture3.1 LowN/AN/AOct 27, 2026
CVE-2026-116686: modelcontextprotocol python-sdk: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients6.5 MediumN/AN/AOct 27, 2026
CVE-2026-116685: modelcontextprotocol python-sdk: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients5.9 MediumN/AN/AOct 27, 2026
CVE-2026-116684: modelcontextprotocol python-sdk: The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients6.8 MediumN/AN/AOct 27, 2026
CVE-2026-112355: MembershipWorks: The MembershipWorks plugin for WordPress before 6.17 contains an information disclosure vulnerability that allows…7.5 High8.7 HighN/AOct 27, 2026
CVE-2026-112352: Sunhillo Corporation SureLine: Sunhillo SureLine before 9.1.5 contains an authentication bypass vulnerability that allows an unauthenticated remote…9.1 Critical9.1 CriticalN/AOct 27, 2026
CVE-2026-112351: Sunhillo Corporation SureLine: Sunhillo SureLine before 9.1.5 contains an OS command injection vulnerability in the networkDiag.cgi endpoint that…8.8 High8.7 HighN/AOct 27, 2026
CVE-2026-112350: Sunhillo Corporation SureLine: Sunhillo SureLine before 9.1.5 contains a path traversal vulnerability in the radarUpdater.cgi endpoint that allows…7.5 High8.7 HighN/AOct 27, 2026
CVE-2026-103995: Python Software Foundation CPython: Response body and chunk parsing would handle non-hex or negative integers incorrectly which could result in…N/A2.0 LowN/AOct 27, 2026
CVE-2026-118180: Mozilla Thunderbird: When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response…N/AN/AN/AOct 27, 2026
CVE-2026-118179: Mozilla Thunderbird: Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and…N/AN/AN/AOct 27, 2026
CVE-2026-118178: Mozilla Thunderbird: A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored…N/AN/AN/AOct 27, 2026
CVE-2026-118177: Mozilla Thunderbird: When looking for calendars in a directory on a server, during account setup or when adding a new network calendar,…N/AN/AN/AOct 27, 2026
CVE-2026-118176: Mozilla Thunderbird: Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed…N/AN/AN/AOct 27, 2026
CVE-2026-118175: Mozilla Thunderbird: When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different…N/AN/AN/AOct 27, 2026
CVE-2026-118174: Mozilla Thunderbird: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's…N/AN/AN/AOct 27, 2026
CVE-2026-118173: MISP misp-guard: MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for…N/A6.1 MediumN/AOct 27, 2026
CVE-2026-118172: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirectN/AN/AN/AOct 27, 2026
CVE-2026-118171: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpointN/AN/AN/AOct 27, 2026
CVE-2026-118170: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made…N/AN/AN/AOct 27, 2026
26-50 of 522616