The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-116543: open5gs: Open5GS 1.3.0 through 2.8.0 contains a heap out-of-bounds write vulnerability in parse_multipart() that allows…7.5 High8.7 HighN/AOct 26, 2026
CVE-2026-116542: netty: Netty netty-tcnative before 2.0.84.Final contains an SNI hostname spoofing vulnerability that allows remote…5.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-116541: netty: Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO…5.9 Medium8.2 HighN/AOct 26, 2026
CVE-2026-116539: netty: Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer…5.9 Medium8.2 HighN/AOct 26, 2026
CVE-2026-116538: mganss HtmlSanitizer: HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability…4.7 Medium2.3 LowN/AOct 26, 2026
CVE-2026-116489: timescale pgvectorscale: Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users…7.5 High7.7 HighN/AOct 26, 2026
CVE-2026-116369: Sunwood-ai-labs github-kanban-mcp-server: A vulnerability was identified in Sunwood-ai-labs github-kanban-mcp-server up to 0.4.06.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116368: DeepSeek Harness: A vulnerability was determined in DeepSeek Harness up to 0.2.0-rc.27.3 High6.9 MediumN/AOct 26, 2026
CVE-2026-116367: DeepSeek Harness: A vulnerability was found in DeepSeek Harness up to 0.1.0-rc.56.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-115748: Apache Software Foundation Apache Vysper: **UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions8.8 HighN/AN/AOct 26, 2026
CVE-2026-115721: Apache Software Foundation Apache Vysper: **UNSUPPORTED WHEN ASSIGNED** Unbounded allocation in XML parsing in Apache Vysper; all versions, may lead to an out of…7.5 HighN/AN/AOct 26, 2026
CVE-2026-112346: OpenHands OpenHands Software Agent SDK: OpenHands Software Agent SDK before 1.52.0 contains an unauthenticated remote code execution vulnerability where the…9.8 Critical9.3 CriticalN/AOct 26, 2026
CVE-2026-112344: Syncplify, Inc. Syncplify Server!: Syncplify Server! before 8.8.0 contains a path traversal vulnerability that allows attackers with a symbolic link…6.8 Medium7.6 HighN/AOct 26, 2026
CVE-2026-112343: Syncplify, Inc. Syncplify Server!: Syncplify Server! before 8.8.0 contains an access control bypass vulnerability that allows authenticated SFTP users to…8.1 High8.6 HighN/AOct 26, 2026
CVE-2026-107090: n/a: An issue in Maltego Technologies GmbH Maltego Windows Installer 4.13.0 allows a local attacker to execute arbitrary…N/AN/AN/AOct 26, 2026
CVE-2026-107080: n/a: OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in…N/AN/AN/AOct 26, 2026
CVE-2026-116370: 2K Games Sid Meier's Civilization IV: A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.686.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-82390: zephyrproject zephyr: The Espressif AES driver drivers/crypto/crypto_esp32_aes.c advertises a multi-session cipher API — it hands out up to…3.7 LowN/AN/AOct 26, 2026
CVE-2026-82389: zephyrproject zephyr: In the Bluetooth Classic Hands-Free Profile Audio Gateway role, hfp_ag_create() in…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-82388: zephyrproject zephyr: bt_hfp_hf_connect() in subsys/bluetooth/host/classic/hfp_hf.c allocates the per-connection HFP Hands-Free object with…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-19742: zephyrproject zephyr: The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers…3.7 LowN/AN/AOct 26, 2026
CVE-2026-81038: zephyrproject zephyr: The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send()…7.1 HighN/AN/AOct 26, 2026
CVE-2026-81039: zephyrproject zephyr: The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every…4.3 MediumN/AN/AOct 26, 2026
CVE-2026-116394: Magepeople inc. WpEvently: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Magepeople inc5.3 MediumN/AN/AOct 26, 2026
CVE-2026-115680: Keil MDK-Middleware: Arm Keil MDK-Middleware 8.0.0-8.3.0 may allow DHCPv6 Option-Walk Over-Reads and Unintended Data RetransmissionN/AN/AN/AOct 26, 2026
26-50 of 546512
‹›