The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-63341: moscajs aedes: Aedes is an MQTT broker that can run on any stream server7.5 HighN/AN/AOct 30, 2026
CVE-2026-62991: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel6.5 MediumN/AN/AOct 30, 2026
CVE-2026-62990: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel8.7 HighN/AN/AOct 30, 2026
CVE-2026-62989: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel8.1 HighN/AN/AOct 30, 2026
CVE-2026-62967: sinamics ztnet: ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support8.1 HighN/AN/AOct 30, 2026
CVE-2026-62966: ESP32Async ESPAsyncWebServer: ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP23507.5 HighN/AN/AOct 30, 2026
CVE-2026-62965: sabnzbd: SABnzbd is an open source automated Usenet download toolN/A7.0 HighN/AOct 30, 2026
CVE-2026-62958: libriscv: libriscv is a RISC-V sandbox and emulator7.9 HighN/AN/AOct 30, 2026
CVE-2026-62864: ring-clojure ring: Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack7.5 HighN/AN/AOct 30, 2026
CVE-2026-62863: gojue moling: MoLing is a computer-use and browser-use based MCP server9.6 CriticalN/AN/AOct 30, 2026
CVE-2026-62860: Zoeille picsou-finance: Picsou is a self-hosted personal finance dashboard5.3 MediumN/AN/AOct 30, 2026
CVE-2026-62853: mqttsnet thinglinks: ThingLinks is an enterprise IoT platform9.9 CriticalN/AN/AOct 30, 2026
CVE-2026-62848: Metalama: Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#7.3 HighN/AN/AOct 30, 2026
CVE-2026-62300: filecoin-project filecoin-pin: Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service6.5 MediumN/AN/AOct 30, 2026
CVE-2026-62297: Agamnentzar ag-psd: ag-psd is a JavaScript library for reading and writing Photoshop Document files7.5 HighN/AN/AOct 30, 2026
CVE-2026-59993: h2o picotls: Picotls is a TLS protocol library that allows users select different crypto backends based on their use case6.5 MediumN/AN/AOct 30, 2026
CVE-2026-58412: filecoin-project filecoin-pin: Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service8.2 HighN/AN/AOct 30, 2026
CVE-2026-54610: libredwg: LibreDWG is a free C library to read and write DWG files3.3 LowN/AN/AOct 30, 2026
CVE-2026-40573: MinecAnton209 NovumOS: NovumOS is a custom 32-bit operating system written in Zig and x86 Assembly8.6 HighN/AN/AOct 30, 2026
CVE-2026-119343: Stirling-Tools Stirling-PDF: Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files6.8 MediumN/AN/AOct 30, 2026
CVE-2026-119342: Stirling-Tools Stirling-PDF: Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119341: tesseract-ocr tesseract: Tesseract is an open source OCR engine0.0 NoneN/AN/AOct 30, 2026
CVE-2026-119340: tesseract-ocr tesseract: Tesseract is an open source OCR engine5.5 MediumN/AN/AOct 30, 2026
CVE-2026-119338: tesseract-ocr tesseract: Tesseract is an open source OCR engineN/A6.9 MediumN/AOct 30, 2026
CVE-2026-117666: deadtrickster ssl_verify_fun: Improper Validation of Certificate with Host Mismatch vulnerability in deadtrickster ssl_verify_fun allows an adversary…N/A9.1 CriticalN/AOct 30, 2026
26-50 of 418318