The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-117649: Gitea: The issue timeline API and the web issue page hid cross-reference events that point at issues the reader cannot access,…N/AN/AN/ANov 1, 2026
CVE-2026-117646: Gitea: The repositories, stars and watching tabs of user profiles and the repository list of organization home pages included…N/AN/AN/ANov 1, 2026
CVE-2026-117635: Gitea: The `/api/v1/admin` route group did not enforce the `public-only` restriction of personal access tokensN/AN/AN/ANov 1, 2026
CVE-2026-116474: Gitea: The `GITEA_TOKEN` of a Gitea Actions job authenticates as the `gitea-actions` system user, and the `/api/v1/user` email…N/AN/AN/ANov 1, 2026
CVE-2026-116296: Gitea: The API routes for releases, release assets, milestones and repository labels did not reject changes to archived…N/AN/AN/ANov 1, 2026
CVE-2026-116289: Gitea: Gitea did not reject personal access tokens restricted to public resources (`public-only`) on the organization Actions…N/AN/AN/ANov 1, 2026
CVE-2026-114199: Gitea: `GET /api/v1/users/{username}/heatmap` computed the contribution heatmap with the repository access of the token owner…N/AN/AN/ANov 1, 2026
CVE-2026-113429: Gitea: Legacy (v1 to v3) Actions artifact uploads stored the request's `Content-Encoding` header unchecked in the column that…N/AN/AN/ANov 1, 2026
CVE-2026-112887: Gitea: Gitea Actions task tokens authenticate to the REST API as a shared system user with a negative ID, which repository,…N/AN/AN/ANov 1, 2026
CVE-2026-120263: Gitea: When `[oauth2_client].ACCOUNT_LINKING` is set to `auto` (not the default) and registration is enabled, the link-account…N/AN/AN/ANov 1, 2026
CVE-2026-118386: Gitea: Workflows triggered by a pull request review were read from the commit named in the review's `commit_id`, while the…N/AN/AN/ANov 1, 2026
CVE-2026-120218: n/a Typemill: A flaw has been found in Typemill up to 2.26.03.5 Low2.0 LowN/ANov 1, 2026
CVE-2026-120217: Delgan loguru: A vulnerability was detected in Delgan loguru 0.7.34.3 Medium2.1 LowN/ANov 1, 2026
CVE-2026-120198: WAVLINK WL-WN530BE1-A: A vulnerability has been found in WAVLINK WL-WN530BE1-A V25111710.0 Critical9.3 CriticalN/ANov 1, 2026
CVE-2026-118168: Unknown MapPress: The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler…N/AN/AN/ANov 1, 2026
CVE-2026-113482: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.44 does not escape one of its shortcode attributes before…N/AN/AN/ANov 1, 2026
CVE-2026-113481: Unknown Media Library Assistant: The Media Library Assistant WordPress plugin before 3.44 does not check that the requesting user is allowed to view a…N/AN/AN/ANov 1, 2026
CVE-2026-107343: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder: The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability…N/AN/AN/ANov 1, 2026
CVE-2026-107342: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder: The Kali Forms — Contact Form & Drag-and-Drop Builder WordPress plugin before 2.4.30 does not perform a capability…N/AN/AN/ANov 1, 2026
CVE-2026-120197: WAVLINK WL-WN530HG4B: A flaw has been found in WAVLINK WL-WN530HG4B M_V2607249.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-120196: WAVLINK WN579X3-D: A vulnerability was detected in WAVLINK WN579X3-D V2504029.9 Critical8.6 HighN/ANov 1, 2026
CVE-2026-120195: WAVLINK WL-WN579A3-A: A security vulnerability has been detected in WAVLINK WL-WN579A3-A 2026-03-10-94f93d410.0 Critical9.3 CriticalN/ANov 1, 2026
CVE-2026-120192: n/a Presenton: A security vulnerability has been detected in Presenton up to 0.9.11-beta5.3 Medium5.5 MediumN/ANov 1, 2026
CVE-2026-120252: cgohlke imagecodecs: imagecodecs 2023.1.23 through 2026.10.10 contains a stack-based buffer overflow vulnerability in the lossless JPEG…5.5 Medium6.8 MediumN/ANov 1, 2026
CVE-2026-120251: cgohlke imagecodecs: imagecodecs 2026.3.6 through 2026.10.10 contains an infinite loop vulnerability in ccitt_fax4_decode_size() that allows…5.5 Medium6.8 MediumN/ANov 1, 2026
26-50 of 420636