The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-117566: icret EasyImages2.0: EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-117565: ArtalkJS Artalk: Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-117564: buqiyuan nest-admin: nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…9.8 Critical9.3 CriticalN/AOct 27, 2026
CVE-2026-117563: zmister2016 MrDoc: MrDoc through 1.1.1 contains a broken access control vulnerability in the manage_doc_share type 3 branch that allows…5.4 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-117562: anyant rssant: rssant 1.9.0 through 1.9.1 contains an authorization bypass vulnerability that allows unauthenticated attackers to read…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-117561: codefriar sf-mcp: Codefriar sf-mcp through 1.3.2 contains an OS command injection vulnerability that allows attackers to execute shell…7.8 High8.5 HighN/AOct 27, 2026
CVE-2026-117560: atxp gemini-cli-extension: ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows…7.8 High8.5 HighN/AOct 27, 2026
CVE-2026-117559: hyperb1iss droidmind: DroidMind through 0.4.0 contains a command injection vulnerability that allows MCP clients to bypass the shell command…7.8 High8.5 HighN/AOct 27, 2026
CVE-2026-117558: ai-sdlc-framework ai-sdlc: The ai-sdlc plugin MCP server through 0.31.2 contains an OS command injection vulnerability that allows attackers to…7.8 High8.5 HighN/AOct 27, 2026
CVE-2026-117557: libsdl-org SDL_image: SDL_image through 3.4.8 and through 2.8.12 contains a stack out-of-bounds read vulnerability in IMG_LoadLBM_IO() in…6.1 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-117556: zchunk: zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes…4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-117555: GreycLab CImg: CImg through 4.0.6 contains a heap out-of-bounds read vulnerability in the _load_bmp() function of CImg.h caused by an…6.1 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-117554: admidio: Admidio before 5.0.17 contains an improper access control vulnerability that allows authenticated members to register…4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-117553: umbraco Umbraco-CMS: Umbraco CMS before 17.7.2 and 18.2.2 contains an authentication bypass vulnerability that allows unauthenticated…7.5 High7.7 HighN/AOct 27, 2026
CVE-2026-90732: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0…4.9 MediumN/AN/AOct 27, 2026
CVE-2026-90731: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…4.9 MediumN/AN/AOct 27, 2026
CVE-2026-90730: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.5 MediumN/AN/AOct 27, 2026
CVE-2026-90729: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.7 MediumN/AN/AOct 27, 2026
CVE-2026-90728: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.3 MediumN/AN/AOct 27, 2026
CVE-2026-56084: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…5.8 MediumN/AN/AOct 27, 2026
CVE-2026-4337: PuMuKIT: Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user…N/A8.8 HighN/AOct 27, 2026
CVE-2026-41022: Eaton easySoft: Eaton easySoft improperly validates TLS certificates presented by easyE4 devices5.9 MediumN/AN/AOct 27, 2026
CVE-2026-41021: Eaton easyE4: Eaton easyE4 uses an insufficiently strong password policy7.5 HighN/AN/AOct 27, 2026
CVE-2026-41020: Eaton easyE4: Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to…7.5 HighN/AN/AOct 27, 2026
CVE-2026-13162: Hitachi Energy: An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute…N/A7.7 HighN/AOct 27, 2026
26-50 of 522616