The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-65145: NVIDIA NeMo Agent Toolkit: NVIDIA NeMo Agent Toolkit contains a vulnerability where a attacker could cause a missing authentication issue10.0 CriticalN/AN/AOct 27, 2026
CVE-2026-65151: NVIDIA NeMo Agent Toolkit: NVIDIA NeMo Agent Toolkit contains vulnerability where an attacker could cause a SQL injection issue8.4 HighN/AN/AOct 27, 2026
CVE-2026-65120: NVIDIA TensorRT-LLM: NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery7.1 HighN/AN/AOct 27, 2026
CVE-2026-24269: NVIDIA TensorRT-LLM: NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery7.1 HighN/AN/AOct 27, 2026
CVE-2026-65119: NVIDIA TensorRT-LLM: NVIDIA TensorRT-LLM for any platform contains a vulnerability in KvCacheAwareRouter tokenizer loading, where an…8.4 HighN/AN/AOct 27, 2026
CVE-2026-100164: Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis: Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co7.5 HighN/AN/AOct 27, 2026
CVE-2026-117541: darylldoyle svg-sanitizer: svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-117540: darylldoyle svg-sanitizer: svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that…7.5 High8.7 HighN/AOct 27, 2026
CVE-2026-117539: darylldoyle svg-sanitizer: darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow…3.5 Low5.1 MediumN/AOct 27, 2026
CVE-2026-117538: redaxo core: REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the…4.1 Medium2.1 LowN/AOct 27, 2026
CVE-2026-117537: redaxo core: REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to…4.1 Medium2.1 LowN/AOct 27, 2026
CVE-2026-117536: redaxo core: REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page…8.8 High8.6 HighN/AOct 27, 2026
CVE-2026-117535: redaxo core: REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page,…6.1 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-117534: redaxo core: REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows…5.4 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-117533: redaxo core: REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves…4.4 Medium2.1 LowN/AOct 27, 2026
CVE-2026-117532: redaxo core: REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin…9.8 Critical9.3 CriticalN/AOct 27, 2026
CVE-2026-117530: JetBrains Junie CLI: In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted…6.7 MediumN/AN/AOct 27, 2026
CVE-2026-117466: Octopus Deploy Octopus Server: In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full…N/A8.6 HighN/AOct 27, 2026
CVE-2026-117341: Octopus Deploy Octopus Server: In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event logN/A7.7 HighN/AOct 27, 2026
CVE-2026-116900: redaxo core: REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by…5.4 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-116899: redaxo core: REDAXO before 5.21.4 contains a broken access control vulnerability that allows authenticated editors to modify slices…6.5 Medium7.1 HighN/AOct 27, 2026
CVE-2026-116898: redaxo core: REDAXO before 5.21.4 contains a missing authorization vulnerability in the media pool bulk move that checks only target…7.1 High7.1 HighN/AOct 27, 2026
CVE-2026-116897: redaxo core: REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history…6.5 Medium7.1 HighN/AOct 27, 2026
CVE-2026-116896: redaxo core: REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any…7.5 High7.7 HighN/AOct 27, 2026
CVE-2026-116895: redaxo core: REDAXO before 5.21.5 contains a cross-site request forgery vulnerability because the backend processes the safemode GET…5.4 Medium5.1 MediumN/AOct 27, 2026
26-50 of 522616