The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-70379: WolfVision: When the vSolution Matrix feature is enabled, affected devices may make current screen content available through an…6.5 Medium7.1 HighN/AOct 26, 2026
CVE-2026-116463: FastStone Image Viewer: A vulnerability was identified in FastStone Image Viewer up to 8.56.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116461: Omega Solution Restro POS: A vulnerability was determined in Omega Solution Restro POS up to 202610264.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116408: WP Chill Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116400: bPlugins Button Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Button…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116398: bPlugins Content Slider Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Content…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115966: bPlugins Typing Text – Give your texts many typing effects: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Typing…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115923: backstage: Backstage is an open framework for building developer portals6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115922: onnx: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability6.2 MediumN/AN/AOct 26, 2026
CVE-2026-115921: onnx: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability6.2 MediumN/AN/AOct 26, 2026
CVE-2026-115920: onnx: Open Neural Network Exchange (ONNX) is an open standard for machine learning interoperability6.2 MediumN/AN/AOct 26, 2026
CVE-2026-115918: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115917: vllm-project vllm: vLLM is an inference and serving engine for large language models3.4 LowN/AN/AOct 26, 2026
CVE-2026-115916: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115914: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-112839: VillaTheme Customer Coupons for WooCommerce: Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows…4.3 MediumN/AN/AOct 26, 2026
CVE-2026-111404: VillaTheme Photo Reviews for WooCommerce: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in VillaTheme…3.7 LowN/AN/AOct 26, 2026
CVE-2026-105765: HashiCorp: HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's…7.5 HighN/AN/AOct 26, 2026
CVE-2026-102649: padok-team burrito: Burrito is a Terraform Automation Collaboration Software (TACoS) Kubernetes operator9.9 CriticalN/AN/AOct 26, 2026
CVE-2026-116467: ggml-org llama.cpp: A security flaw has been discovered in ggml-org llama.cpp up to 0.7.05.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-115804: HashiCorp: HashiCorp Consul and Consul Enterprise are vulnerable to an authorization bypass in health check registration that may…6.4 MediumN/AN/AOct 26, 2026
CVE-2026-116634: cheaper-inference OmniRoute: OmniRoute 3.8.50 before 3.8.52 contains a missing authentication vulnerability that allows unauthenticated attackers to…5.9 Medium8.2 HighN/AOct 26, 2026
CVE-2026-50096: Esri ArcGIS Server: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may…6.1 MediumN/AN/AOct 26, 2026
CVE-2026-50095: Esri ArcGIS Server: There is a stored cross site scripting issue in Esri ArcGIS Server 11.1 and earlier on Windows and Linux that in some…6.1 MediumN/AN/AOct 26, 2026
CVE-2026-33522: Esri ArcGIS Server: Esri ArcGIS Server versions 11.3 to 12.0 ONLY allows a remote, unauthenticated attacker to update service metadata5.3 MediumN/AN/AOct 26, 2026
26-50 of 416032