The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-117609: merbanan rtl_433: rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby…7.1 High7.1 HighN/AOct 28, 2026
CVE-2026-117608: assimp: Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader() that allows attackers…6.1 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-117607: thexerteproject xerteonlinetoolkits: Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users…7.2 High8.6 HighN/AOct 28, 2026
CVE-2026-117606: Blair2004 NexoPOS: NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate…5.4 Medium5.3 MediumN/AOct 28, 2026
CVE-2026-117605: nopSolutions nopCommerce: nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController…4.3 Medium5.3 MediumN/AOct 28, 2026
CVE-2015-20129: CrushFTP: CrushFTP before 7.3.0 contains a cross-site request forgery vulnerability that allows attackers to perform…8.8 High8.6 HighN/AOct 28, 2026
CVE-2014-125138: C97net: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an unrestricted…8.8 High8.7 HighN/AOct 28, 2026
CVE-2014-125137: C97net: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain a local file…6.5 Medium7.1 HighN/AOct 28, 2026
CVE-2014-125136: C97net: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information…5.9 Medium8.2 HighN/AOct 28, 2026
CVE-2013-20009: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains a stored cross-site scripting vulnerability that allows authenticated…4.8 Medium4.8 MediumN/AOct 28, 2026
CVE-2013-20008: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows attackers to change the…6.8 Medium7.0 HighN/AOct 28, 2026
CVE-2013-20007: Linksys WAG200G: Linksys WAG200G through 1.01.06 contains an OS command injection vulnerability that allows authenticated attackers to…7.2 High8.6 HighN/AOct 28, 2026
CVE-2026-110879: FasterXML jackson-databind: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-110747: FasterXML jackson-dataformat-protobuf: ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an…7.5 HighN/AN/AOct 28, 2026
CVE-2026-118129: jeremyckahn Chitchatter: A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc6.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-104895: FasterXML jackson-dataformat-smile: The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input…7.5 HighN/AN/AOct 28, 2026
CVE-2026-104016: FasterXML jackson-dataformat-protobuf: ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and…7.5 HighN/AN/AOct 28, 2026
CVE-2026-59158: thoda-dev nuxt-ollama: Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications7.5 HighN/AN/AOct 27, 2026
CVE-2026-58496: thorvg: Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine4.3 MediumN/AN/AOct 27, 2026
CVE-2026-58257: JeromeDevome GRR: GRR is a resource management and reservation application7.2 HighN/AN/AOct 27, 2026
CVE-2026-58256: JeromeDevome GRR: GRR is a resource management and reservation application9.1 CriticalN/AN/AOct 27, 2026
CVE-2026-58255: jhuckaby Cronicle: Cronicle is a multi-server task scheduler and runner, with a web based front-end UI8.8 HighN/AN/AOct 27, 2026
CVE-2026-58205: JeromeDevome GRR: GRR is a resource management and reservation application8.1 HighN/AN/AOct 27, 2026
CVE-2026-50571: w3c websub: WebSub is a W3C recommendation produced by the Social Web Working Group5.7 MediumN/AN/AOct 27, 2026
CVE-2026-22063: NetApp: The private keys of eight eMudhra intermediate CA certificates have been compromisedN/A6.0 MediumN/AOct 27, 2026
26-50 of 522616