The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-118176: Mozilla Thunderbird: Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed…N/AN/AN/AOct 27, 2026
CVE-2026-118175: Mozilla Thunderbird: When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different…N/AN/AN/AOct 27, 2026
CVE-2026-118174: Mozilla Thunderbird: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's…N/AN/AN/AOct 27, 2026
CVE-2026-118173: MISP misp-guard: MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for…N/A6.1 MediumN/AOct 27, 2026
CVE-2026-118172: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirectN/AN/AN/AOct 27, 2026
CVE-2026-118171: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpointN/AN/AN/AOct 27, 2026
CVE-2026-118170: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made…N/AN/AN/AOct 27, 2026
CVE-2026-116683: ctfer-io terraform-provider-ctfd: CTFer.io's CTFd Terraform Provider manages CTFd resources as codeN/A7.1 HighN/AOct 27, 2026
CVE-2026-115413: AWS aws-api-mcp-server: Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might…7.8 High7.3 HighN/AOct 27, 2026
CVE-2026-88812: X.org, x.org: A double free in XKB SetGeometryin X.Org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by attached…7.8 HighN/AN/AOct 27, 2026
CVE-2026-87086: Tanium Provision: Tanium addressed a denial of service vulnerability in Provision.7.5 HighN/AN/AOct 27, 2026
CVE-2026-87085: Tanium Provision: Tanium addressed a SQL injection vulnerability in Provision.6.3 MediumN/AN/AOct 27, 2026
CVE-2026-57202: asterisk: Asterisk is an open source private branch exchange and telephony toolkit8.1 HighN/AN/AOct 27, 2026
CVE-2026-57188: asterisk: Asterisk is an open source private branch exchange and telephony toolkitN/A7.1 HighN/AOct 27, 2026
CVE-2026-16491: Grafana: Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted…6.5 MediumN/AN/AOct 27, 2026
CVE-2026-118132: NextChat: NextChat version 2.16.1 contains a client‑side cross‑site scripting (XSS) vulnerability in the Plugin Editor due to…N/AN/AN/AOct 27, 2026
CVE-2026-118131: GnuPG: GnuPG (version 2.5.21) for Windows contains a vulnerability where default Discretionary Access Control List (DACL)…N/AN/AN/AOct 27, 2026
CVE-2026-117526: reduxjs redux-devtools: A vulnerability was found in reduxjs redux-devtools 5.0.05.3 Medium1.9 LowN/AOct 27, 2026
CVE-2026-117516: oretnom23 php-travel-agency-system: A weakness has been identified in oretnom23 php-travel-agency-system7.3 High5.5 MediumN/AOct 27, 2026
CVE-2026-117515: oretnom23 php-travel-agency-system: A security flaw has been discovered in oretnom23 php-travel-agency-system 4e28b8f84d72420373dd15c3ae32900beb7e06357.3 High5.5 MediumN/AOct 27, 2026
CVE-2026-116682: gtsteffaniak filebrowser: FileBrowser Quantum is a free, self-hosted, web-based file manager8.6 HighN/AN/AOct 27, 2026
CVE-2026-116680: sysadminsmedia homebox: HomeBox is a home inventory and organization system6.4 MediumN/AN/AOct 27, 2026
CVE-2026-116679: m1k1o neko: Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC5.4 MediumN/AN/AOct 27, 2026
CVE-2026-116678: dani-garcia vaultwarden: Vaultwarden is a Bitwarden-compatible server written in Rust5.8 MediumN/AN/AOct 27, 2026
CVE-2026-116677: openwisp openwisp-controller: OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI…N/A5.3 MediumN/AOct 27, 2026
26-50 of 522616