The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-117513: oretnom23 php-travel-agency-system: A vulnerability was determined in oretnom23 php-travel-agency-system7.3 High5.5 MediumN/AOct 27, 2026
CVE-2026-117512: oretnom23 php-travel-agency-system: A vulnerability was found in oretnom23 php-travel-agency-system7.3 High5.5 MediumN/AOct 27, 2026
CVE-2026-116675: tinymce: TinyMCE is an open source rich text editorN/A8.5 HighN/AOct 27, 2026
CVE-2026-116674: sebhildebrandt systeminformation: systeminformation is a System and OS information library for node.js6.5 MediumN/AN/AOct 27, 2026
CVE-2026-116673: sebhildebrandt systeminformation: systeminformation is a System and OS information library for node.js3.3 LowN/AN/AOct 27, 2026
CVE-2026-116672: authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers8.8 HighN/AN/AOct 27, 2026
CVE-2026-114598: The EPICS Community EPICS Base: In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can…7.5 High8.7 HighN/AOct 27, 2026
CVE-2026-114597: The EPICS Community EPICS Base: In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can…7.5 High8.7 HighN/AOct 27, 2026
CVE-2026-114596: The EPICS Community EPICS Base: In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can…8.2 High8.8 HighN/AOct 27, 2026
CVE-2026-114595: The EPICS Community EPICS Base: In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be…9.8 Critical9.3 CriticalN/AOct 27, 2026
CVE-2026-113775: Autodesk Fusion: A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command…7.8 HighN/AN/AOct 27, 2026
CVE-2026-112353: GFI USA, LLC GFI KerioConnect: GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the…8.2 High6.2 MediumN/AOct 27, 2026
CVE-2026-109090: x.org libXi: A malicious X server could cause a heap overflow by injecting a large DEVICE_ENABLE reply when processed by libXi…7.5 HighN/AN/AOct 27, 2026
CVE-2026-109089: X.Org libXi: A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious…7.5 HighN/AN/AOct 27, 2026
CVE-2026-109088: X.org libXtst: A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the…6.5 MediumN/AN/AOct 27, 2026
CVE-2026-108142: Veeam Backup and Replication: A vulnerability allowing an unauthenticated attacker to bypass authorization on the CDP Coordinator Service.N/A9.1 CriticalN/AOct 27, 2026
CVE-2026-108141: Veeam Backup and Replication: A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a…N/A5.9 MediumN/AOct 27, 2026
CVE-2026-108140: Veeam Backup and Replication: A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a…N/A5.9 MediumN/AOct 27, 2026
CVE-2026-108015: HCLSoftware Notes Client: Private keys for eight eMudhra intermediate CA certificates have been compromised…N/A9.1 CriticalN/AOct 27, 2026
CVE-2026-108014: HCLSoftware Domino Server: Private keys for eight eMudhra intermediate CA certificates have been compromised…N/A9.1 CriticalN/AOct 27, 2026
CVE-2026-107671: Veeam ONE: A vulnerability allowing an attacker with valid Administrator credentials to bypass multi-factor authentication by…N/A8.5 HighN/AOct 27, 2026
CVE-2026-106078: Veeam Backup for Microsoft 365: A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token…N/A6.9 MediumN/AOct 27, 2026
CVE-2026-106077: Veeam Backup for Microsoft 365: A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on…N/A8.3 HighN/AOct 27, 2026
CVE-2026-106076: Veeam Backup for Microsoft 365: A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of…N/A9.0 CriticalN/AOct 27, 2026
CVE-2026-105781: Adobe Adobe Campaign Classic: Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an SQL Command ('SQL…10.0 CriticalN/AN/AOct 27, 2026
26-50 of 522616