The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-88858: Grafana: A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-118604: Alpine iLX-F511: Alpine iLX-F511 Framework Service Stack-based Buffer Overflow Remote Code Execution Vulnerability6.8 MediumN/AN/AOct 28, 2026
CVE-2026-118603: Alpine iLX-F511: Alpine iLX-F511 vCard Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability8.0 HighN/AN/AOct 28, 2026
CVE-2026-118602: Alpine iLX-F511: Alpine iLX-F511 Fiv.System Exposed Dangerous Method Local Privilege Escalation Vulnerability7.8 HighN/AN/AOct 28, 2026
CVE-2026-118601: Alpine iLX-F511: Alpine iLX-F511 SSH Hard-Coded Credentials Remote Code Execution Vulnerability6.3 MediumN/AN/AOct 28, 2026
CVE-2026-88967: Grafana: A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an…7.7 HighN/AN/AOct 28, 2026
CVE-2026-100105: Grafana: A user with permission to edit contact points but not their protected fields can change protected settings, such as a…7.7 HighN/AN/AOct 28, 2026
CVE-2026-117626: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier improperly identifies file paths attempting path traversal in the…N/AN/AN/AOct 28, 2026
CVE-2026-117625: Jenkins Project Jenkins: A missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read…N/AN/AN/AOct 28, 2026
CVE-2026-117624: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not consistently enforce the restriction on deserializing…N/AN/AN/AOct 28, 2026
CVE-2026-117623: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not escape the text shown in the tooltips of breadcrumb bar…N/AN/AN/AOct 28, 2026
CVE-2026-117622: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows agents to send exceptions implementing the Stapler…N/AN/AN/AOct 28, 2026
CVE-2026-117621: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier computes on the agent the URL of the link shown in the workspace…N/AN/AN/AOct 28, 2026
CVE-2026-117620: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in…N/AN/AN/AOct 28, 2026
CVE-2026-117619: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication,…N/AN/AN/AOct 28, 2026
CVE-2026-117618: Jenkins Project Jenkins: In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not…N/AN/AN/AOct 28, 2026
CVE-2026-117617: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only…N/AN/AN/AOct 28, 2026
CVE-2026-117616: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without…N/AN/AN/AOct 28, 2026
CVE-2026-117615: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being…N/AN/AN/AOct 28, 2026
CVE-2026-117614: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into…N/AN/AN/AOct 28, 2026
CVE-2026-117613: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization,…N/AN/AN/AOct 28, 2026
CVE-2026-117612: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by…N/AN/AN/AOct 28, 2026
CVE-2026-114349: Apache Software Foundation Apache Kafka: When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the…N/AN/AN/AOct 28, 2026
CVE-2026-112375: Apache Software Foundation Apache Kafka: An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or…N/AN/AN/AOct 28, 2026
CVE-2026-116593: Apache Software Foundation Apache Kafka: Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate…N/AN/AN/AOct 28, 2026
26-50 of 417096