The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119707: SonicJs-Org sonicjs: SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…9.8 Critical9.3 CriticalN/AOct 30, 2026
CVE-2026-119705: towfiqi serpbear: SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119704: BastilleBSD bastille: Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that…6.8 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119703: xinnan-tech xiaozhi-esp32-server: xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that…4.8 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-119702: WPGraphQL: WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119701: WPGraphQL: WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119700: WPGraphQL: WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119699: WPGraphQL WPGraphQL Smart Cache: WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-104067: Scribus: Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104066: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104065: Scribus: Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104064: Scribus: Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104063: Scribus: Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when…6.1 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-104062: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104061: Scribus: Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119369: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119479: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-116407: Webba Plugins Webba Booking: Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-118238: Tenda W18E: The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature…N/AN/AN/AOct 30, 2026
CVE-2026-119368: Liquid Web / StellarWP The Events Calendar: Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119482: Crocoblock JetFormBuilder: Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-46499: CollaboraOnline online: Collabora Online is a collaborative online office suite based on LibreOffice technology4.3 MediumN/AN/AOct 30, 2026
CVE-2026-48164: CollaboraOnline online: Collabora Online is a collaborative online office suite based on LibreOffice technology4.7 MediumN/AN/AOct 30, 2026
CVE-2026-93327: Google Cloud Application Integration: A Deserialization of Untrusted Data vulnerability in the SubWorkflow task in Google Cloud Application Integration…N/A9.4 CriticalN/AOct 30, 2026
26-50 of 413289