The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-55147: aces Loris: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and…6.3 MediumN/AN/AOct 30, 2026
CVE-2026-55146: aces Loris: LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-16760: trailofbits fickling: In Trail of Bits fickling through 0.1.12, the _process_import() method in fickle.py adds an imported name to the…8.8 HighN/AN/AOct 30, 2026
CVE-2026-118938: trailofbits fickling: In Trail of Bits fickling through 0.1.12, a pickle STACK_GLOBAL operand carrying a dotted __qualname__ (for example…8.8 HighN/AN/AOct 30, 2026
CVE-2026-111578: Unknown PDF Invoices & Packing Slips for WooCommerce: The PDF Invoices & Packing Slips for WooCommerce WordPress plugin from 5.16.2 before 5.16.5 does not properly escape…7.5 HighN/AN/AOct 30, 2026
CVE-2026-63344: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit libraryN/A8.6 HighN/AOct 30, 2026
CVE-2026-63345: christianhelle refitter: Refitter is a tool for generating a C# REST API client using the Refit libraryN/A8.6 HighN/AOct 30, 2026
CVE-2026-61725: hasenbanck sevenz-rust2: sevenz-rust2 is a Rust-native 7z compressor and `decompress`or6.1 MediumN/AN/AOct 30, 2026
CVE-2026-63341: moscajs aedes: Aedes is an MQTT broker that can run on any stream server7.5 HighN/AN/AOct 30, 2026
CVE-2026-62991: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel6.5 MediumN/AN/AOct 30, 2026
CVE-2026-62990: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel8.7 HighN/AN/AOct 30, 2026
CVE-2026-62989: shopperlabs shopper: Shopper is a Headless e-commerce Admin Panel8.1 HighN/AN/AOct 30, 2026
CVE-2026-62967: sinamics ztnet: ZTNET is a ZeroTier web UI for private controllers with multiuser and organization support8.1 HighN/AN/AOct 30, 2026
CVE-2026-62966: ESP32Async ESPAsyncWebServer: ESPAsyncWebServer is an asynchronous HTTP and WebSocket server library for ESP32, ESP8266, RP2040 and RP23507.5 HighN/AN/AOct 30, 2026
CVE-2026-62965: sabnzbd: SABnzbd is an open source automated Usenet download toolN/A7.0 HighN/AOct 30, 2026
CVE-2026-62958: libriscv: libriscv is a RISC-V sandbox and emulator7.9 HighN/AN/AOct 30, 2026
CVE-2026-62864: ring-clojure ring: Ring is a Clojure web applications library inspired by Python's WSGI and Ruby's Rack7.5 HighN/AN/AOct 30, 2026
CVE-2026-62863: gojue moling: MoLing is a computer-use and browser-use based MCP server9.6 CriticalN/AN/AOct 30, 2026
CVE-2026-62860: Zoeille picsou-finance: Picsou is a self-hosted personal finance dashboard5.3 MediumN/AN/AOct 30, 2026
CVE-2026-62853: mqttsnet thinglinks: ThingLinks is an enterprise IoT platform9.9 CriticalN/AN/AOct 30, 2026
CVE-2026-62848: Metalama: Metalama is a Roslyn-based open-source patterns and architecture toolkit for C#7.3 HighN/AN/AOct 30, 2026
CVE-2026-62300: filecoin-project filecoin-pin: Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service6.5 MediumN/AN/AOct 30, 2026
CVE-2026-62297: Agamnentzar ag-psd: ag-psd is a JavaScript library for reading and writing Photoshop Document files7.5 HighN/AN/AOct 30, 2026
CVE-2026-59993: h2o picotls: Picotls is a TLS protocol library that allows users select different crypto backends based on their use case6.5 MediumN/AN/AOct 30, 2026
CVE-2026-58412: filecoin-project filecoin-pin: Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service8.2 HighN/AN/AOct 30, 2026
26-50 of 418318