The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-93849: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-93848: Mattermost: Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery…2.7 LowN/AN/AOct 26, 2026
CVE-2026-93847: Mattermost: Mattermost versions 11.7.x <= 11.7.10 fail to validate reserved system post types on the scheduled post creation and…3.5 LowN/AN/AOct 26, 2026
CVE-2026-93328: Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox): Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases…N/A9.3 CriticalN/AOct 26, 2026
CVE-2026-92171: Red Hat Red Hat Data Grid 8: A flaw was found in the Infinispan Operator for Red Hat Data Grid6.5 MediumN/AN/AOct 26, 2026
CVE-2026-90885: Apache Software Foundation Apache Camel: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component7.5 HighN/AN/AOct 26, 2026
CVE-2026-77062: boneIO: The boneIO Black web interface lacks proper clickjacking protectionsN/A6.9 MediumN/AOct 26, 2026
CVE-2026-77061: boneIO: boneIO Black directly excludes several API endpoints from the authenticationN/A5.3 MediumN/AOct 26, 2026
CVE-2026-77060: boneIO black_debian_images: boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable…N/A6.8 MediumN/AOct 26, 2026
CVE-2026-77059: boneIO: boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in…N/A8.8 HighN/AOct 26, 2026
CVE-2026-77058: boneIO: boneIO Black is vulnerable to Cross-Site Request Forgery (CSRF) on all state-changing API endpoints because it lacks…N/A5.1 MediumN/AOct 26, 2026
CVE-2026-77057: boneIO: boneIO Black does not limit authentication attempts on its web interface (POST /api/login) or SSH service, and does not…N/A2.3 LowN/AOct 26, 2026
CVE-2026-77056: boneIO black_debian_images: boneIO black_debian_images ships with a Mosquitto MQTT broker that uses the same default credentials on all devicesN/A7.1 HighN/AOct 26, 2026
CVE-2026-77055: boneIO black_debian_images: boneIO black_debian_images gives the boneio service account excessive privileges, including full passwordless sudo…N/A9.3 CriticalN/AOct 26, 2026
CVE-2026-77054: boneIO: boneIO Black stores passwords, including the MQTT broker and web panel passwords, in cleartextN/A6.9 MediumN/AOct 26, 2026
CVE-2026-77053: boneIO: boneIO Black firmware ships with authentication disabled by defaultN/A8.7 HighN/AOct 26, 2026
CVE-2026-77052: boneIO: boneIO Black exposes a Node-RED instance without authentication at the /nodered/ path through a Caddy reverse proxyN/A8.7 HighN/AOct 26, 2026
CVE-2026-65184: Vertiv Avocent ACS8000: The root-privileged `wsserver` terminal-bridge daemon builds a shell command from client-supplied WebSocket fields and…9.8 CriticalN/AN/AOct 26, 2026
CVE-2026-3322: Lobster DATA GmbH Lobster_pro: Due to improper permission checks in Lobster_pro, attackers are able to interact with endpoints that should require…N/A5.6 MediumN/AOct 26, 2026
CVE-2026-36698: n/a: Xovis AG APS-R-POE, APS-R-POE-PP, APS-R, APS-R-POE-USB, and APS-B 2.10.1.1 and earlier contains an OS command injection…N/AN/AN/AOct 26, 2026
CVE-2026-31158: n/a: SQL Injection vulnerability in CRM SOFTTRADE Infotech (aka softtradeindia) 1.0 allows a remote attacker to execute…N/AN/AN/AOct 26, 2026
CVE-2026-116497: Red Hat: A NULL pointer dereference vulnerability was found in gssproxy5.5 MediumN/AN/AOct 26, 2026
CVE-2026-116340: iFlytek astron-agent: A vulnerability was identified in iFlytek astron-agent up to 1.1.24.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116339: iFlytek astron-agent: A vulnerability was determined in iFlytek astron-agent up to 1.1.27.3 High5.5 MediumN/AOct 26, 2026
CVE-2026-116284: n/a Kameleo: A security vulnerability has been detected in Kameleo up to 5.3.14.3 Medium5.3 MediumN/AOct 26, 2026
501-525 of 416032