The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-57448: mrblomblo blombooru: Blombooru is a self-hosted personal booru for organizing and tagging private image collectionsN/A6.2 MediumN/AOct 28, 2026
CVE-2026-54455: OpenCATS: OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams7.6 HighN/AN/AOct 28, 2026
CVE-2026-118804: Bricks Bricks Builder: Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to…7.5 HighN/AN/AOct 28, 2026
CVE-2026-118757: PI Websolution PiWeb Disable payment method / Partial payment for WooCommerce: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization…6.5 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-118756: gopasspw gopass: gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to…5.5 Medium6.7 MediumN/AOct 28, 2026
CVE-2026-118755: Volmarg personal-management-system: Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows…7.2 High8.6 HighN/AOct 28, 2026
CVE-2026-118754: Dolibarr Dolibarr ERP/CRM: Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php…5.3 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-118753: danoli3, FreeImage FreeImage: FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows…7.8 High8.5 HighN/AOct 28, 2026
CVE-2026-118752: danoli3, FreeImage FreeImage: FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of…7.8 High8.5 HighN/AOct 28, 2026
CVE-2026-118694: trentm python-markdown2: python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by…7.5 High8.7 HighN/AOct 28, 2026
CVE-2026-118693: giuspen cherrytree: CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that…4.7 Medium5.6 MediumN/AOct 28, 2026
CVE-2026-118692: giuspen cherrytree: CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows…7.0 High7.1 HighN/AOct 28, 2026
CVE-2026-118691: GuDong2003 xianyu-auto-reply-fix: xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint…3.7 Low6.3 MediumN/AOct 28, 2026
CVE-2026-118690: SignalK signalk-server: Signal K Server before 2.33.0 contains a missing authentication vulnerability that allows unauthenticated remote…9.8 Critical9.3 CriticalN/AOct 28, 2026
CVE-2026-118689: OvenMediaLabs OvenMediaEngine: OvenMediaEngine through 0.21.0 contains a denial of service vulnerability in OvtPacket::LoadHeader() that allows…7.5 High8.7 HighN/AOct 28, 2026
CVE-2026-118682: KaringX clashmi: KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing…7.5 High7.7 HighN/AOct 28, 2026
CVE-2026-118669: oauthlib: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+N/A8.4 HighN/AOct 28, 2026
CVE-2026-118538: a2ui-project a2ui: A vulnerability was determined in a2ui-project a2ui up to 0.12.05.5 Medium5.1 MediumN/AOct 28, 2026
CVE-2026-118537: n/a a2ui: A vulnerability was found in a2ui up to 0.10.44.3 Medium5.3 MediumN/AOct 28, 2026
CVE-2026-116641: MongoDB Database Tools: The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store6.8 Medium7.6 HighN/AOct 28, 2026
CVE-2026-54453: OpenCATS: OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams7.2 HighN/AN/AOct 28, 2026
CVE-2026-118668: langchain-ai langgraph-api: langgraph-api implements the LangGraph API for rapid development and testingN/A8.6 HighN/AOct 28, 2026
CVE-2026-118667: langchain-ai: LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs…4.3 MediumN/AN/AOct 28, 2026
CVE-2026-118666: ardatan, @graphql-tools: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemasN/A6.0 MediumN/AOct 28, 2026
CVE-2026-118665: ardatan, @graphql-tools: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemasN/A8.2 HighN/AOct 28, 2026
551-575 of 538495