The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118682: KaringX clashmi: KaringX ClashMi through 1.0.32.1801 disables TLS certificate validation by default in the HttpUtils helper, allowing…7.5 High7.7 HighN/AOct 28, 2026
CVE-2026-118669: oauthlib: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+N/A8.4 HighN/AOct 28, 2026
CVE-2026-118538: a2ui-project a2ui: A vulnerability was determined in a2ui-project a2ui up to 0.12.05.5 Medium5.1 MediumN/AOct 28, 2026
CVE-2026-118537: n/a a2ui: A vulnerability was found in a2ui up to 0.10.44.3 Medium5.3 MediumN/AOct 28, 2026
CVE-2026-116641: MongoDB Database Tools: The DB Tools rely on the TLS implementation in Golang’s standard library, which generally uses the system CA store6.8 Medium7.6 HighN/AOct 28, 2026
CVE-2026-54453: OpenCATS: OpenCATS is an open-source applicant tracking system and recruitment CRM for staffing agencies and hiring teams7.2 HighN/AN/AOct 28, 2026
CVE-2026-118668: langchain-ai langgraph-api: langgraph-api implements the LangGraph API for rapid development and testingN/A8.6 HighN/AOct 28, 2026
CVE-2026-118667: langchain-ai: LangGraph Python SDK is used to connect to running LangGraph API servers, manage assistants, threads and stream runs…4.3 MediumN/AN/AOct 28, 2026
CVE-2026-118666: ardatan, @graphql-tools: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemasN/A6.0 MediumN/AOct 28, 2026
CVE-2026-118665: ardatan, @graphql-tools: GraphQL Tools provides utilities for building, stitching, and mocking GraphQL schemasN/A8.2 HighN/AOct 28, 2026
CVE-2026-118664: SamVerschueren decode-uri-component: decode-uri-component provides a more robust alternative to decodeURIComponentN/A8.2 HighN/AOct 28, 2026
CVE-2026-118663: honojs node-server: @hono/node-server allows running the Hono application on Node.js5.3 MediumN/AN/AOct 28, 2026
CVE-2026-118662: vitejs vite: Vite is a frontend tooling framework for JavaScriptN/A6.9 MediumN/AOct 28, 2026
CVE-2026-118661: capricorn86 happy-dom: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface6.5 MediumN/AN/AOct 28, 2026
CVE-2026-118660: capricorn86 happy-dom: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface8.6 HighN/AN/AOct 28, 2026
CVE-2026-118659: capricorn86 happy-dom: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface7.5 HighN/AN/AOct 28, 2026
CVE-2026-118658: labstack echo: Echo is a Go web framework4.7 MediumN/AN/AOct 28, 2026
CVE-2026-118657: labstack echo: Echo is a Go web framework5.9 MediumN/AN/AOct 28, 2026
CVE-2026-118656: labstack echo: Echo is a Go web framework6.1 MediumN/AN/AOct 28, 2026
CVE-2026-118803: Bricks Bricks Theme: Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows…7.5 HighN/AN/AOct 28, 2026
CVE-2026-78674: WSO2: The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted…8.8 HighN/AN/AOct 28, 2026
CVE-2026-76418: Cisco: A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA)…8.6 HighN/AN/AOct 28, 2026
CVE-2026-6647: WSO2: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for…7.4 HighN/AN/AOct 28, 2026
CVE-2026-63190: fearlessgeekmedia FearlessCMS: FearlessCMS is a flat-file `content` management system centered on simplicity and open source9.4 CriticalN/AN/AOct 28, 2026
CVE-2026-61542: drhelius Gearboy: Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server8.6 HighN/AN/AOct 28, 2026
551-575 of 538495