The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-109999: nalam-1: The AI Marketing Expert — AI Email Marketing, AI Content Generator, SEO Analyzer, AI Workflow Automation, Social Media…7.2 HighN/AN/AOct 28, 2026
CVE-2026-107625: ultimatemember: The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin…6.4 MediumN/AN/AOct 28, 2026
CVE-2026-118271: a2ui-project a2ui: A security vulnerability has been detected in a2ui-project a2ui up to 0.10.64.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-106013: artbees Jupiter X Core: The Jupiter X Core plugin for WordPress is vulnerable to Authentication Bypass via the Twitter/X Social Login handler…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-118376: Tencent WeKnora: WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP() that misclassifies…5.3 Medium6.0 MediumN/AOct 28, 2026
CVE-2026-118372: OpenBSD LibreSSL: LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers…3.7 Low6.3 MediumN/AOct 28, 2026
CVE-2026-117609: merbanan rtl_433: rtl_433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2_mc() that allows nearby…7.1 High7.1 HighN/AOct 28, 2026
CVE-2026-117605: nopSolutions nopCommerce: nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController…4.3 Medium5.3 MediumN/AOct 28, 2026
CVE-2014-125136: C97net: C97net qEngine CMS through 6.0.0, Kemana Directory through 1.5.6, and Cart Engine through 3.0.0 contain an information…5.9 Medium8.2 HighN/AOct 28, 2026
CVE-2026-118272: a2ui-project a2ui: A vulnerability was detected in a2ui-project a2ui up to 0.10.64.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-110879: FasterXML jackson-databind: jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-110747: FasterXML jackson-dataformat-protobuf: ProtobufParser._readStringKey() reads the length prefix of a protobuf map entry's string key into an…7.5 HighN/AN/AOct 28, 2026
CVE-2026-118129: jeremyckahn Chitchatter: A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc6.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-104895: FasterXML jackson-dataformat-smile: The asynchronous Smile parser (NonBlockingByteArrayParser) uses a raw-binary length prefix taken from untrusted input…7.5 HighN/AN/AOct 28, 2026
CVE-2026-104016: FasterXML jackson-dataformat-protobuf: ProtobufParser parses length-prefixed protobuf string and bytes fields by checking (_inputPtr + len) <= _inputEnd and…7.5 HighN/AN/AOct 28, 2026
CVE-2026-59158: thoda-dev nuxt-ollama: Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications7.5 HighN/AN/AOct 27, 2026
CVE-2026-58496: thorvg: Thor Vector Graphics (ThorVG) is a production-ready vector graphics engine4.3 MediumN/AN/AOct 27, 2026
CVE-2026-58257: JeromeDevome GRR: GRR is a resource management and reservation application7.2 HighN/AN/AOct 27, 2026
CVE-2026-58256: JeromeDevome GRR: GRR is a resource management and reservation application9.1 CriticalN/AN/AOct 27, 2026
CVE-2026-58205: JeromeDevome GRR: GRR is a resource management and reservation application8.1 HighN/AN/AOct 27, 2026
CVE-2026-22063: NetApp: The private keys of eight eMudhra intermediate CA certificates have been compromisedN/A6.0 MediumN/AOct 27, 2026
CVE-2026-18326: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 27, 2026
CVE-2026-118359: Google Chrome: Memory corruption in V8 in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…8.8 HighN/AN/AOct 27, 2026
CVE-2026-118358: Google Chrome: Memory corruption in WebAudio in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…8.8 HighN/AN/AOct 27, 2026
CVE-2026-118357: Google Chrome: Use after free in FileSystem in Google Chrome prior to 156.0.8078.73 allowed a remote attacker to potentially execute…8.8 HighN/AN/AOct 27, 2026
626-650 of 417096