The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-111590: Harbor: A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook…N/AN/AN/AOct 26, 2026
CVE-2026-111103: mtrudel bandit: Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated…N/A8.2 HighN/AOct 26, 2026
CVE-2026-111101: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel…N/A8.7 HighN/AOct 26, 2026
CVE-2026-110499: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit…N/A8.7 HighN/AOct 26, 2026
CVE-2026-110475: CreditNirvana CreditNirvana Collections Platform (CollectionWorkz): This vulnerability exists in the CreditNirvana Collections Platform due to improper authentication and authorization…N/A9.3 CriticalN/AOct 26, 2026
CVE-2026-110474: CreditNirvana Agentic AI Call Centre: This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in…N/A8.7 HighN/AOct 26, 2026
CVE-2026-110314: mtrudel bandit: Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit…N/A6.3 MediumN/AOct 26, 2026
CVE-2026-109584: mtrudel bandit: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in the HTTP/2 implementation of mtrudel…N/A8.7 HighN/AOct 26, 2026
CVE-2026-108529: mtrudel bandit: Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an…N/A8.7 HighN/AOct 26, 2026
CVE-2026-108525: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit…N/A8.7 HighN/AOct 26, 2026
CVE-2026-107157: Qt: Specially crafted CBOR input passed to QCborValue::fromCbor() in Qt Core can cause an out-of-bounds read, which may…N/A2.0 LowN/AOct 26, 2026
CVE-2026-107092: n/a: NexoPOS v6.2.4 is vulnerable to Directory Traversal via the api/update endpoint.9.8 CriticalN/AN/AOct 26, 2026
Fortinet FortiSandbox: CVE-2026-107656: Improper access control and session management in the web management interface9.6 CriticalN/AN/AOct 26, 2026
CVE-2026-116219: dolibarr: Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that…7.2 High8.6 HighN/AOct 26, 2026
CVE-2026-116218: dolibarr: Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to…7.6 High7.2 HighN/AOct 26, 2026
CVE-2026-116217: francoisjacquet rosariosis: RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in…6.1 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-96432: qt: A malicious or compromised HTTP/2 server withholding SETTINGS ACK can send RST_STREAM on a completed stream, planting a…N/A2.1 LowN/AOct 26, 2026
CVE-2026-94380: HAVELSAN Inc. Liman MYS: Weak Password Recovery Mechanism for Forgotten Password vulnerability in HAVELSAN Inc8.1 HighN/AN/AOct 26, 2026
CVE-2026-116263: HaschekSolutions PictShare: A flaw has been found in HaschekSolutions PictShare up to 3.7.14.6 Medium1.2 LowN/AOct 26, 2026
CVE-2026-116262: n/a libimobiledevice: A vulnerability was detected in libimobiledevice up to 1.4.05.4 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116261: n/a libimobiledevice: A security vulnerability has been detected in libimobiledevice up to 1.4.03.5 Low2.0 LowN/AOct 26, 2026
CVE-2026-116260: n/a libimobiledevice: A weakness has been identified in libimobiledevice up to 1.4.07.3 High5.5 MediumN/AOct 26, 2026
CVE-2026-115720: frappe builder: Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the…5.0 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-115718: frappe builder: Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt…4.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-115717: frappe builder: Frappe Builder versions before 1.36.1 contain a server-side request forgery vulnerability in the convert_to_webp API…7.7 High6.3 MediumN/AOct 26, 2026
701-725 of 417478