The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116585: go-jose: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including…N/A6.9 Medium0%Oct 26, 2026
CVE-2026-116584: lxsmnsyc seroval: Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities7.5 HighN/A0%Oct 26, 2026
CVE-2026-116583: lxsmnsyc seroval: Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilitiesN/A5.3 Medium0%Oct 26, 2026
CVE-2026-116582: lxsmnsyc seroval: Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities4.7 MediumN/A0%Oct 26, 2026
CVE-2026-116581: lxsmnsyc seroval: Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities7.5 HighN/A0%Oct 26, 2026
CVE-2026-116580: lxsmnsyc seroval: Seroval facilitates JavaScript value stringification, including complex structures beyond JSON.stringify capabilities7.3 HighN/A0%Oct 26, 2026
CVE-2026-50096: Esri ArcGIS Server: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may…6.1 MediumN/A0%Oct 26, 2026
CVE-2026-33520: Esri ArcGIS Server: There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may…6.1 MediumN/A0%Oct 26, 2026
CVE-2026-116212: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows…5.4 Medium5.1 Medium0%Oct 26, 2026
CVE-2026-110474: CreditNirvana Agentic AI Call Centre: This vulnerability exists in the CreditNirvana Agentic AI Call Centre application due to hardcoded static API Key in…N/A8.7 High0%Oct 26, 2026
CVE-2026-4316: Zuinq Studio IsMyGym: Reflected Cross-Site Scripting (XSS) in Gym Management Software IsMyGym by Zuinq Studio affecting the reservation…N/A5.1 Medium0%Oct 26, 2026
CVE-2026-103377: Regional Parliament of Castile-La Mancha Video library of the Regional Parliament of Castile-La Mancha: A reflected Cross-Site Scripting (XSS) vulnerability has been identified in the web application of the Castile-La…N/A5.1 Medium0%Oct 26, 2026
CVE-2026-115425: OPNsense OPNsense firewall: Multiple cross site scripting (XSS) vulnerabilities affect OPNsense firewall vesrion 26.7.1_1 and earlier allows low…N/A5.6 Medium0%Oct 26, 2026
CVE-2026-116206: yeswiki: YesWiki from 4.2.0 before 4.7.0 contains a stored cross-site scripting vulnerability that allows authenticated users to…6.4 Medium5.3 Medium0%Oct 25, 2026
CVE-2026-116203: yeswiki: YesWiki before 4.7.0 contains a stored cross-site scripting vulnerability in the filtertags action, which echoes…6.1 Medium5.3 Medium0%Oct 25, 2026
CVE-2026-116169: siyuan-note siyuan: SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit…5.4 Medium5.1 Medium0%Oct 25, 2026
CVE-2026-116167: siyuan-note siyuan: SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page…6.8 Medium7.6 High0%Oct 25, 2026
CVE-2026-116139: WWBN AVideo: WWBN AVideo 26.0 through 29.3.0 contains a stored cross-site scripting vulnerability that allows authenticated…5.4 Medium5.1 Medium0%Oct 25, 2026
CVE-2026-112207: Unknown Download Monitor: The Download Monitor WordPress plugin before 5.3.4 does not properly validate that a clicked link belongs to the site…7.1 HighN/A0%Oct 24, 2026
CVE-2026-105199: Unknown Pixel Tag Manager for WooCommerce: The Pixel Tag Manager for WooCommerce WordPress plugin before 2.2.3 does not perform a capability check in one of its…6.8 MediumN/A0%Oct 24, 2026
CVE-2026-115897: yahoo serialize-javascript: Serialize JavaScript serializes JavaScript values to a superset of JSON that includes regular expressions and functionsN/A2.1 Low0%Oct 23, 2026
CVE-2026-115895: capricorn86 happy-dom: Happy DOM is a JavaScript implementation of a web browser without its graphical user interface8.8 HighN/A0%Oct 23, 2026
CVE-2026-115570: electron: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS7.4 HighN/A0%Oct 23, 2026
CVE-2026-115569: fallow-rs, @fallow-cli: Fallow is a codebase intelligence tool for TypeScript and JavaScript3.3 LowN/A0%Oct 23, 2026
CVE-2026-55486: intranda goobi-viewer-core: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser9.3 CriticalN/A0%Oct 23, 2026
51-75 of 10664