The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-116251: pgadmin.org pgAdmin 4: pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own…4.2 Medium2.3 LowN/AOct 30, 2026
CVE-2026-116250: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…6.5 Medium7.3 HighN/AOct 30, 2026
CVE-2026-116249: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file…8.4 High7.2 HighN/AOct 30, 2026
CVE-2026-116248: pgadmin.org pgAdmin 4: In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the…6.8 Medium6.0 MediumN/AOct 30, 2026
CVE-2026-116247: pgadmin.org pgAdmin 4: When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one…8.2 High7.1 HighN/AOct 30, 2026
CVE-2026-116246: pgadmin.org pgAdmin 4: To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager…6.5 Medium7.0 HighN/AOct 30, 2026
CVE-2026-116245: pgadmin.org pgAdmin 4: libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry…8.2 High7.1 HighN/AOct 30, 2026
CVE-2026-116244: pgadmin.org pgAdmin 4: When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME…8.2 High7.1 HighN/AOct 30, 2026
CVE-2026-116243: pgadmin.org pgAdmin 4: pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences7.5 High7.7 HighN/AOct 30, 2026
CVE-2026-116242: pgadmin.org pgAdmin 4: pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file,…8.2 High7.1 HighN/AOct 30, 2026
CVE-2026-116241: pgadmin.org pgAdmin 4: pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the…9.9 Critical9.4 CriticalN/AOct 30, 2026
CVE-2026-116240: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-116239: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an…8.5 High8.9 HighN/AOct 30, 2026
CVE-2026-116238: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default)8.1 High9.2 CriticalN/AOct 30, 2026
CVE-2026-115830: Delinea Secret Server: In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive…N/A8.7 HighN/AOct 30, 2026
CVE-2026-115829: Delinea Secret Server: In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by…N/A8.7 HighN/AOct 30, 2026
CVE-2026-115828: Delinea Secret Server: In Secret Server versions earlier than 12.3.1, Secret Server did not always validate the PIN or biometric check when…N/A5.1 MediumN/AOct 30, 2026
CVE-2026-62300: filecoin-project filecoin-pin: Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119339: tesseract-ocr tesseract: Tesseract is an open source OCR engine5.5 MediumN/AN/AOct 30, 2026
CVE-2026-58412: filecoin-project filecoin-pin: Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP service8.2 HighN/AN/AOct 30, 2026
CVE-2026-119338: tesseract-ocr tesseract: Tesseract is an open source OCR engineN/A6.9 MediumN/AOct 30, 2026
CVE-2026-94175: Saad Iqbal All In One Login: Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-90888: LeadSnap: Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-7005: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a browser-mediated cross-origin request forgery vulnerability that allows…6.1 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-7004: WIT SynApps Runtime: WIT SynApps Runtime through 1.4.11 contains a pre-authentication reflected cross-site scripting vulnerability that…6.1 Medium5.1 MediumN/AOct 30, 2026
51-75 of 418318