The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-120250: marketcalls OpenAlgo: OpenAlgo 1.0.0.29 before 2.0.3.1 contains an improper certificate validation vulnerability in utils/email_utils.py and…5.3 Medium6.0 MediumN/ANov 1, 2026
CVE-2026-120249: Thelia Thelia Back-office Default Twig Template: Thelia Back-office Default Twig Template before 1.1.1 contains a cross-site request forgery vulnerability in the…6.5 Medium6.9 MediumN/ANov 1, 2026
CVE-2026-120248: Thelia: Thelia before 3.1.1 contains a stored cross-site scripting vulnerability that allows authenticated back-office…4.8 Medium4.6 MediumN/ANov 1, 2026
CVE-2026-120247: FFmpeg: FFmpeg 2.3 through 9.0.2 contains a use of uninitialized resource vulnerability in the Huffyuv decoder that allows…5.5 Medium6.8 MediumN/ANov 1, 2026
CVE-2026-120246: FFmpeg: FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack…5.5 Medium6.8 MediumN/ANov 1, 2026
CVE-2026-120245: FFmpeg: FFmpeg 0.10 through 9.0.2 contains a use of uninitialized resource vulnerability in sunrast_decode_frame() that leaks…5.5 Medium6.8 MediumN/ANov 1, 2026
CVE-2026-120244: FFmpeg: FFmpeg 2.1 through 9.0.2 contains a use of uninitialized resource vulnerability in the PCX decoder that allows…5.5 Medium6.8 MediumN/ANov 1, 2026
CVE-2026-120243: FFmpeg: FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows…5.5 Medium6.8 MediumN/ANov 1, 2026
CVE-2026-120191: n/a Presenton: A weakness has been identified in Presenton up to 0.9.11-beta7.3 High5.5 MediumN/ANov 1, 2026
CVE-2026-120190: n/a PostyBirb Plus: A security flaw has been discovered in PostyBirb Plus up to 3.1.753.5 Low2.0 LowN/ANov 1, 2026
CVE-2026-120189: D-Link DIR-505: A vulnerability was identified in D-Link DIR-505 1.10B0210.0 Critical9.3 CriticalN/ANov 1, 2026
CVE-2026-115946: XS::libbrotli versions before 1.2.1.0 for Perl bundle a brotli library with an out-of-bounds write in the decoderN/AN/AN/ANov 1, 2026
CVE-2026-120185: ken678 YznCMS: A security flaw has been discovered in ken678 YznCMS up to 2.2.04.7 Medium5.1 MediumN/AOct 31, 2026
CVE-2026-120135: Apache Software Foundation Apache Thrift: Uncontrolled Recursion vulnerability in Apache Thrift Java bindingsN/A8.2 HighN/AOct 31, 2026
CVE-2026-118636: Apache Software Foundation Apache MINA: **UNSUPPORTED WHEN ASSIGNED** JavaNativeMessageDecoder in the MINA 3.0 codec module calls…9.8 CriticalN/AN/AOct 31, 2026
CVE-2026-118147: Microsoft: Improper certificate validation in Visual Studio allows an unauthorized attacker to perform spoofing over a network.7.4 HighN/AN/AOct 31, 2026
CVE-2026-120210: FFmpeg: FFmpeg 5.0 through 9.0.2 contains a path traversal vulnerability in the IMF demuxer that allows attackers to open files…4.3 Medium5.3 MediumN/AOct 31, 2026
CVE-2026-120209: anji-plus AJ-Report: AJ-Report through 1.7.1 signs share tokens with a hard-coded JWT secret, allowing attackers to forge valid Share-Tokens…9.8 Critical9.3 CriticalN/AOct 31, 2026
CVE-2026-120208: strukturag libheif: libheif 1.18.0 before 1.23.3 contains a heap-based buffer overflow vulnerability in…7.5 High7.7 HighN/AOct 31, 2026
CVE-2026-120207: Thelia Thelia Page Module: Thelia Page Module before 2.0.4 contains a cross-site request forgery vulnerability that allows remote attackers to…7.1 High7.0 HighN/AOct 31, 2026
CVE-2026-120206: Thelia: Thelia before 3.2.0 contains a cross-site request forgery vulnerability in the back office that allows attackers to…5.9 Medium5.9 MediumN/AOct 31, 2026
CVE-2026-120205: Thelia: Thelia before 3.1.0 contains a stored cross-site scripting vulnerability in ForSomeCustomers::getSummary() that allows…8.0 High7.4 HighN/AOct 31, 2026
CVE-2026-120204: deepseek-ai DeepInfer: DeepInfer through 0.1.0 contains a path traversal vulnerability in the unauthenticated /profile endpoint that allows…5.6 Medium6.3 MediumN/AOct 31, 2026
CVE-2026-120203: ShowDoc: ShowDoc 2.8.14 before 3.9.6 contains a code injection vulnerability in its Mock feature that allows authenticated users…8.8 High8.7 HighN/AOct 31, 2026
CVE-2026-120202: highflame-ai ramparts: Highflame ramparts 0.8.1 through 0.8.10 contains a security scan bypass vulnerability that allows attackers to hide…6.5 Medium7.1 HighN/AOct 31, 2026
51-75 of 420636