The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-42057: vtk: An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.67.5 HighN/AN/AOct 29, 2026
CVE-2026-41216: vtk: An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.67.5 HighN/AN/AOct 29, 2026
CVE-2026-119251: Ubiquiti Inc WiFiman Desktop for macOS: A malicious actor with local access and high privileges could exploit an Improper Access Control vulnerability found in…6.7 MediumN/AN/AOct 29, 2026
CVE-2026-119250: Ubiquiti Inc WiFiman Desktop for macOS: A malicious actor with local access and low privileges could exploit an External Control of File Name or Path…7.8 HighN/AN/AOct 29, 2026
CVE-2026-119249: Ubiquiti Inc WiFiman Desktop for macOS: A malicious actor with access to the network could exploit a Binding to an Unrestricted IP Address vulnerability found…7.5 HighN/AN/AOct 29, 2026
CVE-2026-119168: HashiCorp: HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration…8.8 HighN/AN/AOct 29, 2026
CVE-2026-118782: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript7.5 HighN/AN/AOct 29, 2026
CVE-2026-118781: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript2.9 LowN/AN/AOct 29, 2026
CVE-2026-118780: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript3.7 LowN/AN/AOct 29, 2026
CVE-2026-118779: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript7.5 HighN/AN/AOct 29, 2026
CVE-2026-118778: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript5.9 MediumN/AN/AOct 29, 2026
CVE-2026-118777: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript4.8 MediumN/AN/AOct 29, 2026
CVE-2026-118776: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript3.7 LowN/AN/AOct 29, 2026
CVE-2026-118775: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript3.7 LowN/AN/AOct 29, 2026
CVE-2026-118774: digitalbazaar forge: Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript3.7 LowN/AN/AOct 29, 2026
CVE-2026-118773: isaacs node-glob: Glob matches files using patterns the shell usesN/A6.3 MediumN/AOct 29, 2026
CVE-2026-118772: hapijs, @hapi joi: joi is a schema description language and data validator for JavaScript7.5 HighN/AN/AOct 29, 2026
CVE-2026-103094: ServiceNow ServiceNow AI Platform: ServiceNow has remediated an information disclosure vulnerability that was identified in the ServiceNow AI PlatformN/A7.1 HighN/AOct 29, 2026
CVE-2026-103093: ServiceNow ServiceNow AI Platform: ServiceNow has remediated a sandbox escape security issue that was identified in the ServiceNow AI PlatformN/A9.4 CriticalN/AOct 29, 2026
CVE-2026-60111: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 29, 2026
CVE-2026-51912: n/a: OpenBMB XAgent v1.0.0 contains directory traversal vulnerability in…N/AN/AN/AOct 29, 2026
CVE-2026-51905: n/a: TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in…N/AN/AN/AOct 29, 2026
CVE-2026-51903: n/a: SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in…N/AN/AN/AOct 29, 2026
CVE-2026-51902: n/a: SuperAGI up to v0.0.14 contains an improper access control vulnerabilityN/AN/AN/AOct 29, 2026
CVE-2026-51863: n/a: DB-GPT v0.7.5 and 0.8.0 contains directory traversal in use_example_file…N/AN/AN/AOct 29, 2026
51-75 of 538495