The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-117499: @fastify/session: @fastify/session is a session plugin for Fastify3.7 LowN/AN/AOct 27, 2026
CVE-2026-115408: Eclipse Foundation Eclipse KeyPont: In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions…5.5 MediumN/AN/AOct 27, 2026
CVE-2026-115216: Eclipse Foundation Eclipse ioFog: In Eclipse ioFog Operator versions 3.8.0 before 3.9.2, TLS certificate verification is disabled when the operator…N/A9.1 CriticalN/AOct 27, 2026
CVE-2026-113644: Eclipse Foundation Eclipse ioFog: In Eclipse ioFog iofogctl versions 1.0.0 through 3.7.0 and 3.8.0-rc.1 through 3.9.1, the provisioning key and CA…N/A5.5 MediumN/AOct 27, 2026
CVE-2026-112362: @fastify/express: @fastify/express is a Fastify plugin that runs Express middleware inside Fastify9.1 CriticalN/AN/AOct 27, 2026
CVE-2026-10756: Hitachi Energy TRO600 Series Firmware: TRO600 contains a vulnerability that allows an authenticated attacker to bypass network access restrictions and access…N/A7.7 HighN/AOct 27, 2026
CVE-2026-10752: hwk-fr Advanced Custom Fields: Extended: The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to,…4.8 MediumN/AN/AOct 27, 2026
CVE-2026-109995: wplakeorg Advanced Views – Display Framework – Gutenberg/Elementor/Shortcode: The Advanced Views – Display Framework for Gutenberg & Elementor plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 27, 2026
CVE-2026-106087: Hitachi Energy TRO600 Series Firmware: TRO600 contains an arbitrary file read vulnerabilityN/A8.7 HighN/AOct 27, 2026
CVE-2026-105323: Kulga Software and Telecommunications Limited Company Kulga News Software: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Kulga Software…6.1 MediumN/AN/AOct 27, 2026
CVE-2026-102800: dj-extensions.com DJ-HelpfulArticles extension for Joomla: Joomla Extension - dj-extensions.com - Unauthenticated Stored XSS in DJ-HelpfulArticles < 1.3.0 - The “was this article…N/A8.7 HighN/AOct 27, 2026
CVE-2026-117541: darylldoyle svg-sanitizer: svg-sanitizer from 0.11.0 before 1.1.0 contains an uncaught exception vulnerability that allows attackers to crash…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-117540: darylldoyle svg-sanitizer: svg-sanitizer from 0.5.3 before 1.1.0 contains a denial of service vulnerability in Sanitizer::sanitize() that…7.5 High8.7 HighN/AOct 27, 2026
CVE-2026-117539: darylldoyle svg-sanitizer: darylldoyle svg-sanitizer before 1.0.0 contains CSS injection and remote reference bypass vulnerabilities that allow…3.5 Low5.1 MediumN/AOct 27, 2026
CVE-2026-117538: redaxo core: REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability in the backend packages API, where the…4.1 Medium2.1 LowN/AOct 27, 2026
CVE-2026-117537: redaxo core: REDAXO before 5.21.0 contains a reflected cross-site scripting vulnerability that allows authenticated attackers to…4.1 Medium2.1 LowN/AOct 27, 2026
CVE-2026-117536: redaxo core: REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the backend user administration page…8.8 High8.6 HighN/AOct 27, 2026
CVE-2026-117535: redaxo core: REDAXO before 5.21.3 contains a reflected cross-site scripting vulnerability in the backend media pool detail page,…6.1 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-117534: redaxo core: REDAXO before 5.21.3 contains a cross-site request forgery vulnerability in the structure/history plugin that allows…5.4 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-117533: redaxo core: REDAXO from 5.18.0 before 5.21.4 contains a stored cross-site scripting vulnerability because rex_media_service moves…4.4 Medium2.1 LowN/AOct 27, 2026
CVE-2026-117532: redaxo core: REDAXO core from 5.3.0 before 5.21.4 contains an authentication bypass vulnerability in the structure/history plugin…9.8 Critical9.3 CriticalN/AOct 27, 2026
CVE-2026-117530: JetBrains Junie CLI: In JetBrains Junie CLI before 26.8.17 command execution was possible due to incomplete validation of allowlisted…6.7 MediumN/AN/AOct 27, 2026
CVE-2026-117466: Octopus Deploy Octopus Server: In affected versions of Octopus Server, a user holding the System Manager role could escalate their privileges to full…N/A8.6 HighN/AOct 27, 2026
CVE-2026-117341: Octopus Deploy Octopus Server: In affected versions of Octopus Server, creating a user invitation writes the invitation code to the audit event logN/A7.7 HighN/AOct 27, 2026
CVE-2026-116900: redaxo core: REDAXO before 5.21.4 contains a stored cross-site scripting vulnerability that allows content editors to inject HTML by…5.4 Medium5.1 MediumN/AOct 27, 2026
51-75 of 522616