The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-78402: Thalesgroup Sentinel Keys Server: Stack-based buffer overflow and out-of-bounds write vulnerability in Thales Sentinel Keys Server on Windows allows…7.8 High7.3 HighN/AOct 30, 2026
CVE-2026-62337: axiom-crypto snark-verifier: SNARK Verifier is a generic (S)NARK verifierN/A6.9 MediumN/AOct 30, 2026
CVE-2026-62335: openvm-org openvm: OpenVM is a performant and modular zkVM framework built for customization and extensibilityN/A6.9 MediumN/AOct 30, 2026
CVE-2026-62334: openvm-org openvm: OpenVM is a performant and modular zkVM framework built for customization and extensibilityN/A8.7 HighN/AOct 30, 2026
CVE-2026-62333: openvm-org openvm: OpenVM is a performant and modular zkVM framework built for customization and extensibilityN/A8.7 HighN/AOct 30, 2026
CVE-2026-62302: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websitesN/A8.7 HighN/AOct 30, 2026
CVE-2026-62301: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websitesN/A7.1 HighN/AOct 30, 2026
CVE-2026-62284: osac-project osac-operator: OSAC operator is a Kubernetes operatorN/A8.6 HighN/AOct 30, 2026
CVE-2026-61850: akuity kargo: Kargo manages and automates the promotion of software artifactsN/A9.3 CriticalN/AOct 30, 2026
CVE-2026-61694: LeJamon go-xrpl: go-xrpl is a Go implementation of the XRP Ledger protocol3.7 LowN/AN/AOct 30, 2026
CVE-2026-61620: seancorfield honeysql: HoneySQL turns Clojure data structures into SQL9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-61618: axiom-crypto snark-verifier: SNARK Verifier is a generic (S)NARK verifierN/A6.9 MediumN/AOct 30, 2026
CVE-2026-55598: madeofpendletonwool PinePods: PinePods is a complete, self-hosted podcast management system written in Rust9.1 CriticalN/AN/AOct 30, 2026
CVE-2026-55493: kohler hotcrp: HotCRP is conference review software6.5 MediumN/AN/AOct 30, 2026
CVE-2026-55098: Basekick-Labs arc: Arc is an open, SQL-native time-series database for telemetry6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119730: Maxthon Technology Limited Maxthon Browser for Android: Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote…4.3 Medium5.1 MediumN/AOct 30, 2026
CVE-2026-119337: infiniflow ragflow: RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine7.1 HighN/AN/AOct 30, 2026
CVE-2026-119336: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software7.8 HighN/AN/AOct 30, 2026
CVE-2026-119335: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software7.8 HighN/AN/AOct 30, 2026
CVE-2026-119334: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software2.2 LowN/AN/AOct 30, 2026
CVE-2026-119333: jgraph drawio-desktop: draw.io Desktop is the official Electron build of draw.io7.8 HighN/AN/AOct 30, 2026
CVE-2026-119332: LadybirdBrowser ladybird: Ladybird is a truly independent web browser8.8 HighN/AN/AOct 30, 2026
CVE-2026-119331: LadybirdBrowser ladybird: Ladybird is a truly independent web browser7.1 HighN/AN/AOct 30, 2026
CVE-2026-119330: immich-app immich: Immich is a high-performance self-hosted photo and video management solution3.5 LowN/AN/AOct 30, 2026
CVE-2026-119329: immich-app immich: Immich is a high-performance self-hosted photo and video management solution4.3 MediumN/AN/AOct 30, 2026
51-75 of 418318