The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-118657: labstack echo: Echo is a Go web framework5.9 MediumN/AN/AOct 28, 2026
CVE-2026-118656: labstack echo: Echo is a Go web framework6.1 MediumN/AN/AOct 28, 2026
CVE-2026-78674: WSO2: The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted…8.8 HighN/AN/AOct 28, 2026
CVE-2026-6647: WSO2: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for…7.4 HighN/AN/AOct 28, 2026
CVE-2026-63190: fearlessgeekmedia FearlessCMS: FearlessCMS is a flat-file `content` management system centered on simplicity and open source9.4 CriticalN/AN/AOct 28, 2026
CVE-2026-61542: drhelius Gearboy: Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server8.6 HighN/AN/AOct 28, 2026
CVE-2026-61529: endatix: Endatix is a self-hosted form and survey management platform with a headless API4.7 MediumN/AN/AOct 28, 2026
CVE-2026-54162: alexandre-daubois ember: Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support4.7 MediumN/AN/AOct 28, 2026
CVE-2026-3583: WSO2: When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately…3.1 LowN/AN/AOct 28, 2026
CVE-2026-13451: Red Hat Red Hat OpenShift AI (RHOAI): A flaw was found in KServe7.7 HighN/AN/AOct 28, 2026
CVE-2026-11854: WSO2: The authentication endpoint generates an error message that includes reflected data directly from the request without…6.1 MediumN/AN/AOct 28, 2026
CVE-2026-118655: labstack echo: Echo is a Go web framework5.9 MediumN/AN/AOct 28, 2026
CVE-2026-118654: labstack echo: Echo is a Go web framework5.9 MediumN/AN/AOct 28, 2026
CVE-2026-118653: labstack echo: Echo is a Go web framework5.3 MediumN/AN/AOct 28, 2026
CVE-2026-118652: labstack echo: Echo is a Go web framework6.1 MediumN/AN/AOct 28, 2026
CVE-2026-118651: labstack echo: Echo is a Go web framework5.3 MediumN/AN/AOct 28, 2026
CVE-2026-118650: labstack echo: Echo is a Go web framework7.5 HighN/AN/AOct 28, 2026
CVE-2026-118266: labstack echo: Echo is a Go web framework5.3 MediumN/AN/AOct 28, 2026
CVE-2026-117574: Red Hat Red Hat OpenShift AI (RHOAI): A flaw was found in ai-gateway-payload-processing9.1 CriticalN/AN/AOct 28, 2026
CVE-2026-115415: amazon strands-agents-tools: Improper neutralization of input used for LLM prompting in the environment tool in Strands Agents Tools before 0.8.6…6.5 Medium5.9 MediumN/AOct 28, 2026
CVE-2026-109411: Samba, Red Hat: An access control bypass flaw was found in Samba's vfs_ceph_rgw module in it's openat() function8.1 HighN/AN/AOct 28, 2026
CVE-2025-14260: WSO2: Due to the improper implementation of access control rules, the WSO2 product accepts user-supplied input related to…8.3 HighN/AN/AOct 28, 2026
CVE-2026-76418: Cisco: A vulnerability in the Remote Access SSL VPN service of Cisco Secure Firewall Adaptive Security Appliance (ASA)…8.6 HighN/AN/AOct 28, 2026
CVE-2026-118688: bytecodealliance wasmtime: wasmtime-wasi in Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 re-appends a trailing slash to…7.9 High8.8 HighN/AOct 28, 2026
CVE-2026-118687: coder: Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does…6.5 Medium8.3 HighN/AOct 28, 2026
51-75 of 413066