The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-116539: netty: Netty netty-tcnative before 2.0.84.Final contains a heap buffer overflow vulnerability in the tcn_write_to_bytebuffer…5.9 Medium8.2 HighN/AOct 26, 2026
CVE-2026-116538: mganss HtmlSanitizer: HtmlSanitizer before 9.2.1039 and 10.0 prereleases before 10.0.1037-beta contains a cross-site scripting vulnerability…4.7 Medium2.3 LowN/AOct 26, 2026
CVE-2026-116489: timescale pgvectorscale: Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users…7.5 High7.7 HighN/AOct 26, 2026
CVE-2026-85297: Google Cloud Cloud Run MCP: Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to…N/A7.7 HighN/AOct 26, 2026
CVE-2026-90885: Apache Software Foundation Apache Camel: Improper Restriction of XML External Entity Reference vulnerability in Apache Camel Saxon component7.5 HighN/AN/AOct 26, 2026
CVE-2026-77062: boneIO: The boneIO Black web interface lacks proper clickjacking protectionsN/A6.9 MediumN/AOct 26, 2026
CVE-2026-94386: Apache Software Foundation Apache Camel: Use of Cache Containing Sensitive Information vulnerability in Apache Camel Oauth component4.8 MediumN/AN/AOct 26, 2026
CVE-2026-77061: boneIO: boneIO Black directly excludes several API endpoints from the authenticationN/A5.3 MediumN/AOct 26, 2026
CVE-2026-77060: boneIO black_debian_images: boneIO black_debian_images stores the Mosquitto MQTT broker password file at /etc/mosquitto/passwd with world-readable…N/A6.8 MediumN/AOct 26, 2026
CVE-2026-77059: boneIO: boneIO Black contains a TOCTOU race condition in the create_timedatectl_sudoers_file() function in…N/A8.8 HighN/AOct 26, 2026
CVE-2026-59107: WolfVision: A security vulnerability has been identified in the vSolution Matrix file sharing feature9.8 Critical9.2 CriticalN/AOct 26, 2026
CVE-2026-116492: frappe crm: Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged…6.5 Medium7.1 HighN/AOct 26, 2026
CVE-2026-116488: NXP mcuxsdk-middleware-usb: NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio,…6.8 Medium7.0 HighN/AOct 26, 2026
CVE-2026-116487: NXP mcuxsdk-middleware-usb: NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability…4.6 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-116486: easymock objenesis: Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects…4.5 Medium2.0 LowN/AOct 26, 2026
CVE-2026-116485: huangxd- danmu_api: danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify…9.8 Critical9.3 CriticalN/AOct 26, 2026
CVE-2026-116283: n/a Kameleo: A weakness has been identified in Kameleo up to 5.0.1.264.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116282: n/a Kameleo: A security flaw has been discovered in Kameleo up to 5.3.14.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116281: n/a Kameleo: A vulnerability was identified in Kameleo up to 5.0.1.263.3 Low4.8 MediumN/AOct 26, 2026
CVE-2026-116280: n/a Kameleo: A vulnerability was determined in Kameleo up to 5.0.1.265.5 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-116275: AllenAI AllenNLP: A vulnerability was found in AllenAI AllenNLP up to 2.10.16.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116274: n/a JIZHICMS: A vulnerability has been found in JIZHICMS up to 2.5.64.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116219: dolibarr: Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that…7.2 High8.6 HighN/AOct 26, 2026
CVE-2026-116218: dolibarr: Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to…7.6 High7.2 HighN/AOct 26, 2026
CVE-2026-116217: francoisjacquet rosariosis: RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in…6.1 Medium5.3 MediumN/AOct 26, 2026
51-75 of 546512
‹›