The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-72758: NLnet Labs Routinator: When parsing an AS range in Routinator, if the maximum value of the range is smaller than the minimum value of the…7.5 HighN/AN/AOct 26, 2026
CVE-2026-72757: NLnet Labs Routinator: Routinator runs out of open connections on the HTTP server when many connections are opened but never closed, leaving…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-72756: NLnet Labs Routinator: Routinator exits when an rsync URI for a file obtained over RRDP contains a path that cannot be stored on disk, such as…7.5 HighN/AN/AOct 26, 2026
CVE-2026-72755: NLnet Labs Routinator: Routinator stores a newly-retrieved TA certificate via HTTPS in cache without validation, potentially overwriting a…3.8 LowN/AN/AOct 26, 2026
CVE-2026-72754: NLnet Labs Routinator: When Routinator encounters a CRL with many entries, it may hang or run out of memory7.5 HighN/AN/AOct 26, 2026
CVE-2026-72753: NLnet Labs Routinator: When Routinator encounters an RRDP notification file with gaps in the delta entries, it is still accepted and parsed,…8.2 HighN/AN/AOct 26, 2026
CVE-2026-72752: NLnet Labs Routinator: Routinator runs out of memory when the JSON output is requested many times concurrently6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116384: Bdtask Garage 24 Garage Management Software: A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.06.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-115913: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115912: vllm-project vllm: vLLM is an inference and serving engine for large language models7.5 HighN/AN/AOct 26, 2026
CVE-2026-116612: GStreamer project gst-editing-services: A flaw was found in GStreamer Editing Services (gst-editing-services)7.8 HighN/AN/AOct 26, 2026
CVE-2026-116395: bPlugins LightBox Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115598: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-114710: WP Chill Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115597: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…5.4 MediumN/AN/AOct 26, 2026
CVE-2026-116388: TMS Amelia: Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-116396: TMS Amelia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116403: Awesomemotive Easy Digital Downloads: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in…5.9 MediumN/AN/AOct 26, 2026
CVE-2026-93846: Mattermost: Mattermost versions 11.7.x <= 11.7.10 fail to restrict which built-in roles can be assigned to a team member via the…3.8 LowN/AN/AOct 26, 2026
CVE-2026-85297: Google Cloud Cloud Run MCP: Bucket Squatting in Google Cloud Run MCP versions prior to 1.11.0 on Google Cloud Platform allows an attacker to…N/A7.7 HighN/AOct 26, 2026
CVE-2026-65226: Rejected reason: This CVE ID has been rejected by runZero as unused.N/AN/AN/AOct 26, 2026
CVE-2026-65222: Rejected reason: The reported issue could not be reproduced, and the affected products are end-of-lifeN/AN/AN/AOct 26, 2026
CVE-2026-65221: Rejected reason: The reported issue was assessed as intended functionalityN/AN/AN/AOct 26, 2026
CVE-2026-65218: Rejected reason: The reported issue is tracked under CVE-2026-18451N/AN/AN/AOct 26, 2026
CVE-2026-65217: Rejected reason: The reported issue could not be reproducedN/AN/AN/AOct 26, 2026
51-75 of 546512