The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-118687: coder: Coder before 2.29.21, 2.30.0 before 2.34.12, 2.35.0 before 2.35.9, 2.36.0 before 2.36.7, and 2.37.0 before 2.37.4 does…6.5 Medium8.3 HighN/AOct 28, 2026
CVE-2026-118686: espocrm: EspoCRM before 9.3.11 and 10.x before 10.0.8 contains a denial of service vulnerability in which the password-redaction…7.5 High8.7 HighN/AOct 28, 2026
CVE-2026-118685: ToolJet: ToolJet from 3.20.2-lts before 3.20.242-lts contains an authorization bypass in SignupDisableGuard, which treats the…6.5 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-118684: Project-MONAI MONAI: MONAI before 1.6.1 contains an insufficient integrity verification vulnerability in check_hash() that silently returns…5.9 Medium8.2 HighN/AOct 28, 2026
CVE-2026-118683: Project-MONAI MONAI: MONAI from 1.2.0 before 1.6.1 contains a remote code execution vulnerability in ConfigWorkflow.__init__, which passes a…8.8 High8.6 HighN/AOct 28, 2026
CVE-2026-118681: go-chi chi: go-chi chi before 5.5.0 contains an authentication bypass in middleware.SupressNotFound, which calls Match with the…3.7 Low6.3 MediumN/AOct 28, 2026
CVE-2026-118680: siyuan-note siyuan: SiYuan 3.8.7 through 3.8.8 fails to normalize Windows GLOBALROOT device-namespace aliases, bypassing the…4.4 Medium5.9 MediumN/AOct 28, 2026
CVE-2026-118679: n8n-io n8n: n8n before 1.123.83, 2.41.4, and 2.42.1 contains a server-side request forgery vulnerability in the Slack Trigger…7.5 High6.9 MediumN/AOct 28, 2026
CVE-2026-118678: n8n-io n8n: n8n before 2.41.4 and 2.42.x before 2.42.1 contains a prototype pollution vulnerability that allows low-privileged…7.1 High7.1 HighN/AOct 28, 2026
CVE-2026-118677: n8n-io n8n: n8n before 2.41.4 and 2.42.x before 2.42.1 contains a missing confirmation vulnerability in the Local Gateway desktop…5.9 Medium5.9 MediumN/AOct 28, 2026
CVE-2026-118676: n8n-io n8n: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows member users to use…7.1 High5.1 MediumN/AOct 28, 2026
CVE-2026-118675: n8n-io n8n: n8n before 1.123.85, 2.43.5, and 2.44.1 contains a credential guard bypass vulnerability that allows editors of shared…7.1 High5.1 MediumN/AOct 28, 2026
CVE-2026-118649: n8n-io n8n: n8n before 2.43.5 and 2.44.x before 2.44.1 accepts a client-supplied workflow ID and caches each workflow's owner…8.3 High8.7 HighN/AOct 28, 2026
CVE-2026-118648: n8n-io n8n: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a stored cross-site scripting vulnerability…7.3 High8.4 HighN/AOct 28, 2026
CVE-2026-118647: n8n-io n8n: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 saves the SeaTable Trigger node's API token in error…8.2 High5.3 MediumN/AOct 28, 2026
CVE-2026-118646: n8n-io n8n: n8n before 1.123.85, 2.43.5, and 2.44.1 contains a regular expression denial of service vulnerability that allows…6.5 Medium7.1 HighN/AOct 28, 2026
CVE-2026-118645: n8n-io n8n: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains a filter injection vulnerability in the Quick…8.7 High7.0 HighN/AOct 28, 2026
CVE-2026-118644: n8n-io n8n: n8n before 2.41.5 and 2.42.x before 2.42.2 passes a failed workflow's full execution context, including the identity of…7.7 High5.1 MediumN/AOct 28, 2026
CVE-2026-118643: n8n-io n8n: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 stores credential secrets in execution error data when…8.2 High5.3 MediumN/AOct 28, 2026
CVE-2026-118642: n8n-io n8n: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability that allows authenticated…7.1 High5.1 MediumN/AOct 28, 2026
CVE-2026-118641: n8n-io n8n: n8n before 1.123.85, 2.x before 2.43.5, and 2.44.x before 2.44.1 contains an OData $filter injection vulnerability in…7.5 High6.9 MediumN/AOct 28, 2026
CVE-2026-118640: n8n-io n8n: n8n before 1.123.85, 2.43.5, and 2.44.1 contains an authorization bypass vulnerability in Chat Hub that allows…5.4 Medium5.3 MediumN/AOct 28, 2026
CVE-2026-118633: Sophos SG UTM: A path traversal vulnerability allows a remote unauthenticated attacker to execute arbitrary code as root in Sophos UTM…8.1 High9.2 CriticalN/AOct 28, 2026
CVE-2026-118265: labstack echo: Echo is a Go web framework5.3 MediumN/AN/AOct 28, 2026
CVE-2026-118264: labstack echo: Echo is a Go web frameworkN/A9.1 CriticalN/AOct 28, 2026
51-75 of 413066