The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-102813: TP-Link Systems Inc. RE305 v3: An authentication flaw exists in the password-recovery functionality of TP-Link RE305 V3N/A6.1 MediumN/AOct 27, 2026
CVE-2026-102812: TP-Link Systems Inc.: A hard-coded cryptographic key vulnerability exists in the user-configuration backup mechanism of TP-Link RE305 V3 and…N/A6.9 MediumN/AOct 27, 2026
CVE-2026-118180: Mozilla Thunderbird: When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response…N/AN/AN/AOct 27, 2026
CVE-2026-118179: Mozilla Thunderbird: Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and…N/AN/AN/AOct 27, 2026
CVE-2026-118178: Mozilla Thunderbird: A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored…N/AN/AN/AOct 27, 2026
CVE-2026-118177: Mozilla Thunderbird: When looking for calendars in a directory on a server, during account setup or when adding a new network calendar,…N/AN/AN/AOct 27, 2026
CVE-2026-118176: Mozilla Thunderbird: Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed…N/AN/AN/AOct 27, 2026
CVE-2026-118175: Mozilla Thunderbird: When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different…N/AN/AN/AOct 27, 2026
CVE-2026-118174: Mozilla Thunderbird: When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's…N/AN/AN/AOct 27, 2026
CVE-2026-118173: MISP misp-guard: MISP Guard, a proxy that enforces security policies on MISP feed data, contained an incomplete validation check for…N/A6.1 MediumN/AOct 27, 2026
CVE-2026-115413: AWS aws-api-mcp-server: Missing token audience validation in the OAuth authentication mode of AWS API MCP Server before version 1.6.0 might…7.8 High7.3 HighN/AOct 27, 2026
CVE-2026-118171: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/content-manager package is missing content-scope authorization in the content manager preview URL endpointN/AN/AN/AOct 27, 2026
CVE-2026-118172: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/strapi (Core Admin / Webhook Runner) package is vulnerable to a semi-blind SSRF via a webhook follow-redirectN/AN/AN/AOct 27, 2026
CVE-2026-118170: Strapi Strapi Open Source and Enterprise Headless CMS: The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made…N/AN/AN/AOct 27, 2026
CVE-2026-87897: Nextcloud whiteboard: A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT…4.6 MediumN/AN/AOct 27, 2026
CVE-2026-82986: Nextcloud Tables: The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for…4.6 MediumN/AN/AOct 27, 2026
CVE-2026-82984: Nextcloud Server: When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team…4.3 MediumN/AN/AOct 27, 2026
CVE-2026-82983: Nextcloud Tables: The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting…3.3 LowN/AN/AOct 27, 2026
CVE-2026-77173: Nextcloud Files Confidential: A user could create a docx or odt file with a # in the filename with confidential information such as a credit card…4.3 MediumN/AN/AOct 27, 2026
CVE-2026-77172: Nextcloud Server: App passwords were allowed to bypass password confirmation on sensitive endpoints.5.3 MediumN/AN/AOct 27, 2026
CVE-2026-77171: Nextcloud Collectives: A public shared collective always allowed recipients of the link to create pages.3.5 LowN/AN/AOct 27, 2026
CVE-2026-77167: Nextcloud server: Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table7.5 HighN/AN/AOct 27, 2026
CVE-2026-67400: Nextcloud Richdocuments: A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or…3.5 LowN/AN/AOct 27, 2026
CVE-2026-57201: asterisk: Asterisk is an open source private branch exchange and telephony toolkit7.5 HighN/AN/AOct 27, 2026
CVE-2026-57198: asterisk: Asterisk is an open source private branch exchange and telephony toolkitN/A2.3 LowN/AOct 27, 2026
51-75 of 522616