The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-50539: xibosignage xibo-cms: Xibo is an open source digital signage platform with a web content management system and Windows display player software6.5 MediumN/AN/AOct 28, 2026
CVE-2026-44179: xwikisas xwiki-pro-macros: XWiki Remote Macros provides XWiki rendering macros that are useful when migrating content from Confluence9.9 CriticalN/AN/AOct 28, 2026
CVE-2026-118029: aws aws-sdk-pandas: Unverified ownership of the default query result location in the Athena module in AWS SDK for pandas (awswrangler)…5.9 Medium5.9 MediumN/AOct 28, 2026
CVE-2026-116778: fogproject: FOG is a free open-source cloning/imaging/rescue suite/inventory management system8.8 HighN/AN/AOct 28, 2026
CVE-2026-112357: GFI USA, LLC GFI KerioConnect: GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local…7.8 High8.5 HighN/AOct 28, 2026
CVE-2026-112356: GFI USA, LLC GFI KerioConnect: GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail…6.1 Medium5.1 MediumN/AOct 28, 2026
CVE-2026-116776: n-romanovich usb-test: USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB…N/A7.0 HighN/AOct 28, 2026
CVE-2026-47235: simulationcraft simc: SimulationCraft is a tool to explore combat mechanics in World of WarcraftN/A7.5 HighN/AOct 28, 2026
Alma Linux: CVE-2026-93520: Important: xorg-x11-server security update (Multiple Advisories)7.8 HighN/AN/AOct 28, 2026
Alma Linux: CVE-2026-93519: Important: xorg-x11-server security update (Multiple Advisories)7.8 HighN/AN/AOct 28, 2026
Alma Linux: CVE-2026-93518: Important: xorg-x11-server security update (Multiple Advisories)7.8 HighN/AN/AOct 28, 2026
CVE-2026-115402: OpenVPN ovpn-dco-win: OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash)…N/A5.7 MediumN/AOct 28, 2026
CVE-2026-106972: n/a: Uncontrolled recursion in MessagePack\BufferUnpacker::unpack() in rybakit/msgpack versions prior to 0.11.0 allows…N/AN/AN/AOct 28, 2026
CVE-2026-106971: n/a: An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack versions prior to 0.11.0 allows…N/AN/AN/AOct 28, 2026
Alma Linux: CVE-2026-93517: Important: xorg-x11-server security update (Multiple Advisories)N/A8.5 HighN/AOct 28, 2026
CVE-2026-59185: identrail: identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes8.5 HighN/AN/AOct 28, 2026
CVE-2026-59177: esphome device-builder: ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software8.8 HighN/AN/AOct 28, 2026
CVE-2026-59176: jordanburke functype: Functype is a family of TypeScript functional programming libraries7.8 HighN/AN/AOct 28, 2026
CVE-2026-59172: candid82 joker: Joker is a small Clojure interpreter, linter and formatter written in Go7.8 HighN/AN/AOct 28, 2026
CVE-2026-52729: xibosignage xibo-cms: Xibo is an open source digital signage platform with a web content management system and Windows display player software7.1 HighN/AN/AOct 28, 2026
CVE-2026-50541: xibosignage xibo-cms: Xibo is an open source digital signage platform with a web content management system and Windows display player software6.5 MediumN/AN/AOct 28, 2026
CVE-2026-116390: stepasyuk Filter Everything — WordPress & WooCommerce Filters: Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce…7.2 HighN/AN/AOct 28, 2026
CVE-2026-116389: crossi72 Phoenix Media Rename: Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object…8.8 HighN/AN/AOct 28, 2026
CVE-2026-116078: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit…N/A8.7 HighN/AOct 28, 2026
CVE-2026-115968: Ultimate Member: Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object…9.8 CriticalN/AN/AOct 28, 2026
726-750 of 538495