The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118664: Uncontrolled Resource ConsumptionN/A8.2 HighN/AOct 28, 2026
CVE-2026-118663: Double Decoding of the Same Data5.3 MediumN/AN/AOct 28, 2026
CVE-2026-118662: Incorrect Behavior Order: Validate Before CanonicalizeN/A6.9 MediumN/AOct 28, 2026
CVE-2026-118661: Reliance on Cookies without Validation and Integrity Checking6.5 MediumN/AN/AOct 28, 2026
CVE-2026-118660: Server-Side Request Forgery (SSRF)8.6 HighN/AN/AOct 28, 2026
CVE-2026-118659: Server-Side Request Forgery (SSRF)7.5 HighN/AN/AOct 28, 2026
CVE-2026-118658: URL Redirection to Untrusted Site4.7 MediumN/AN/AOct 28, 2026
CVE-2026-118657: Origin Validation Error5.9 MediumN/AN/AOct 28, 2026
CVE-2026-118656: URL Redirection to Untrusted Site6.1 MediumN/AN/AOct 28, 2026
CVE-2026-78674: WSO2: The BPMN System REST APIs do not sufficiently validate input parameters, allowing authenticated users to submit crafted…8.8 HighN/AN/AOct 28, 2026
CVE-2026-6647: WSO2: In deployments of WSO2 Identity Server configured with a case-insensitive user store and a case-sensitive database for…7.4 HighN/AN/AOct 28, 2026
CVE-2026-63190: fearlessgeekmedia FearlessCMS: FearlessCMS is a flat-file `content` management system centered on simplicity and open source9.4 CriticalN/AN/AOct 28, 2026
CVE-2026-61542: drhelius Gearboy: Gearboy is a Game Boy, Game Boy Color, and Super Game Boy emulator and debugger with an embedded MCP server8.6 HighN/AN/AOct 28, 2026
CVE-2026-61529: endatix: Endatix is a self-hosted form and survey management platform with a headless API4.7 MediumN/AN/AOct 28, 2026
CVE-2026-54162: alexandre-daubois ember: Ember is a real-time terminal dashboard for Caddy servers with FrankenPHP support4.7 MediumN/AN/AOct 28, 2026
CVE-2026-3583: WSO2: When the `allowed_scopes` configuration is enabled, the OAuth2 token introspection mechanism does not immediately…3.1 LowN/AN/AOct 28, 2026
CVE-2026-13451: Server-Side Request Forgery (SSRF)7.7 HighN/AN/AOct 28, 2026
CVE-2026-11854: Improper Neutralization of Input During Web Page Generation6.1 MediumN/AN/AOct 28, 2026
CVE-2026-118655: Double Decoding of the Same Data5.9 MediumN/AN/AOct 28, 2026
CVE-2026-118654: Improper Limitation of a Pathname to a Restricted Directory5.9 MediumN/AN/AOct 28, 2026
CVE-2026-118653: Authentication Bypass by Spoofing5.3 MediumN/AN/AOct 28, 2026
CVE-2026-118652: Improper Neutralization of Input During Web Page Generation6.1 MediumN/AN/AOct 28, 2026
CVE-2026-118651: Origin Validation Error5.3 MediumN/AN/AOct 28, 2026
CVE-2026-118650: Improper Handling of URL Encoding (Hex Encoding)7.5 HighN/AN/AOct 28, 2026
CVE-2026-118266: Cross-Site Request Forgery (CSRF)5.3 MediumN/AN/AOct 28, 2026
776-800 of 415341