The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116179: vllm-project vllm: vLLM from 0.18.0 before 0.31.0 contains a resource exhaustion vulnerability that allows API clients to bypass the…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116178: vllm-project vllm: vLLM from 0.20.0 before 0.30.0 contains a denial of service vulnerability that allows remote attackers to crash the…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116177: vllm-project vllm: vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116176: vllm-project vllm: vLLM from 0.9.2 before 0.24.0 contains a server-side request forgery vulnerability that allows API callers to force…8.2 High8.8 HighN/AOct 25, 2026
CVE-2026-116175: vllm-project vllm: vLLM from 0.19.0 before 0.24.0 contains a decompression bomb vulnerability because the AudioMediaIO multimodal path…6.5 Medium7.1 HighN/AOct 25, 2026
CVE-2026-116174: vllm-project vllm: vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC Generate and…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116173: vllm-project vllm: vLLM from 0.22.0 before 0.24.0 contains a denial of service vulnerability that allows remote attackers to terminate…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116172: vllm-project vllm: vLLM from 0.22.0 before 0.24.0 contains an improper input validation vulnerability in the Rust gRPC converter that…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116171: siyuan-note siyuan: SiYuan 3.5.4 before 3.8.7 on Windows contains a sensitive-path denylist bypass in IsSensitivePath because the Windows…7.5 High8.7 HighN/AOct 25, 2026
CVE-2026-116170: siyuan-note siyuan: SiYuan before v3.8.7 contains an sql injection vulnerability that allows admin-token holders to read history.db by…4.9 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116169: siyuan-note siyuan: SiYuan from 2.10.0 before 3.8.7 contains a stored cross-site scripting vulnerability that allows users with edit…5.4 Medium5.1 MediumN/AOct 25, 2026
CVE-2026-116168: siyuan-note siyuan: SiYuan before 3.8.7 contains a path traversal vulnerability in the MCP asset tool because validateAssetUploadPaths…6.2 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116167: siyuan-note siyuan: SiYuan from 2.9.0 before 3.8.7 contains a cross-site scripting vulnerability in the unauthenticated /check-auth page…6.8 Medium7.6 HighN/AOct 25, 2026
CVE-2026-116166: siyuan-note siyuan: SiYuan 3.6.0 before 3.8.7 accepts and persists the networkServeTLS setting but never enforces it, so the kernel port…6.8 Medium7.6 HighN/AOct 25, 2026
CVE-2026-116165: parse-community parse-server: Parse Server before 8.6.101 and 9.0.0 before 9.10.4-alpha.4 contains a missing authorization vulnerability on MongoDB…N/A8.8 HighN/AOct 25, 2026
CVE-2026-116164: parse-community parse-server: Parse Server before 8.6.100 and 9.0.0 before 9.10.4-alpha.3 does not reject reserved internal field names in client…N/A6.3 MediumN/AOct 25, 2026
CVE-2026-116163: parse-community parse-server: Parse Server before 8.6.102 and 9.0.0 before 9.10.5-alpha.2 contains an authentication bypass because the…7.4 High9.1 CriticalN/AOct 25, 2026
CVE-2026-116162: parse-community parse-server: Parse Server before 8.6.104 and 9.0.0 before 9.10.5-alpha.5 saves the entire login request with master privileges when…N/A2.1 LowN/AOct 25, 2026
CVE-2026-116161: parse-community parse-server: Parse Server before 8.6.103 and 9.0.0 before 9.10.5-alpha.4 contains an information disclosure vulnerability in…N/A6.0 MediumN/AOct 25, 2026
CVE-2026-116160: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a heap-based buffer overflow in the X11 animate operation…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116159: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of the -cdl (color decision…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116158: ImageMagick: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in the magick compare command caused by missing…2.5 Low2.0 LowN/AOct 25, 2026
CVE-2026-116157: ImageMagick: ImageMagick before 7.1.2-33 contains a memory leak vulnerability in PerlMagick that fails to free values returned when…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116156: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak caused by a missing cleanup when the -set…3.3 Low4.8 MediumN/AOct 25, 2026
CVE-2026-116155: ImageMagick: ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 contains a memory leak in the handling of XMP profiles by various…5.3 Medium6.9 MediumN/AOct 25, 2026
801-825 of 416032