The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-110183: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence4.3 MediumN/AN/AOct 28, 2026
CVE-2026-110182: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer contains a vulnerability related to the anon.partial() and anon.partial_email() functions4.3 MediumN/AN/AOct 28, 2026
CVE-2026-110181: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer contains a vulnerability related to anonymization functions defined using SQL-standard function…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-116264: Interpretation ConflictN/AN/AN/AOct 28, 2026
CVE-2026-105620: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer doesn't mask data returned by a sub-query in a rule6.5 MediumN/AN/AOct 28, 2026
CVE-2026-105619: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer doesn't mask data accessed thru a security_invoker view4.8 MediumN/AN/AOct 28, 2026
CVE-2026-105618: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer's documentation recommends applying rules on partitions and inheritance tables5.7 MediumN/AN/AOct 28, 2026
CVE-2026-105617: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer doesn't invalidate plans prepared after a rule was added or a role changed5.7 MediumN/AN/AOct 28, 2026
CVE-2026-105616: DALIBO PostgreSQL Anonymizer: PostgreSQL restricts acces to the salt and shift via the `SHOW` command for users not member of `pg_read_all_settings`5.7 MediumN/AN/AOct 28, 2026
CVE-2026-105615: DALIBO PostgreSQL Anonymizer: PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table3.5 LowN/AN/AOct 28, 2026
CVE-2026-105614: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer's `anon.image_blur()` function doesn't check the declared dimension of the provided image,…4.7 MediumN/AN/AOct 28, 2026
CVE-2026-105613: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer's range-based dummy functions dont constraint the range size4.7 MediumN/AN/AOct 28, 2026
CVE-2026-105612: DALIBO PostgreSQL Anonymizer: PostgreSQL Anonymizer contains a vulnerability that data-modifying CTEs to bypass the read-only restriction of masked…3.5 LowN/AN/AOct 28, 2026
CVE-2026-118242: highcharts, @highcharts: Highcharts JS is a JavaScript charting library based on SVGN/A8.5 HighN/AOct 28, 2026
CVE-2026-84725: Red Hat: when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attacker-supplied CDR codebase URLs during object…8.1 HighN/AN/AOct 28, 2026
CVE-2026-116797: highcharts, @highcharts: Highcharts JS is a JavaScript charting library based on SVGN/A8.5 HighN/AOct 28, 2026
CVE-2026-79656: Grafana: A user with read access to Grafana's server logs, or to a log store they are shipped to, can recover the OAuth and OIDC…6.0 MediumN/AN/AOct 28, 2026
CVE-2026-116796: highcharts: Highcharts JS is a JavaScript charting library based on SVGN/A7.2 HighN/AOct 28, 2026
CVE-2026-93536: x.org: A use after free caused by missing lifecycle management of gesture sprites in GestureBuildSprite() in X.Org X Server…5.3 MediumN/AN/AOct 28, 2026
CVE-2026-93524: x.org: A buffer overread in CheckKeySyms() in X.Org X Server before 21.1.25 and XWayland before 24.1.14 could be used by…N/A6.9 MediumN/AOct 28, 2026
CVE-2026-93523: x.org: A heap buffer overflow caused by a XIPassiveUngrabDevice request with an out-of-range modifier value in X.Org X Server…7.8 HighN/AN/AOct 28, 2026
CVE-2026-88967: Grafana: A user with query access to an Azure Monitor data source in Grafana can cause server-side requests to an…7.7 HighN/AN/AOct 28, 2026
CVE-2026-88858: Grafana: A user with the Viewer role in Grafana can crash the server by submitting a crafted server-side math expression…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-83525: Apache Software Foundation Apache Kafka: Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0…N/AN/AN/AOct 28, 2026
CVE-2026-82962: zephyrproject zephyr: ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepend the Ethernet header in place, by pushing it…6.5 MediumN/AN/AOct 28, 2026
76-100 of 413066