The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119712: pipeshub-ai: PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that…6.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119711: pipeshub-ai: PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119710: pipeshub-ai: PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119709: goniszewski grimoire: Grimoire before 1.0.0 contains an unauthenticated server-side request forgery vulnerability in the /api/fetch-metadata…5.8 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119708: colinin abp-next-admin: abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119707: SonicJs-Org sonicjs: SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…9.8 Critical9.3 CriticalN/AOct 30, 2026
CVE-2026-119705: towfiqi serpbear: SerpBear before 3.1.1 contains a missing authentication vulnerability in pages/api/notify.ts that allows remote…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119704: BastilleBSD bastille: Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that…6.8 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119703: xinnan-tech xiaozhi-esp32-server: xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that…4.8 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-119702: WPGraphQL: WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119701: WPGraphQL: WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows unauthenticated attackers to flood…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119700: WPGraphQL: WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119699: WPGraphQL WPGraphQL Smart Cache: WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119479: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119369: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119291: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno5.5 MediumN/AN/AOct 30, 2026
CVE-2026-119290: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.5 HighN/AN/AOct 30, 2026
CVE-2026-119289: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.1 HighN/AN/AOct 30, 2026
CVE-2026-119288: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.0 HighN/AN/AOct 30, 2026
CVE-2026-119287: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno8.0 HighN/AN/AOct 30, 2026
CVE-2026-118238: Tenda W18E: The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature…7.2 HighN/AN/AOct 30, 2026
CVE-2026-117184: n/a: An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a…N/AN/AN/AOct 30, 2026
CVE-2026-117183: n/a: A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape…N/AN/AN/AOct 30, 2026
CVE-2026-117182: n/a: An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0…N/AN/AN/AOct 30, 2026
76-100 of 418318