The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-62301: franklioxygen MyTube: MyTube is a self-hosted downloader and player for several video websitesN/A7.1 HighN/AOct 30, 2026
CVE-2026-62284: osac-project osac-operator: OSAC operator is a Kubernetes operatorN/A8.6 HighN/AOct 30, 2026
CVE-2026-61850: akuity kargo: Kargo manages and automates the promotion of software artifactsN/A9.3 CriticalN/AOct 30, 2026
CVE-2026-61694: LeJamon go-xrpl: go-xrpl is a Go implementation of the XRP Ledger protocol3.7 LowN/AN/AOct 30, 2026
CVE-2026-61620: seancorfield honeysql: HoneySQL turns Clojure data structures into SQL9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-61618: axiom-crypto snark-verifier: SNARK Verifier is a generic (S)NARK verifierN/A6.9 MediumN/AOct 30, 2026
CVE-2026-55598: madeofpendletonwool PinePods: PinePods is a complete, self-hosted podcast management system written in Rust9.1 CriticalN/AN/AOct 30, 2026
CVE-2026-55493: kohler hotcrp: HotCRP is conference review software6.5 MediumN/AN/AOct 30, 2026
CVE-2026-55098: Basekick-Labs arc: Arc is an open, SQL-native time-series database for telemetry6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119730: Maxthon Technology Limited Maxthon Browser for Android: Maxthon Browser for Android before 7.5.8.103 contains an address bar spoofing vulnerability that allows remote…4.3 Medium5.1 MediumN/AOct 30, 2026
CVE-2026-119337: infiniflow ragflow: RAGFlow is an open-source RAG (Retrieval-Augmented Generation) engine7.1 HighN/AN/AOct 30, 2026
CVE-2026-119336: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software7.8 HighN/AN/AOct 30, 2026
CVE-2026-119335: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software7.8 HighN/AN/AOct 30, 2026
CVE-2026-119334: pi-hole: Pi-hole is a DNS sinkhole that protects devices from unwanted content without installing any client-side software2.2 LowN/AN/AOct 30, 2026
CVE-2026-119333: jgraph drawio-desktop: draw.io Desktop is the official Electron build of draw.io7.8 HighN/AN/AOct 30, 2026
CVE-2026-119332: LadybirdBrowser ladybird: Ladybird is a truly independent web browser8.8 HighN/AN/AOct 30, 2026
CVE-2026-119331: LadybirdBrowser ladybird: Ladybird is a truly independent web browser7.1 HighN/AN/AOct 30, 2026
CVE-2026-119330: immich-app immich: Immich is a high-performance self-hosted photo and video management solution3.5 LowN/AN/AOct 30, 2026
CVE-2026-119329: immich-app immich: Immich is a high-performance self-hosted photo and video management solution4.3 MediumN/AN/AOct 30, 2026
CVE-2026-119328: immich-app immich: Immich is a high-performance self-hosted photo and video management solution6.5 MediumN/AN/AOct 30, 2026
CVE-2026-116252: pgadmin.org pgAdmin 4: pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-116251: pgadmin.org pgAdmin 4: pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own…4.2 Medium2.3 LowN/AOct 30, 2026
CVE-2026-116250: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…6.5 Medium7.3 HighN/AOct 30, 2026
CVE-2026-116249: pgadmin.org pgAdmin 4: In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file…8.4 High7.2 HighN/AOct 30, 2026
CVE-2026-116248: pgadmin.org pgAdmin 4: In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the…6.8 Medium6.0 MediumN/AOct 30, 2026
76-100 of 418318