The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-108140: Veeam Backup and Replication: A vulnerability allowing an authenticated user with the Restore Operator role, who also controls the contents of a…N/A5.9 MediumN/AOct 27, 2026
CVE-2026-105477: Veeam Agent for Linux: A vulnerability in Veeam Agent for Linux allows for local privilege escalationN/A7.3 HighN/AOct 27, 2026
CVE-2026-82984: Nextcloud Server: When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team…4.3 MediumN/AN/AOct 27, 2026
CVE-2026-77167: Nextcloud server: Abusing the federated share endpoint, an attacker can write arbitrary rows into the oc_share_external database table7.5 HighN/AN/AOct 27, 2026
CVE-2026-77173: Nextcloud Files Confidential: A user could create a docx or odt file with a # in the filename with confidential information such as a credit card…4.3 MediumN/AN/AOct 27, 2026
CVE-2026-67400: Nextcloud Richdocuments: A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or…3.5 LowN/AN/AOct 27, 2026
CVE-2026-77171: Nextcloud Collectives: A public shared collective always allowed recipients of the link to create pages.3.5 LowN/AN/AOct 27, 2026
CVE-2026-77172: Nextcloud Server: App passwords were allowed to bypass password confirmation on sensitive endpoints.5.3 MediumN/AN/AOct 27, 2026
CVE-2026-87897: Nextcloud whiteboard: A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT…4.6 MediumN/AN/AOct 27, 2026
CVE-2026-82983: Nextcloud Tables: The Tables app's share-listing endpoint (GET /apps/tables/share/table/{tableId}) did not verify that the requesting…3.3 LowN/AN/AOct 27, 2026
CVE-2026-82986: Nextcloud Tables: The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for…4.6 MediumN/AN/AOct 27, 2026
CVE-2026-54462: knative pkg: Knative pkg provides common packages shared across Knative repositories6.5 MediumN/AN/AOct 27, 2026
CVE-2026-112353: GFI USA, LLC GFI KerioConnect: GFI KerioConnect (Kerio Connect) before 10.0.8 Patch 2 contains a stored cross-site scripting vulnerability in the…8.2 High6.2 MediumN/AOct 27, 2026
CVE-2026-113775: Autodesk Fusion: A maliciously crafted dynamic library, when loaded from an arbitrary path through the TextCommands.LoadDll command…7.8 HighN/AN/AOct 27, 2026
CVE-2026-109089: X.Org libXi: A buffer overflow when handling DEVICE_RESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious…7.5 HighN/AN/AOct 27, 2026
CVE-2026-102638: Autodesk Fusion: A maliciously crafted HTML payload in the description of an electronic library (.lbr) file, when displayed in the…7.1 HighN/AN/AOct 27, 2026
CVE-2026-102637: Autodesk Fusion: A maliciously crafted HTML payload in the documentName parameter of a Fusion protocol URL, when the protocol URL is…7.1 HighN/AN/AOct 27, 2026
CVE-2026-102636: Autodesk Fusion: A maliciously crafted HTML payload in a design name, when displayed after another user opens the manipulated design,…7.1 HighN/AN/AOct 27, 2026
CVE-2026-78845: n/a: Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light…N/AN/AN/AOct 27, 2026
CVE-2026-117604: getgrav grav: Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that…7.5 High8.7 HighN/AOct 27, 2026
CVE-2026-117507: a2aproject a2a-java: A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final5.4 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-117506: a2aproject a2a-java: A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-117505: a2aproject a2a-java: A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-105987: KGS Software tia Viewer: KGS Software tia Viewer is vulnerable to Stored XSS via the annotation APIN/A5.1 MediumN/AOct 27, 2026
CVE-2026-94347: Dell PowerProtect Data Domain Virtual Edition: PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions…7.2 HighN/AN/AOct 27, 2026
76-100 of 522616