The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-103359: Unknown PayDunya WooCommerce Payment Gateway: The PayDunya WooCommerce Payment Gateway WordPress plugin through 1.1.6 does not verify the authenticity of incoming…5.3 MediumN/AN/AOct 27, 2026
CVE-2026-103325: Unknown TiendaCrypto para WooCommerce: The TiendaCrypto para WooCommerce WordPress plugin through 1.2.1 does not correctly verify the authenticity of its…3.7 LowN/AN/AOct 27, 2026
Fortinet FortiOS: CVE-2026-106174: GUI Denial of Service6.7 MediumN/AN/AOct 27, 2026
CVE-2026-103312: Unknown Payment Integration Wompi: The Payment Integration Wompi WordPress plugin through 4.0.1 does not verify the authenticity of incoming payment…N/AN/AN/AOct 27, 2026
CVE-2026-103332: Unknown Payex Payment Gateway for Woocommerce: The Payex Payment Gateway for Woocommerce WordPress plugin through 1.2.10 does not properly verify the authenticity of…N/AN/AN/AOct 27, 2026
CVE-2026-117472: esaqa GmbH Psono: Psono Server CE && EE versions 4.0.33 through 7.2.3 compared the request path for the bulk-secret-read endpoint with a…4.3 MediumN/AN/AOct 27, 2026
CVE-2026-117471: esaqa GmbH Psono: Psono Server CE && EE versions 0.1.0 through 7.2.3 accepted a user-controlled host when configuring a personal Duo…5.4 MediumN/AN/AOct 27, 2026
CVE-2026-117470: esaqa GmbH Psono: Psono Server CE & EE versions 3.1.0 through 7.2.3 did not consume a stored WebAuthn challenge after assertion…6.5 MediumN/AN/AOct 27, 2026
CVE-2026-117469: esaqa GmbH Psono: Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on…5.4 MediumN/AN/AOct 27, 2026
CVE-2026-117468: esaqa GmbH Psono: Psono Server versions 5.3.5 through 7.2.3 used a permission class that did not enforce token write scope when claiming…6.5 MediumN/AN/AOct 27, 2026
CVE-2026-111820: deconf Analytics Insights – Google Analytics Dashboard for WordPress: The Analytics Insights – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 27, 2026
CVE-2026-88781: ASUS motherboards firmware: Untrusted Pointer Dereference in ASUS certain motherboards firmware allows a kernel-level privileges user can supply an…N/A6.8 MediumN/AOct 27, 2026
CVE-2026-116640: Saruf-Ratul HR-Payroll-Management-System: A flaw has been found in Saruf-Ratul HR-Payroll-Management-System…3.5 Low2.0 LowN/AOct 27, 2026
CVE-2026-97028: Rejected reason: Maintainers determined it is not a vulnerability.N/AN/AN/AOct 27, 2026
CVE-2026-116844: fclairamb ftpserverlib: Fclairamb ftpserverlib through 0.32.4 contains a cleartext transmission vulnerability because TransferOpen checks only…4.8 Medium6.3 MediumN/AOct 27, 2026
CVE-2026-116843: mistralai mistral-vibe: Mistral Vibe before 3.0.3 contains a remote code execution vulnerability that allows attackers to run commands by…8.8 High8.7 HighN/AOct 27, 2026
CVE-2026-116842: diasurgical DevilutionX: DevilutionX 1.4.0 through 1.5.5 contains a heap buffer overflow vulnerability in the bundled libmpq libmpq__archive_dup…6.1 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116841: diasurgical DevilutionX: DevilutionX 1.4.0 through 1.5.5 contains an out-of-bounds read vulnerability in the bundled libmpq…5.5 Medium6.8 MediumN/AOct 27, 2026
CVE-2026-116840: ggml-org llama.cpp: llama.cpp b5854 before b11275 contains an integer overflow vulnerability in gguf_init_from_reader that bypasses the…6.1 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116839: Ubiquiti Inc airMAX M: A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF)…7.1 HighN/AN/AOct 27, 2026
CVE-2026-116838: Ubiquiti Inc airMAX M: A malicious actor who lures an authenticated user to a malicious page could exploit a Cross-Site Request Forgery (CSRF)…8.8 HighN/AN/AOct 27, 2026
CVE-2026-116837: Ubiquiti Inc: A malicious actor with access to the adjacent network could exploit a Heap-based Buffer Overflow vulnerability found in…8.8 HighN/AN/AOct 27, 2026
CVE-2026-116836: Ubiquiti Inc airMAX M: A malicious actor with access to the adjacent network and under certain conditions could exploit a Stored Cross-Site…8.8 HighN/AN/AOct 27, 2026
CVE-2026-116829: ggml-org llama.cpp: llama.cpp b10398 before b11301 contains an integer overflow vulnerability in gguf_init_from_reader that allows…6.6 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116816: ggml-org llama.cpp: llama.cpp b5899 before b10261 contains a heap out-of-bounds write vulnerability in llm_tokenizer_plamo2::build that…7.8 High8.5 HighN/AOct 27, 2026
76-100 of 413108