The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-81039: zephyrproject zephyr: The Bluetooth host pre-allocates a bt_conn object (a "reservation") from the fixed acl_conns[] pool for every…4.3 MediumN/AN/AOct 26, 2026
CVE-2026-81038: zephyrproject zephyr: The Object Transfer Service server builds its Object Action Control Point (OACP) response indication in oacp_ind_send()…7.1 HighN/AN/AOct 26, 2026
CVE-2026-71456: Johnson Controls Kantech Entrapass: Use of hard-coded cryptographic key vulnerability in Johnson Controls Kantech Entrapass allows Padding Oracle Crypto…N/A8.5 HighN/AOct 26, 2026
CVE-2026-71455: Johnson Controls Kantech Entrapass: Cleartext storage of sensitive information in memory vulnerability in Johnson Controls Kantech Entrapass allows…N/A5.3 MediumN/AOct 26, 2026
CVE-2026-19742: zephyrproject zephyr: The IPv6 stack derived the long-lived secret key used to compute RFC 7217 stable interface identifiers…3.7 LowN/AN/AOct 26, 2026
CVE-2026-116612: GStreamer project gst-editing-services: A flaw was found in GStreamer Editing Services (gst-editing-services)7.8 HighN/AN/AOct 26, 2026
CVE-2026-116596: Pyrus Pyrus Sync: Pyrus Sync for Windows contains a local privilege escalation vulnerability caused by missing authorization controls in…N/AN/AN/AOct 26, 2026
CVE-2026-116403: Awesomemotive Easy Digital Downloads: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') vulnerability in…5.9 MediumN/AN/AOct 26, 2026
CVE-2026-116396: TMS Amelia: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TMS Amelia…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116395: bPlugins LightBox Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins LightBox…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116388: TMS Amelia: Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-116384: Bdtask Garage 24 Garage Management Software: A weakness has been identified in Bdtask Garage 24 Garage Management Software 1.06.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116370: 2K Games Sid Meier's Civilization IV: A security flaw has been discovered in 2K Games Sid Meier's Civilization IV 1.0.12.686.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-115913: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115911: vllm-project vllm: vLLM is an inference and serving engine for large language models6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115910: python-social-auth social-core: Python Social Auth is a social authentication and registration mechanism6.8 MediumN/AN/AOct 26, 2026
CVE-2026-115907: zip-rs zip2: zip is a zip library for Rust that supports reading and writing simple ZIP files7.5 HighN/AN/AOct 26, 2026
CVE-2026-115906: zip-rs zip2: zip is a zip library for Rust that supports reading and writing simple ZIP files6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115905: zip-rs zip2: zip is a zip library for Rust that supports reading and writing simple ZIP filesN/A10.0 CriticalN/AOct 26, 2026
CVE-2026-115598: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-115597: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…5.4 MediumN/AN/AOct 26, 2026
CVE-2026-115418: AWS aws-cdk/aws-redshift-alpha: SQL injection in the database-query custom resource handlers in the Amazon Web Services (AWS) Cloud Development Kit…7.3 High7.0 HighN/AOct 26, 2026
CVE-2026-114710: WP Chill Gallery PhotoBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Gallery…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-107091: n/a: An issue in HUION Inspiroy Frego S (L310) Windows Driver 20.0.1.118 allows a local attacker to execute arbitrary code…N/AN/AN/AOct 26, 2026
CVE-2026-106677: n/a: Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImplN/AN/AN/AOct 26, 2026
76-100 of 416032