The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-55348: Google Android: In GetSharedMemory of trusty_shared_memory_manager.cc, there is a possible way to trigger an out of bounds read via…N/AN/AN/ANov 10, 2026
CVE-2026-55346: Google Android: In km_read_data_response of keymaster.c, there is a possible way to trigger an out of bounds write on the heap due to a…6.7 MediumN/AN/ANov 10, 2026
CVE-2026-55344: Google Android: In TzSharedMemory of TzSharedMemory.c, there is a possible Heap buffer overflow due to a logic error in the codeN/AN/AN/ANov 10, 2026
CVE-2026-55335: Google Android: In multiple locations, there is a possible use-after-free due to a logic error in the codeN/AN/AN/ANov 10, 2026
CVE-2026-55321: Google Android: In parse_prime256v1 of keymint_asn1.c, there is a possible Heap Buffer Overflow due to a logic error in the codeN/AN/AN/ANov 10, 2026
CVE-2026-55319: Google Android: In thread_free of thread.c, there is a possible way to corrupt kernel heap metadata on thread creation failure due to…N/AN/AN/ANov 10, 2026
CVE-2026-55316: Google Android: In handle_dpm_image of seclib.rs, there is a possible Logic error due to a logic error in the codeN/AN/AN/ANov 10, 2026
CVE-2026-55312: Google Android: In insert_node of remap.c, there is a possible way to trigger an out of bounds write in the address remapping table due…N/AN/AN/ANov 10, 2026
CVE-2026-55311: Google Android: In N/A of gdmc/gsp/project/gdmc.mk, there is a possible Logic error due to a logic error in the codeN/AN/AN/ANov 10, 2026
CVE-2026-55309: Google Android: In multiple functions of verifier.rs, there is a possible way to bypass secure boot signature verification via fault…N/AN/AN/ANov 10, 2026
CVE-2026-55297: Google Android: In handle_chan_msg of tipc_virtio_dev.c, there is a possible way to bypass memory tag access controls via concurrent…6.4 MediumN/AN/ANov 10, 2026
CVE-2026-50080: BlackBerry Ltd: Stack-based Buffer Overflow in the ACPI event handler of the QVM could allow an attacker in a guest to crash the QVM by…3.3 LowN/AN/ANov 10, 2026
CVE-2026-50079: BlackBerry Ltd: Time-of-check Time-of-use (TOCTOU) Race Condition in the virtio network virtual device could allow an attacker in the…3.3 LowN/AN/ANov 10, 2026
CVE-2026-50078: BlackBerry Ltd: Out-Of-Bounds Read in the MSI-X table in the QVM could allow an attacker in the guest to cause an information…4.4 MediumN/AN/ANov 10, 2026
CVE-2026-50077: BlackBerry Ltd: Invalid Memory Access via the MSI-X table in QVM could allow an attacker in the guest to execute arbitrary code in the…7.7 HighN/AN/ANov 10, 2026
CVE-2026-26248: Fortinet: A improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Fortinet…8.8 HighN/AN/ANov 10, 2026
CVE-2026-14447: Google Android: In ext_mem_obj_get_page of memss-mfw.c, there is a possible way to return an out of bounds physical address via an…N/AN/AN/ANov 10, 2026
CVE-2026-126062: sparklemotion nokogiri: Nokogiri is an open source XML and HTML library for the Ruby programming language3.7 LowN/AN/ANov 10, 2026
CVE-2026-126061: wintercms winter: Winter CMS is a content management system built on the Laravel PHP framework4.3 MediumN/AN/ANov 10, 2026
CVE-2026-125341: wintercms winter: Winter CMS is a content management system built on the Laravel PHP framework2.0 LowN/AN/ANov 10, 2026
CVE-2026-125340: wintercms winter: Winter CMS is a content management system built on the Laravel PHP framework4.5 MediumN/AN/ANov 10, 2026
CVE-2026-125339: wintercms winter: Winter CMS is a content management system built on the Laravel PHP framework6.1 MediumN/AN/ANov 10, 2026
CVE-2026-125338: wintercms winter: Winter CMS is a content management system built on the Laravel PHP framework4.5 MediumN/AN/ANov 10, 2026
CVE-2026-125337: wintercms winter: Winter CMS is a content management system built on the Laravel PHP framework8.3 HighN/AN/ANov 10, 2026
CVE-2026-124848: Amazon Kiro CLI: Incorrect default file permissions in Kiro CLI (formerly Amazon Q Developer CLI) before version 2.27.0 on macOS and…5.5 Medium6.8 MediumN/ANov 10, 2026
1026-1050 of 511254