The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-66090: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the XML parser used for item metadata does not disable external entity resolutionN/A7.1 High0%Oct 29, 2026
CVE-2026-66089: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the SOAP API parses XML supplied in the stopEdit operation with a parser that resolves…N/A6.1 Medium0%Oct 29, 2026
CVE-2026-66088: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the system.execute() function available to the scripting engine runs supplied operating…N/A9.4 Critical1%Oct 29, 2026
CVE-2026-16889: Apereo Foundation openEQUELLA: In openEQUELLA before 2026.1, the pre-login notice image upload endpoint (PUT /api/preloginnotice/image/{name}) does…N/A4.8 Medium0%Oct 29, 2026
CVE-2026-114173: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not filter the WooCommerce product data it embedded in public…5.3 MediumN/A0%Oct 29, 2026
CVE-2026-113409: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not escape stored settings on its admin settings page, leading to…4.8 MediumN/A0%Oct 29, 2026
CVE-2026-113387: canva ortto: The Ortto plugin for WordPress before 1.0.25 did not authenticate configuration update requests, relying only on a…8.6 HighN/A0%Oct 29, 2026
CVE-2026-118590: nipy nibabel: A security vulnerability has been detected in nipy nibabel up to 5.4.25.3 Medium6.9 Medium0%Oct 29, 2026
CVE-2026-113957: Apple: An attacker who controls the registry, a mirror, or the network path to it may be able to serve arbitrary image content…N/AN/A0%Oct 29, 2026
CVE-2026-21157: Samsung Mobile Bixby: Improper input validation in Bixby prior to version 4.0.85.6 allows privileged local attackers to launch arbitrary…N/A8.3 High0%Oct 29, 2026
CVE-2026-118589: nschloe meshio: A weakness has been identified in nschloe meshio up to 5.3.55.3 Medium6.9 Medium0%Oct 29, 2026
CVE-2026-118586: dfm feedfinder2: A security flaw has been discovered in dfm feedfinder2 up to 0.0.45.3 Medium6.9 Medium0%Oct 29, 2026
CVE-2026-118585: configuroweb inventariobasico: A vulnerability was identified in configuroweb inventariobasico…3.5 Low2.0 Low0%Oct 29, 2026
CVE-2026-107017: n/a: Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers…N/AN/AN/AOct 29, 2026
CVE-2026-107023: n/a: Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to…N/AN/AN/AOct 29, 2026
CVE-2026-107028: n/a: Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an…N/AN/AN/AOct 29, 2026
CVE-2026-107034: n/a: Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read…N/AN/AN/AOct 29, 2026
CVE-2026-107039: n/a: Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode…N/AN/AN/AOct 29, 2026
CVE-2026-107044: n/a: Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily…N/AN/AN/AOct 29, 2026
CVE-2026-107049: n/a: An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via…N/AN/AN/AOct 29, 2026
CVE-2026-107055: n/a: Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to…N/AN/AN/AOct 29, 2026
CVE-2026-107060: n/a: Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to…N/AN/AN/AOct 29, 2026
CVE-2026-86983: Apple swift-crypto: A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API…N/AN/A0%Oct 28, 2026
CVE-2026-85749: MailWatch: MailWatch for MailScanner is a web-based front-end to MailScanner8.1 HighN/A0%Oct 28, 2026
CVE-2026-82411: maykinmedia open-object: Open Object provides an API and admin interface to manage objects and object types6.5 MediumN/A0%Oct 28, 2026
1076-1100 of 418318