The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-47486: NVIDIA PhysX: NVIDIA PhysX for all platforms contains a vulnerability where an attacker could cause an out-of-bounds write7.8 HighN/AN/AOct 27, 2026
CVE-2026-24269: NVIDIA TensorRT-LLM: NVIDIA TensorRT-LLM contains a vulnerability where an attacker could cause a server-side request forgery7.1 HighN/AN/AOct 27, 2026
CVE-2026-15586: İdvlabs Software and Consulting Services Inc. Ontime: Improper restriction of excessive authentication attempts vulnerability in İdvlabs Software and Consulting Services Inc5.3 MediumN/AN/AOct 27, 2026
CVE-2026-116627: Devolutions PowerShell Universal: Improper neutralization of input during web page generation ('Cross-site Scripting') in the notifications feature in…N/AN/AN/AOct 27, 2026
CVE-2026-114409: Docker Docker Desktop: Docker Desktop before version 4.97.0 could write third-party API keys and OAuth access tokens in cleartext to local…N/A5.7 MediumN/AOct 27, 2026
CVE-2026-107590: Qt: An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt 5 Compatibility APIs module…N/A1.9 LowN/AOct 27, 2026
CVE-2026-100164: Rolantis Information Technologies Tourism Industry and Trade Co. Ltd. Agentis: Observable response discrepancy vulnerability in Rolantis Information Technologies Tourism Industry and Trade Co7.5 HighN/AN/AOct 27, 2026
CVE-2026-117601: spesmilo electrum: Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing…7.5 High9.3 CriticalN/AOct 27, 2026
CVE-2026-117568: bitscorp-mcp mcp-ffmpeg: mcp-ffmpeg through 1.0.5 contains an OS command injection vulnerability that allows attackers to run shell commands by…7.0 High7.3 HighN/AOct 27, 2026
CVE-2026-117564: buqiyuan nest-admin: nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge…9.8 Critical9.3 CriticalN/AOct 27, 2026
CVE-2026-117560: atxp gemini-cli-extension: ATXP Gemini CLI extension through 1.0.0 contains an OS command injection vulnerability in runAtxp() that allows…7.8 High8.5 HighN/AOct 27, 2026
CVE-2026-117556: zchunk: zchunk before 1.5.5 contains a heap out-of-bounds read vulnerability in read_preface() in src/lib/header.c that passes…4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-90732: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through LTS 2026, LTS2024 release versions 7.13.1.0…4.9 MediumN/AN/AOct 27, 2026
CVE-2026-90731: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…4.9 MediumN/AN/AOct 27, 2026
CVE-2026-90730: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.5 MediumN/AN/AOct 27, 2026
CVE-2026-90729: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.7 MediumN/AN/AOct 27, 2026
CVE-2026-90728: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.3 MediumN/AN/AOct 27, 2026
CVE-2026-56084: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…5.8 MediumN/AN/AOct 27, 2026
CVE-2026-4337: PuMuKIT: Unrestricted Upload of File with Dangerous Type vulnerability in the PuMuKIT application allows a unauthenticated user…N/A8.8 HighN/AOct 27, 2026
CVE-2026-41022: Eaton easySoft: Eaton easySoft improperly validates TLS certificates presented by easyE4 devices5.9 MediumN/AN/AOct 27, 2026
CVE-2026-41021: Eaton easyE4: Eaton easyE4 uses an insufficiently strong password policy7.5 HighN/AN/AOct 27, 2026
CVE-2026-41020: Eaton easyE4: Eaton easyE4 uses a static nonce during authentication, which could allow an unauthenticated attacker with access to…7.5 HighN/AN/AOct 27, 2026
CVE-2026-13162: Hitachi Energy: An OS command vulnerability exists in CoreTec product that allows authenticated users with certain roles to execute…N/A7.7 HighN/AOct 27, 2026
CVE-2026-117499: @fastify/session: @fastify/session is a session plugin for Fastify3.7 LowN/AN/AOct 27, 2026
CVE-2026-115408: Eclipse Foundation Eclipse KeyPont: In `github.com/eclipse-keypont/crypto11/v2` versions `>= 2.0.0-rc3, <= 2.0.0-rc8`, the ML-KEM key-pair lookup functions…5.5 MediumN/AN/AOct 27, 2026
1101-1125 of 417096