The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-42692: Themeum WP Crowdfunding: Unauthenticated Cross Site Scripting (XSS) in WP Crowdfunding <= 2.2.2 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-27394: Jyothis Joy Eventer: Unauthenticated Cross Site Scripting (XSS) in Eventer <= 0.1.1 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-20942: Microsoft Microsoft Edge (Chromium-based): Improper restriction of rendered ui layers or frames in Microsoft Edge (Chromium-based) allows an unauthorized attacker…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-18894: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker to trigger pre-existing stored Python component…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-119145: frappe: Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload…9.9 Critical9.4 CriticalN/AOct 29, 2026
CVE-2026-119144: frappe: Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability…8.8 High8.7 HighN/AOct 29, 2026
CVE-2026-119143: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119142: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119141: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119140: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119139: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119138: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119137: bytecodealliance wasmtime: Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119136: bytecodealliance wasmtime: Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119135: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119134: bytecodealliance wasmtime: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables…6.2 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119132: bytecodealliance wasmtime: Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119131: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119130: bytecodealliance wasmtime: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values…2.6 Low2.1 LowN/AOct 29, 2026
CVE-2026-119128: zitadel: ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows…7.4 High9.1 CriticalN/AOct 29, 2026
CVE-2026-119127: zitadel: ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows…8.1 High8.6 HighN/AOct 29, 2026
CVE-2026-119126: parse-community parse-server: Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values…3.1 Low2.3 LowN/AOct 29, 2026
CVE-2026-119124: ImageMagick: ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause…3.3 Low4.8 MediumN/AOct 29, 2026
CVE-2026-119123: ImageMagick: ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG…3.7 Low6.3 MediumN/AOct 29, 2026
CVE-2026-119122: unclecode crawl4ai: Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API…5.3 Medium6.9 MediumN/AOct 29, 2026
101-125 of 538495