The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-104066: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the Mac PICT image loader and import plugin when…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104065: Scribus: Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104064: Scribus: Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104063: Scribus: Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when…6.1 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-104062: Scribus: Scribus before 1.6.7 contains a heap buffer overflow vulnerability in the PICT image loader and import plugin that…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104061: Scribus: Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-105454: Best Practical Solutions Request Tracker: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the linkN/A5.3 MediumN/AOct 30, 2026
CVE-2026-105455: Best Practical Solutions RT for Incident Response: RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident…N/A5.3 MediumN/AOct 30, 2026
CVE-2026-105456: Best Practical Solutions RT for Incident Response: RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that…N/A5.3 MediumN/AOct 30, 2026
CVE-2026-65444: Creative Themes Blocksy Companion: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Creative Themes…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-61739: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs7.5 HighN/AN/AOct 30, 2026
CVE-2026-61738: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs10.0 CriticalN/AN/AOct 30, 2026
CVE-2026-61737: huajian123 ng-antd-admin: ng-antd-admin is an Angular and NestJS administration system template9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-61730: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs9.3 CriticalN/AN/AOct 30, 2026
CVE-2026-61729: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs9.4 CriticalN/AN/AOct 30, 2026
CVE-2026-61728: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs9.9 CriticalN/AN/AOct 30, 2026
CVE-2026-61708: socfortress CoPilot: SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs8.5 HighN/AN/AOct 30, 2026
CVE-2026-61627: libass: libass is a portable subtitle renderer for the `ASS`/SSA (Advanced Substation Alpha/Substation Alpha) subtitle formatN/A7.3 HighN/AOct 30, 2026
CVE-2026-48164: CollaboraOnline online: Collabora Online is a collaborative online office suite based on LibreOffice technology4.7 MediumN/AN/AOct 30, 2026
CVE-2026-45145: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system7.5 HighN/AN/AOct 30, 2026
CVE-2026-45144: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system8.9 HighN/AN/AOct 30, 2026
CVE-2026-45141: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system6.5 MediumN/AN/AOct 30, 2026
CVE-2026-44344: chamilo chamilo-lms: Chamilo LMS is an open-source learning management system6.6 MediumN/AN/AOct 30, 2026
CVE-2026-119665: MGdaasLab WHartTest: WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and…6.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119662: songloft-org songloft: Songloft 2.9.0 before 2.13.6 contains a hardcoded credentials vulnerability that allows adjacent network attackers to…8.8 High8.7 HighN/AOct 30, 2026
101-125 of 418318