The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119299: gopacket: gopacket provides packet processing capabilities for Go5.9 MediumN/AN/AOct 30, 2026
CVE-2026-119116: AWS kmstool-enclave: A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of…7.8 High8.7 HighN/AOct 30, 2026
CVE-2026-115642: OpenStack keystonemiddleware: In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in…8.3 HighN/AN/AOct 30, 2026
CVE-2026-112816: Canonical LXD: Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,…N/A10.0 CriticalN/AOct 30, 2026
CVE-2025-49602: n/a: An issue was discovered in Keyfactor EJBCA 9N/AN/AN/AOct 30, 2026
CVE-2026-50000: freedomofpress securedrop: SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept…5.0 MediumN/AN/AOct 30, 2026
CVE-2026-39375: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their contentN/A5.1 MediumN/AOct 30, 2026
CVE-2026-62141: WP ManageNinja LLC Fluent CRM: Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-119722: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119720: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds read vulnerability in read_file_dna() that…5.5 Medium6.8 MediumN/AOct 30, 2026
CVE-2026-119719: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability in the blend file thumbnail…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119718: Blender Foundation Blender: Blender before 4.5.15 and 5.x before 5.2.3 contains a heap buffer overflow vulnerability caused by integer overflow in…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119716: wbond pybars3: pybars3 through 0.9.7 contains a code injection vulnerability in pybars/_compiler.py that allows template authors to…8.1 High9.2 CriticalN/AOct 30, 2026
CVE-2026-119715: nocodb: NocoDB before 2026.08.0 contains a clickjacking vulnerability that allows any origin to frame the authenticated…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119714: joedolson My Calendar - Accessible Event Manager: My Calendar WordPress plugin 3.8.8 before 3.8.11 contains a shortcode injection vulnerability that allows…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119712: pipeshub-ai: PipesHub before 0.10.0 contains a server-side request forgery vulnerability in ImageParser._fetch_single_url that…6.4 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119711: pipeshub-ai: PipesHub before 0.10.0 contains a rate limit bypass vulnerability in getClientIp() that allows unauthenticated…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119710: pipeshub-ai: PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119708: colinin abp-next-admin: abp-next-admin 10.4.0 through 10.7.0 contains a cross-tenant authorization bypass in the BlobManagement…6.5 Medium7.1 HighN/AOct 30, 2026
CVE-2026-119707: SonicJs-Org sonicjs: SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write…7.1 High7.1 HighN/AOct 30, 2026
CVE-2026-119706: InternLM lmdeploy: InternLM LMDeploy 0.9.0 through 0.18.0 contains an unauthenticated remote code execution vulnerability that allows…9.8 Critical9.3 CriticalN/AOct 30, 2026
CVE-2026-119704: BastilleBSD bastille: Bastille through 1.4.4 contains a symlink following vulnerability in the cp.sh, rcp.sh and jcp.sh subcommands that…6.8 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119703: xinnan-tech xiaozhi-esp32-server: xiaozhi-esp32-server through 0.9.8 contains an authentication bypass vulnerability in WebSocketServer._handle_auth that…4.8 Medium6.3 MediumN/AOct 30, 2026
CVE-2026-119702: WPGraphQL: WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows…6.5 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119700: WPGraphQL: WPGraphQL before 2.24.2 contains an information disclosure vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 30, 2026
126-150 of 418318