The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118996: Improper Removal of Sensitive Data Before Storage or TransferN/AN/AN/AOct 30, 2026
CVE-2026-118995: Permissive Regular ExpressionN/AN/AN/AOct 30, 2026
CVE-2026-118994: CallBackery versions before 0.62.0 for Perl allow log injection via newlines in the login nameN/AN/AN/AOct 30, 2026
CVE-2026-118993: Inefficient Regular Expression Complexity (ReDoS)N/AN/AN/AOct 30, 2026
CVE-2026-118992: OS Command InjectionN/AN/AN/AOct 30, 2026
CVE-2026-118991: Use of Password Hash With Insufficient Computational EffortN/AN/AN/AOct 30, 2026
CVE-2026-118990: Improper Link Resolution Before File AccessN/AN/AN/AOct 30, 2026
CVE-2026-116128: Allocation of Resources Without Limits or ThrottlingN/AN/AN/AOct 30, 2026
CVE-2026-116127: Inconsistent Interpretation of HTTP RequestsN/AN/AN/AOct 30, 2026
CVE-2026-115866: Inefficient Regular Expression Complexity (ReDoS)N/AN/AN/AOct 30, 2026
CVE-2026-115865: Memory Allocation with Excessive Size ValueN/AN/AN/AOct 30, 2026
CVE-2026-112374: FOSSBilling: FOSSBilling before 0.8.9 contains a Cross-Site Request Forgery vulnerability in the staff guest login endpoint (POST…4.3 Medium5.1 MediumN/AOct 30, 2026
CVE-2026-119602: kyz libmspack: libmspack through 0.11alpha contains an uninitialized memory disclosure vulnerability in the MS-ZIP decompressor that…3.7 Low6.3 MediumN/AOct 30, 2026
CVE-2026-119599: looplj AxonHub: AxonHub through 1.0.0-beta11 contains a privilege escalation vulnerability that allows project users to assign…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119598: iluobei miaomiaowu: Miaomiaowu before 0.9.3 contains an insecure direct object reference vulnerability in /api/user/proxy-provider-configs…4.3 Medium5.3 MediumN/AOct 30, 2026
CVE-2026-119578: Project-MONAI MONAI: MONAI from 1.6.0 before 1.6.1 contains a remote code execution vulnerability in Auto3DSeg algo_from_json() that allows…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119577: ArcadeData arcadedb: ArcadeDB before 26.10.2 contains an improper authorization vulnerability that allows revoked users to retain access…6.8 Medium7.6 HighN/AOct 30, 2026
CVE-2026-119574: traefik: Traefik from 3.2.0 before 3.7.15 contains a data race in the experimental FastProxy that allows unauthenticated…5.9 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119573: traefik: Traefik 3.7.11 before 3.7.15 contains an authorization bypass in the Kubernetes Ingress NGINX provider that skips the…4.4 Medium2.1 LowN/AOct 30, 2026
CVE-2026-119570: parse-community parse-server: Parse Server from 9.7.0 before 9.10.5-alpha.7 contains an information disclosure vulnerability that allows clients to…3.1 Low2.3 LowN/AOct 30, 2026
CVE-2026-119569: parse-community parse-server: Parse Server before 8.6.108 and 9.0.0 before 9.10.5-alpha.9 contains a prototype pollution vulnerability because…5.3 Medium6.0 MediumN/AOct 30, 2026
CVE-2026-75882: ESET spol. s.r.o.: An improper access control vulnerability in ESET Endpoint Encryption and ESET Full Disk Encryption allow attacker with…N/A8.5 HighN/AOct 30, 2026
CVE-2026-116130: Null Byte Interaction Error (Poison Null Byte)N/AN/AN/AOct 30, 2026
CVE-2026-118988: Path TraversalN/AN/AN/AOct 30, 2026
CVE-2026-87768: Inefficient Algorithmic ComplexityN/AN/AN/AOct 30, 2026
126-150 of 413289