The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118586: dfm feedfinder2: A security flaw has been discovered in dfm feedfinder2 up to 0.0.45.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-118585: configuroweb inventariobasico: A vulnerability was identified in configuroweb inventariobasico…3.5 Low2.0 LowN/AOct 29, 2026
CVE-2026-86983: Apple swift-crypto: A remote attacker may be able to terminate a process that passes attacker-controlled input to the P-384 VOPRF API…N/AN/AN/AOct 28, 2026
CVE-2026-85749: MailWatch: MailWatch for MailScanner is a web-based front-end to MailScanner8.1 HighN/AN/AOct 28, 2026
CVE-2026-82411: maykinmedia open-object: Open Object provides an API and admin interface to manage objects and object types6.5 MediumN/AN/AOct 28, 2026
CVE-2026-75520: domoticz: Domoticz is a free, open source home automation system for Linux, Windows, macOS, and Raspberry Pi5.4 MediumN/AN/AOct 28, 2026
CVE-2026-55561: InvoicePlane: InvoicePlane is a self-hosted open source application for managing invoices, clients, and paymentsN/A5.3 MediumN/AOct 28, 2026
CVE-2026-118579: D-Link DIR-505: A weakness has been identified in D-Link DIR-505 1.10B029.8 Critical8.9 HighN/AOct 28, 2026
CVE-2026-118578: maotoumao MusicFreeDesktop: A security flaw has been discovered in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.84.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-118577: maotoumao MusicFreeDesktop: A vulnerability was identified in maotoumao MusicFreeDesktop 0.0.6/0.0.7/0.0.86.3 Medium2.1 LowN/AOct 28, 2026
CVE-2026-111575: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 28, 2026
CVE-2026-111486: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 28, 2026
CVE-2026-111478: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 28, 2026
CVE-2026-118804: Bricks Bricks Builder: Bricks Builder 2.4.3 and before contains a broken access control vulnerability that allows unauthenticated attackers to…7.5 HighN/AN/AOct 28, 2026
CVE-2026-118803: Bricks Bricks Theme: Bricks Theme 2.4.3 and before contains an unauthenticated dynamic-data tag injection vulnerability that allows…7.5 HighN/AN/AOct 28, 2026
CVE-2026-118757: PI Websolution PiWeb Disable payment method / Partial payment for WooCommerce: PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 contains a missing authorization…6.5 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-118756: gopasspw gopass: gopass before 1.17.0 contains a path traversal vulnerability in the filesystem storage backend that allows attackers to…5.5 Medium6.7 MediumN/AOct 28, 2026
CVE-2026-118755: Volmarg personal-management-system: Volmarg Personal Management System through 2.1.0 contains an OS command injection vulnerability that allows…7.2 High8.6 HighN/AOct 28, 2026
CVE-2026-118754: Dolibarr Dolibarr ERP/CRM: Dolibarr ERP CRM before 24.0.2 contains a missing authorization vulnerability in htdocs/public/recruitment/view.php…5.3 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-118753: danoli3, FreeImage FreeImage: FreeImage (danoli3 fork) before 3.19.25 contains a heap buffer overflow vulnerability in PluginGIF.cpp that allows…7.8 High8.5 HighN/AOct 28, 2026
CVE-2026-118752: danoli3, FreeImage FreeImage: FreeImage (danoli3 fork) before 3.19.22 contains a heap buffer overflow vulnerability in the PBM RLE decoder of…7.8 High8.5 HighN/AOct 28, 2026
CVE-2026-118694: trentm python-markdown2: python-markdown2 through 2.5.5 contains a denial of service vulnerability that allows remote users to exhaust CPU by…7.5 High8.7 HighN/AOct 28, 2026
CVE-2026-118693: giuspen cherrytree: CherryTree through 1.7.2 contains a path traversal vulnerability in CtStorageXmlHelper::_create_image_from_xml that…4.7 Medium5.6 MediumN/AOct 28, 2026
CVE-2026-118692: giuspen cherrytree: CherryTree through 1.7.2 contains an OS command injection vulnerability in CtActions::link_clicked that allows…7.0 High7.1 HighN/AOct 28, 2026
CVE-2026-118691: GuDong2003 xianyu-auto-reply-fix: xianyu-auto-reply-fix through 2.0.7 contains a missing authorization vulnerability in the POST /send-message endpoint…3.7 Low6.3 MediumN/AOct 28, 2026
126-150 of 410067