The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-117620: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers with Overall/Read permission to trigger warnings in…N/AN/AN/AOct 28, 2026
CVE-2026-117619: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows requests authenticated using HTTP Basic authentication,…N/AN/AN/AOct 28, 2026
CVE-2026-117618: Jenkins Project Jenkins: In Jenkins 2.587 and earlier, LTS 2.580.1 and earlier, the HTTP endpoint for creating the first user account does not…N/AN/AN/AOct 28, 2026
CVE-2026-117617: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier checks for symbolic links in the path of an extracted file only…N/AN/AN/AOct 28, 2026
CVE-2026-117616: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier provides an HTTP endpoint that loads agents by name without…N/AN/AN/AOct 28, 2026
CVE-2026-117615: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier follows symbolic links when copying the directory of an item being…N/AN/AN/AOct 28, 2026
CVE-2026-117614: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent configurations into…N/AN/AN/AOct 28, 2026
CVE-2026-117613: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not restrict item types in collections after deserialization,…N/AN/AN/AOct 28, 2026
CVE-2026-117612: Jenkins Project Jenkins: Jenkins 2.587 and earlier, LTS 2.580.1 and earlier does not apply its deserialization filter to classes referenced by…N/AN/AN/AOct 28, 2026
CVE-2026-116593: Apache Software Foundation Apache Kafka: Apache Kafka Connect has the /connector-plugins/{connector-type}/config/validate endpoint on its REST API to validate…N/AN/AN/AOct 28, 2026
CVE-2026-115644: Apache Software Foundation Apache Kafka: Apache Kafka Connect contains an authentication bypass vulnerability affecting the admin REST API when admin.listeners…N/AN/AN/AOct 28, 2026
CVE-2026-114349: Apache Software Foundation Apache Kafka: When a broker decodes a compressed record batch, the per-record decoder reads a declared body size from the…N/AN/AN/AOct 28, 2026
CVE-2026-112375: Apache Software Foundation Apache Kafka: An authenticated Kafka principal with no authorization grants (not even ALTER_CONFIGS) can make a broker read a file or…N/AN/AN/AOct 28, 2026
CVE-2026-111551: Apache Software Foundation Apache Kafka: Several Kafka deserialization paths read a size or count field from input data and use it directly to allocate an…N/AN/AN/AOct 28, 2026
CVE-2026-111496: Apache Software Foundation Apache Kafka: Kafka Streams derives its stream-time clock from record timestampsN/AN/AN/AOct 28, 2026
CVE-2026-111115: Apache Software Foundation Apache Kafka: Apache Kafka's code-generated readers for flexible protocol versions read a tagged-field count declared by the sender…N/AN/AN/AOct 28, 2026
CVE-2026-111108: Apache Software Foundation Apache Kafka: Apache Kafka's code-generated protocol readers pre-size an array's collection from the element count declared by the…N/AN/AN/AOct 28, 2026
CVE-2026-111073: Apache Software Foundation Apache Kafka: The broker-side PushTelemetry API (KIP-714) validates only the compressed size of a client's metrics payload against…N/AN/AN/AOct 28, 2026
CVE-2026-110985: Apache Software Foundation Apache Kafka: A Kafka broker using SASL/OAUTHBEARER with the default validator…N/AN/AN/AOct 28, 2026
CVE-2026-110952: Apache Software Foundation Apache Kafka: A Kafka broker that authenticates clients with SASL/OAUTHBEARER using the bundled JWKS-backed validator always verifies…N/AN/AN/AOct 28, 2026
CVE-2026-58458: Klei Entertainment Don't Starve Together: Don't Starve Together (Steam AppID 322330) through build 747465 contains a memory-corruption vulnerability in the…6.5 Medium6.9 MediumN/AOct 28, 2026
CVE-2026-106079: Juniper Networks: An Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in…8.8 HighN/AN/AOct 28, 2026
CVE-2026-103506: Grafana: An authenticated user in Grafana can read SSO client secrets and modify instance-wide SSO settings without the required…N/A8.9 HighN/AOct 28, 2026
CVE-2026-103411: Juniper Networks Session Smart Router: An Integer Underflow vulnerability in DhcpMessageDecoder in Juniper Networks Session Smart Router allows an attacker…7.1 HighN/AN/AOct 28, 2026
CVE-2026-117501: Allocation of Resources Without Limits or ThrottlingN/AN/AN/AOct 28, 2026
151-175 of 413066