The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119699: WPGraphQL WPGraphQL Smart Cache: WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption vulnerability that allows…5.3 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-119479: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…5.3 MediumN/AN/AOct 30, 2026
CVE-2026-119369: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119291: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno5.5 MediumN/AN/AOct 30, 2026
CVE-2026-119290: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.5 HighN/AN/AOct 30, 2026
CVE-2026-119289: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.1 HighN/AN/AOct 30, 2026
CVE-2026-119287: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno8.0 HighN/AN/AOct 30, 2026
CVE-2026-118238: Tenda W18E: The Tenda W18E web management server is vulnerable to OS command injection via the "diagnose" packet-capture feature…7.2 HighN/AN/AOct 30, 2026
CVE-2026-117184: n/a: An issue in the GraphQL endpoint of traggo server v0.8.3 allows attackers to cause a Denial of Service (DoS) via a…N/AN/AN/AOct 30, 2026
CVE-2026-117183: n/a: A path traversal vulnerability in the FeaturedImage component of astro-notion-blog 0.13.0 allows attackers to escape…N/AN/AN/AOct 30, 2026
CVE-2026-117182: n/a: An authenticated cross-site scripting (XSS) vulnerability in the /spina/embeddable.rb component of Spina CMS v2.21.0…N/AN/AN/AOct 30, 2026
CVE-2026-116407: Webba Plugins Webba Booking: Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-105456: Best Practical Solutions RT for Incident Response: RTIR extends RT's HTML scrubber to allow an internal link placeholder, and the extension lets through any link that…N/A5.3 MediumN/AOct 30, 2026
CVE-2026-105455: Best Practical Solutions RT for Incident Response: RTIR's ticket creation forms show the subject of the related ticket when splitting a ticket or creating an incident…N/A5.3 MediumN/AOct 30, 2026
CVE-2026-105454: Best Practical Solutions Request Tracker: RT's automatic link creation for URLs in HTML ticket content does not HTML-escape the URL it places in the linkN/A5.3 MediumN/AOct 30, 2026
CVE-2026-104615: SUSE Rancher: A security vulnerability was discovered in SUSE Rancher Fleet's cluster registration flow, in Fleet versions before…7.9 HighN/AN/AOct 30, 2026
CVE-2026-104067: Scribus: Scribus before 1.6.7 contains an out-of-bounds memory access vulnerability in the importsvm plugin that fails to verify…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104065: Scribus: Scribus before 1.6.7 contains an out-of-bounds write vulnerability in the importdrw Micrografx Draw plugin that uses an…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104064: Scribus: Scribus before 1.6.7 contains an integer overflow vulnerability in the scimgdataloader_tiff TIFF loader that allows…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-104063: Scribus: Scribus before 1.6.7 contains an out-of-bounds read vulnerability in the Mac PICT image loader and import plugin when…6.1 Medium6.9 MediumN/AOct 30, 2026
CVE-2026-104061: Scribus: Scribus before 1.6.7 contains a heap out-of-bounds write vulnerability in the scimgdataloader_psd loader that uses…7.8 High8.5 HighN/AOct 30, 2026
CVE-2026-119298: schollz croc: croc is a tool that allows any two computers to simply and securely transfer files and folders4.2 MediumN/AN/AOct 30, 2026
CVE-2026-119148: AWS aws-nitro-enclaves-sdk-c: Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the…6.5 Medium8.2 HighN/AOct 30, 2026
CVE-2026-104623: SUSE Rancher: A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE…6.3 MediumN/AN/AOct 30, 2026
CVE-2026-119288: zuke-build zuke: Zuke is a code-first, strongly typed build automation system for Deno7.0 HighN/AN/AOct 30, 2026
151-175 of 418318