The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-93518: x.org: An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients…7.8 HighN/AN/AOct 28, 2026
CVE-2026-115402: OpenVPN ovpn-dco-win: OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash)…N/A5.7 MediumN/AOct 28, 2026
CVE-2026-106972: n/a: An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows…N/AN/AN/AOct 28, 2026
CVE-2026-106971: n/a: An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a…N/AN/AN/AOct 28, 2026
CVE-2026-93517: x.orgg, x.org: A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before…N/A8.5 HighN/AOct 28, 2026
CVE-2026-59959: HappySeaFox sail: SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profilesN/A4.8 MediumN/AOct 28, 2026
CVE-2026-59185: identrail: identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes8.5 HighN/AN/AOct 28, 2026
CVE-2026-59179: naorsabag openhop: OpenHop is a tool for creating interactive data-flow diagrams8.3 HighN/AN/AOct 28, 2026
CVE-2026-59177: esphome device-builder: ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software8.8 HighN/AN/AOct 28, 2026
CVE-2026-59176: jordanburke functype: Functype is a family of TypeScript functional programming libraries7.8 HighN/AN/AOct 28, 2026
CVE-2026-59172: candid82 joker: Joker is a small Clojure interpreter, linter and formatter written in Go7.8 HighN/AN/AOct 28, 2026
CVE-2026-59164: getnora-io nora: NORA is a self-hosted artifact registry and pull-through cache7.1 HighN/AN/AOct 28, 2026
CVE-2026-52729: xibosignage xibo-cms: Xibo is an open source digital signage platform with a web content management system and Windows display player software7.1 HighN/AN/AOct 28, 2026
CVE-2026-50541: xibosignage xibo-cms: Xibo is an open source digital signage platform with a web content management system and Windows display player software6.5 MediumN/AN/AOct 28, 2026
CVE-2026-116390: stepasyuk Filter Everything — WordPress & WooCommerce Filters: Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce…7.2 HighN/AN/AOct 28, 2026
CVE-2026-116389: crossi72 Phoenix Media Rename: Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object…8.8 HighN/AN/AOct 28, 2026
CVE-2026-116078: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit…N/A8.7 HighN/AOct 28, 2026
CVE-2026-115968: Ultimate Member: Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-115603: Advanced Ads GmbH Advanced Ads – Tracking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH…8.5 HighN/AN/AOct 28, 2026
CVE-2026-115590: weDevs Dokan: Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects…7.2 HighN/AN/AOct 28, 2026
CVE-2026-105420: Wing Soft Technology Wing FTP Server: Wing FTP Server does not verify user's base folderN/A9.4 CriticalN/AOct 28, 2026
CVE-2026-93516: x.org: A use-after-free caused by lack of lifecycle management when adding / removing XInput master devices in X.org X Server…5.5 MediumN/AN/AOct 28, 2026
CVE-2026-93515: X.org, x.org: A use-after-free in present_clear_window_notifies() in the X.org X Server before 21.1.25 and X Wayland before 24.1.14…N/A6.8 MediumN/AOct 28, 2026
CVE-2026-67080: HCL Software BigFix AEX: HCL BigFix AEX is affected by an Information Disclosure vulnerability due to improper handling of errors or exceptional…6.5 MediumN/AN/AOct 28, 2026
CVE-2026-67079: HCL Software BigFix AEX: HCL BigFix AEX is affected by a Clickjacking vulnerability, which could allow an attacker to embed the application…6.4 MediumN/AN/AOct 28, 2026
151-175 of 413066