The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-109823: tidewave-ai tidewave: An attacker can read the name of filesystem paths of your application present via Tidewave configuration via…N/A2.3 LowN/AOct 27, 2026
CVE-2026-107672: Autodesk Fusion Post Processor Utility: A maliciously crafted .stack.json file can trigger a trusted Markdown injection vulnerability in Autodesk Fusion Post…8.8 HighN/AN/AOct 27, 2026
CVE-2026-107458: Rejected reason: This CVE has been rejected by Upstream, as they failed to create a meaningful exploitN/AN/AN/AOct 27, 2026
CVE-2026-104381: WatchGuard Fireware OS: A missing authentication vulnerability in Fireware OS's FireCluster state synchronization feature allows an…N/A6.0 MediumN/AOct 27, 2026
CVE-2026-104189: maz1987in 3Dviewer-Nextcloud: The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file…7.5 HighN/AN/AOct 27, 2026
CVE-2026-103594: WatchGuard Fireware OS: A stack-based buffer overflow vulnerability in Fireware OS's WireGuard configuration processing allows a remote…N/A9.5 CriticalN/AOct 27, 2026
CVE-2026-103593: WatchGuard Fireware OS: A stack-based buffer overflow vulnerability in the Fireware OS logging service allows a network-adjacent attacker who…N/A7.1 HighN/AOct 27, 2026
CVE-2026-78845: n/a: Aidot products Linkind Matter Smart Plug 1.01.32, OREiN Matter Smart Light Bulb 3.15.21, and Linkind Wi-Fi Smart Light…N/AN/AN/AOct 27, 2026
CVE-2026-117604: getgrav grav: Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized() that…7.5 High8.7 HighN/AOct 27, 2026
CVE-2026-117507: a2aproject a2a-java: A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final5.4 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-117506: a2aproject a2a-java: A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-117505: a2aproject a2a-java: A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-105987: KGS Software tia Viewer: KGS Software tia Viewer is vulnerable to Stored XSS via the annotation APIN/A5.1 MediumN/AOct 27, 2026
CVE-2026-94347: Dell PowerProtect Data Domain Virtual Edition: PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions…7.2 HighN/AN/AOct 27, 2026
CVE-2026-94346: Dell PowerProtect Data Domain Virtual Edition: PowerProtect Data Domain Virtual Edition, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions…7.2 HighN/AN/AOct 27, 2026
CVE-2026-90727: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…3.8 LowN/AN/AOct 27, 2026
CVE-2026-90726: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…6.0 MediumN/AN/AOct 27, 2026
CVE-2026-90725: Dell PowerProtect Data Domain: Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release versions 7.13.1.0 through…4.9 MediumN/AN/AOct 27, 2026
CVE-2026-68866: Dell PowerProtect Data Domain: PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.7, LTS2024 release versions 7.13.1.0 through…6.5 MediumN/AN/AOct 27, 2026
CVE-2026-16307: Netiket Information Technologies EdoWEB: Authorization bypass through User-Controlled key vulnerability in Netiket Information Technologies EdoWEB allows…4.3 MediumN/AN/AOct 27, 2026
CVE-2026-12887: Octopus Deploy Octopus Server: In affected versions of Octopus Server, a user with permission to upload a malicious nuget package is able to deploy a…N/A5.1 MediumN/AOct 27, 2026
CVE-2026-118027: Mozilla Firefox: Frame poisoning in the Layout componentN/AN/AN/AOct 27, 2026
CVE-2026-118018: Mozilla Firefox: Spoofing issue in the Downloads component in Firefox for AndroidN/AN/AN/AOct 27, 2026
CVE-2026-117603: spesmilo electrum: Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows…4.3 Medium9.3 CriticalN/AOct 27, 2026
CVE-2026-117602: spesmilo electrum: Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's…8.4 High8.6 HighN/AOct 27, 2026
151-175 of 522616