The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119138: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119137: bytecodealliance wasmtime: Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119136: bytecodealliance wasmtime: Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119135: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119134: bytecodealliance wasmtime: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables…6.2 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119133: bytecodealliance wasmtime: Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that…2.6 Low2.1 LowN/AOct 29, 2026
CVE-2026-119132: bytecodealliance wasmtime: Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to…4.8 Medium5.9 MediumN/AOct 29, 2026
CVE-2026-119131: bytecodealliance wasmtime: Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119130: bytecodealliance wasmtime: Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values…2.6 Low2.1 LowN/AOct 29, 2026
CVE-2026-119129: zitadel: ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that…8.1 High8.6 HighN/AOct 29, 2026
CVE-2026-119128: zitadel: ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows…7.4 High9.1 CriticalN/AOct 29, 2026
CVE-2026-119127: zitadel: ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows…8.1 High8.6 HighN/AOct 29, 2026
CVE-2026-119126: parse-community parse-server: Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values…3.1 Low2.3 LowN/AOct 29, 2026
CVE-2026-119125: parse-community parse-server: Parse Server before 8.6.107 and 9.0.0 before 9.10.5-alpha.8 returns the stored value of a field reverted by a…3.1 Low2.3 LowN/AOct 29, 2026
CVE-2026-119124: ImageMagick: ImageMagick before 7.1.2-34 contains a heap-based buffer overflow in its -morph processing, where crafted images cause…3.3 Low4.8 MediumN/AOct 29, 2026
CVE-2026-119123: ImageMagick: ImageMagick before 7.1.2-34 contains a stack overflow vulnerability in the TIFF decoder that occurs when the DNG…3.7 Low6.3 MediumN/AOct 29, 2026
CVE-2026-119122: unclecode crawl4ai: Crawl4AI before 0.9.5 contains a blind server-side request forgery vulnerability in the Docker server that allows API…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119121: unclecode crawl4ai: Crawl4AI from 0.9.0 before 0.9.5 contains a JavaScript injection vulnerability in the Docker API server that allows…4.3 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-119120: unclecode crawl4ai: Crawl4AI from 0.9.0 before 0.9.5 fails to filter the CosineStrategy model_name field in untrusted Docker API request…7.5 High7.7 HighN/AOct 29, 2026
CVE-2026-119119: unclecode crawl4ai: Crawl4AI before 0.9.5 contains a denial of service vulnerability in the Docker API server where _clamp_untrusted()…7.5 High8.7 HighN/AOct 29, 2026
CVE-2026-119118: unclecode crawl4ai: Crawl4AI before 0.9.5 contains an improper certificate validation vulnerability that allows network attackers to…6.5 Medium8.3 HighN/AOct 29, 2026
CVE-2026-118673: keepassxreboot keepassxc: KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password SafeN/A4.1 MediumN/AOct 29, 2026
CVE-2026-118085: Global Payments GlobalPayments WooCommerce: Unauthenticated Cross Site Scripting (XSS) in GlobalPayments WooCommerce <= 1.23.3 versions.7.1 HighN/AN/AOct 29, 2026
CVE-2026-118084: nicdark Hotel Booking: Subscriber Insecure Direct Object References (IDOR) in Hotel Booking <= 3.8 versions.6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118083: Themeum WP Crowdfunding: Unauthenticated Sensitive Data Exposure in WP Crowdfunding <= 2.2.2 versions.7.5 HighN/AN/AOct 29, 2026
201-225 of 538495