The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116776: n-romanovich usb-test: USB Test is a lightweight Windows CLI utility for verifying sector integrity and detecting overreported capacity on USB…N/A7.0 HighN/AOct 28, 2026
CVE-2026-112357: GFI USA, LLC GFI KerioConnect: GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition), 'KOFF', before 10.0.9 Patch 2 contains a local…7.8 High8.5 HighN/AOct 28, 2026
CVE-2026-112356: GFI USA, LLC GFI KerioConnect: GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cross-site scripting vulnerability in the Webmail…6.1 Medium5.1 MediumN/AOct 28, 2026
CVE-2026-93520: x.org: A heap buffer overflow caused by mismatching size calculations between XkbAllocNames and ChangeKeycodeRange in X.org X…7.8 HighN/AN/AOct 28, 2026
CVE-2026-93519: x.org, x.orgg: A buffer overflow when handling pointer barriers in the XFIXES extension in X.Org X server before 21.1.25 and XWayland…7.8 HighN/AN/AOct 28, 2026
CVE-2026-93518: x.org: An integer truncation issue in XkbResizeKeyType() that could lead to a heap buffer overflow by authenticated X clients…7.8 HighN/AN/AOct 28, 2026
CVE-2026-115402: OpenVPN ovpn-dco-win: OpenVPN ovpn-dco-win 0.6.5 through 2.8.13 allows unprivileged local users to cause a denial of service (system crash)…N/A5.7 MediumN/AOct 28, 2026
CVE-2026-106972: n/a: An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack() component of rybakit/msgpack v0.11.0 allows…N/AN/AN/AOct 28, 2026
CVE-2026-106971: n/a: An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a…N/AN/AN/AOct 28, 2026
CVE-2026-93517: x.orgg, x.org: A heap buffer overflow in handling GLX RenderLarge request where dataBytes exceeds cmdlen in X.org X server before…N/A8.5 HighN/AOct 28, 2026
CVE-2026-59959: HappySeaFox sail: SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profilesN/A4.8 MediumN/AOct 28, 2026
CVE-2026-59185: identrail: identrail is a machine identity security platform for AWS, GitHub/OIDC, and Kubernetes8.5 HighN/AN/AOct 28, 2026
CVE-2026-59179: naorsabag openhop: OpenHop is a tool for creating interactive data-flow diagrams8.3 HighN/AN/AOct 28, 2026
CVE-2026-59177: esphome device-builder: ESPHome Device Builder Dashboard is a dashboard for the ESPHome home management software8.8 HighN/AN/AOct 28, 2026
CVE-2026-59176: jordanburke functype: Functype is a family of TypeScript functional programming libraries7.8 HighN/AN/AOct 28, 2026
CVE-2026-59172: candid82 joker: Joker is a small Clojure interpreter, linter and formatter written in Go7.8 HighN/AN/AOct 28, 2026
CVE-2026-59164: getnora-io nora: NORA is a self-hosted artifact registry and pull-through cache7.1 HighN/AN/AOct 28, 2026
CVE-2026-52729: xibosignage xibo-cms: Xibo is an open source digital signage platform with a web content management system and Windows display player software7.1 HighN/AN/AOct 28, 2026
CVE-2026-50541: xibosignage xibo-cms: Xibo is an open source digital signage platform with a web content management system and Windows display player software6.5 MediumN/AN/AOct 28, 2026
CVE-2026-116390: stepasyuk Filter Everything — WordPress & WooCommerce Filters: Deserialization of Untrusted Data vulnerability in stepasyuk Filter Everything — WordPress & WooCommerce…7.2 HighN/AN/AOct 28, 2026
CVE-2026-116389: crossi72 Phoenix Media Rename: Deserialization of Untrusted Data vulnerability in crossi72 Phoenix Media Rename phoenix-media-rename allows Object…8.8 HighN/AN/AOct 28, 2026
CVE-2026-116078: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit…N/A8.7 HighN/AOct 28, 2026
CVE-2026-115968: Ultimate Member: Deserialization of Untrusted Data vulnerability in Ultimate Member Ultimate Member ultimate-member allows Object…9.8 CriticalN/AN/AOct 28, 2026
CVE-2026-115603: Advanced Ads GmbH Advanced Ads – Tracking: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Advanced Ads GmbH…8.5 HighN/AN/AOct 28, 2026
CVE-2026-115590: weDevs Dokan: Deserialization of Untrusted Data vulnerability in weDevs Dokan dokan-lite allows Object Injection.This issue affects…7.2 HighN/AN/AOct 28, 2026
201-225 of 413066