The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-115585: py-pdf pypdf: pypdf is a free and open-source pure-python PDF libraryN/A7.1 High0%Oct 23, 2026
CVE-2026-115580: py-pdf pypdf: pypdf is a free and open-source pure-python PDF libraryN/A7.1 High0%Oct 23, 2026
CVE-2026-115572: py-pdf pypdf: pypdf is a free and open-source pure-python PDF libraryN/A7.1 High0%Oct 23, 2026
CVE-2026-91093: HP Inc. HP One Agent Software: A potential security vulnerability has been identified in HP One Agent for certain HP PC products, which might allow…N/A8.5 High0%Oct 23, 2026
CVE-2026-115845: AWS AWS MCP Server: An incomplete list of disallowed inputs in the Python code validator of the run_script tool in AWS MCP Server might…6.4 Medium5.3 Medium0%Oct 23, 2026
CVE-2026-115570: electron: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS7.4 HighN/A0%Oct 23, 2026
CVE-2026-115569: fallow-rs, @fallow-cli: Fallow is a codebase intelligence tool for TypeScript and JavaScript3.3 LowN/A0%Oct 23, 2026
CVE-2026-112342: Tandoor Recipes: Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows…7.1 High7.1 High0%Oct 23, 2026
CVE-2026-115863: ConnMan: ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message7.6 HighN/A0%Oct 23, 2026
CVE-2026-115813: AWS multi-model-server: Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier…5.8 Medium6.9 Medium0%Oct 23, 2026
CVE-2026-115812: AWS multi-model-server: Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier…9.8 Critical9.3 Critical1%Oct 23, 2026
CVE-2026-115567: tokio-rs tokio: Tokio is a runtime for writing applications with RustN/A5.8 Medium0%Oct 23, 2026
CVE-2026-110975: A flaw was found in Kruize Autotune7.4 HighN/A0%Oct 23, 2026
CVE-2026-87901: phpBB: Improper sanitization in the registration module allows reflected Cross-Site Scripting.8.3 HighN/A0%Oct 23, 2026
CVE-2026-115810: TandoorRecipes recipes: Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows…7.7 High6.3 Medium0%Oct 23, 2026
Red Hat: CVE-2026-106074: nodejs: nodejs: predictable random values via snapshot entropy cache reuse4.8 MediumN/A0%Oct 23, 2026
Red Hat: CVE-2026-106073: nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()3.3 LowN/A0%Oct 23, 2026
Red Hat: CVE-2026-106072: nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification6.7 MediumN/A1%Oct 23, 2026
Red Hat: CVE-2026-106071: nodejs: nodejs: Permission model bypass via wildcard path matching flaw3.6 LowN/A0%Oct 23, 2026
Red Hat: CVE-2026-106070: nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch3.7 LowN/A0%Oct 23, 2026
Node.js: CVE-2026-106069: TLS certificate validated against a different IP address for non-canonical IPv4 literals7.4 HighN/A0%Oct 23, 2026
Node.js: CVE-2026-105483: TLS certificate hostname verification bypass for IPv4 addresses written with fullwidth digits7.4 HighN/A0%Oct 23, 2026
Node.js: CVE-2026-105482: dns.resolve truncates hostnames containing a NUL byte7.4 HighN/A0%Oct 23, 2026
Red Hat: CVE-2026-105481: nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse6.5 MediumN/A0%Oct 23, 2026
CVE-2026-57845: huggingface datasets: Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute…8.8 High8.7 High1%Oct 23, 2026
2226-2250 of 417096