The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-115570: electron: Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS7.4 HighN/A0%Oct 23, 2026
CVE-2026-115569: fallow-rs, @fallow-cli: Fallow is a codebase intelligence tool for TypeScript and JavaScript3.3 LowN/A0%Oct 23, 2026
CVE-2026-112342: Tandoor Recipes: Tandoor Recipes before 2.7.0 contains an improper cache-key design in cookbook/helper/permission_helper.py that allows…7.1 High7.1 High0%Oct 23, 2026
CVE-2026-115863: ConnMan: ConnMan through 2.0 has a stack-based buffer overflow via a DHCPv6 Reply message7.6 HighN/A0%Oct 23, 2026
CVE-2026-115813: AWS multi-model-server: Server-side request forgery in the model download path in Amazon Web Services Multi Model Server 1.1.11 and earlier…5.8 Medium6.9 Medium0%Oct 23, 2026
CVE-2026-115812: AWS multi-model-server: Relative path traversal during model archive extraction in Amazon Web Services Multi Model Server 1.1.11 and earlier…9.8 Critical9.3 Critical1%Oct 23, 2026
CVE-2026-115567: tokio-rs tokio: Tokio is a runtime for writing applications with RustN/A5.8 Medium0%Oct 23, 2026
CVE-2026-110975: A flaw was found in Kruize Autotune7.4 HighN/A0%Oct 23, 2026
CVE-2026-87901: phpBB: Improper sanitization in the registration module allows reflected Cross-Site Scripting.8.3 HighN/A0%Oct 23, 2026
CVE-2026-115810: TandoorRecipes recipes: Tandoor Recipes before 2.7.0 contains a server-side request forgery vulnerability in the Pestle importer that allows…7.7 High6.3 Medium0%Oct 23, 2026
Red Hat: CVE-2026-106074: nodejs: nodejs: predictable random values via snapshot entropy cache reuse4.8 MediumN/A0%Oct 23, 2026
Red Hat: CVE-2026-106073: nodejs: Node.js: Filesystem read permission bypass via fs.realpathSync()3.3 LowN/A0%Oct 23, 2026
Red Hat: CVE-2026-106072: nodejs: nodejs: Authentication bypass via non-canonical IPv4 hostname verification6.7 MediumN/A1%Oct 23, 2026
Red Hat: CVE-2026-106071: nodejs: nodejs: Permission model bypass via wildcard path matching flaw3.6 LowN/A0%Oct 23, 2026
Red Hat: CVE-2026-106070: nodejs: Node.js: Security inspection bypass via crafted ZIP archive header mismatch3.7 LowN/A0%Oct 23, 2026
Node.js: CVE-2026-106069: TLS certificate validated against a different IP address for non-canonical IPv4 literals7.4 HighN/A0%Oct 23, 2026
Node.js: CVE-2026-105483: TLS certificate hostname verification bypass for IPv4 addresses written with fullwidth digits7.4 HighN/A0%Oct 23, 2026
Node.js: CVE-2026-105482: dns.resolve truncates hostnames containing a NUL byte7.4 HighN/A0%Oct 23, 2026
Red Hat: CVE-2026-105481: nodejs: nodejs: Response desynchronization via improper HTTP keep-alive connection reuse6.5 MediumN/A0%Oct 23, 2026
CVE-2026-57845: huggingface datasets: Hugging Face Datasets through 5.1.0 contains an insecure deserialization vulnerability that allows attackers to execute…8.8 High8.7 High1%Oct 23, 2026
CVE-2026-52356: n/a: An OS command injection vulnerability in the /htdocs/web/diagnostic.php endpoint of D-Link DAP1160L A1_FW101WWb04…8.8 HighN/A2%Oct 23, 2026
CVE-2026-50787: n/a: e-SIC Livre (esiclivre) v0.2.2 and earlier contains an uncontrolled resource consumption vulnerability in…7.5 HighN/A0%Oct 23, 2026
CVE-2025-45528: Undefined Security WeaknessN/AN/A0%Oct 23, 2026
CVE-2026-58497: olo-dot-io Uni-CLI: Uni-CLI gives people and agents one command interface for websites, browsers, desktop applications, local tools, and MCPN/A8.6 High0%Oct 23, 2026
CVE-2026-55486: intranda goobi-viewer-core: The Goobi viewer is a web application that allows digitised material to be displayed in a web browser9.3 CriticalN/A0%Oct 23, 2026
2426-2450 of 413066