Rapid7 Vulnerability & Exploit Database

Emergent Threat6

CVE-2026-21589:Critical unauthenticated arbitrary file access in Atlassian productsBlog ↗CVE details

CVE-2026-21589:Critical unauthenticated arbitrary file access in Atlassian products

Blog ↗CVE details

CVE-2026-76504:Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)

Blog ↗CVE details

CVE-2026-88771:Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772

Blog ↗CVE details

CVE-2026-94127:Critical Unauthenticated RCE in F5 BIG-IP APM

Blog ↗CVE details

CVE-2026-76461:Critical Cisco Secure Email Gateway Vulnerability Exploited in the Wild

Blog ↗CVE details

CVE-2026-85706:Critical GitLab Path Traversal Exploited in the Wild

Blog ↗CVE details

CVE-2026-76504:Critical Cisco Catalyst SD-WAN Manager API authentication bypass exploited in the wild (CVE-2026-76504)Blog ↗CVE details

CVE-2026-88771:Zero-Day Exploitation of Citrix NetScaler ADC and Gateway: CVE-2026-88771 and CVE-2026-88772Blog ↗CVE details

CVE-2026-94127:Critical Unauthenticated RCE in F5 BIG-IP APMBlog ↗CVE details

CVE-2026-76461:Critical Cisco Secure Email Gateway Vulnerability Exploited in the WildBlog ↗CVE details

CVE-2026-85706:Critical GitLab Path Traversal Exploited in the WildBlog ↗CVE details

Title			EitW	Modules

Title
CVE-2026-76501: Cisco Cisco NX-OS Software: A vulnerability in the Segment Routing over IPv6 (SRv6) Operation, Administration, and Maintenance (OAM) feature of…	9.8 Critical	N/A	N/A	Oct 7, 2026
CVE-2026-76488: Cisco Cisco Application Policy Infrastructure Controller (APIC): A vulnerability in the export policies functionality of Cisco Application Policy Infrastructure Controller (APIC) could…	6.5 Medium	N/A	N/A	Oct 7, 2026
CVE-2026-76486: Cisco Cisco NX-OS Software: A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as…	9.8 Critical	N/A	N/A	Oct 7, 2026
CVE-2026-76485: Cisco Cisco NX-OS Software: A vulnerability in the VXLAN Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software, known as…	9.8 Critical	N/A	N/A	Oct 7, 2026
CVE-2026-76465: Cisco Cisco NX-OS Software: A vulnerability in the MPLS Operation, Administration, and Maintenance (OAM) feature of Cisco NX-OS Software for Cisco…	9.8 Critical	N/A	N/A	Oct 7, 2026
CVE-2026-76452: Cisco Cisco License On-Prem: A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager…	4.9 Medium	N/A	N/A	Oct 7, 2026
CVE-2026-76437: Cisco Cisco License On-Prem: A vulnerability in the web-based user interface of Cisco License On-Prem, formerly Cisco Smart Software Manager On-Prem…	4.9 Medium	N/A	N/A	Oct 7, 2026
CVE-2026-62252: sipcapture homer: Homer is open source telecom observability software	9.8 Critical	N/A	N/A	Oct 7, 2026
CVE-2026-20328: Cisco Cisco License On-Prem: A vulnerability in the web-based management interface of Cisco License On-Prem, formerly Cisco Smart Software Manager…	9.1 Critical	N/A	N/A	Oct 7, 2026
CVE-2026-20321: Cisco Cisco Application Policy Infrastructure Controller (APIC): A vulnerability in the web-based management API for Cisco Application Policy Infrastructure Controller (APIC) could…	6.5 Medium	N/A	N/A	Oct 7, 2026
CVE-2026-107272: gophish: Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to…	4.7 Medium	2.3 Low	N/A	Oct 7, 2026
CVE-2026-107202: jonssonyan h-ui: A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper…	N/A	N/A	N/A	Oct 7, 2026
CVE-2026-102258: SonicWall SMA1000: Post-authentication Stored Cross-Site Scripting (XSS) vulnerability has been identified in the SMA1000 Appliance…	6.1 Medium	N/A	N/A	Oct 7, 2026
CVE-2026-102256: SonicWall SMA1000: Post-authentication Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')…	7.8 High	N/A	N/A	Oct 7, 2026
CVE-2026-92532: BugTracker.NET: Unrestricted file upload vulnerability in the BugTracker.NET attachment functionality	N/A	7.5 High	N/A	Oct 7, 2026
CVE-2026-92531: BugTracker.NET: Operating system command injection vulnerability in the SVN integration component of BugTracker.NET	N/A	7.5 High	N/A	Oct 7, 2026
CVE-2025-64391: Veeam Agent for Windows: This vulnerability in Veeam Agent for Microsoft Windows allows a low-privileged local user to make the agent write…	N/A	4.1 Medium	N/A	Oct 7, 2026
CVE-2026-97331: Unknown User Private Files: The User Private Files WordPress plugin before 2.1.9 does not validate that a supplied user belongs to the document…	4.3 Medium	N/A	N/A	Oct 7, 2026
CVE-2026-97188: Unknown String locator: The String locator WordPress plugin before 2.6.8 does not restrict the classes allowed when deserializing the content…	8.8 High	N/A	N/A	Oct 7, 2026
CVE-2026-87782: Unknown Koinonia Link: The Koinonia Link WordPress plugin before 1.1.5 does not check that a user is allowed to change roles before saving a…	8.8 High	N/A	N/A	Oct 7, 2026
CVE-2026-86833: Unknown MetForm: The MetForm WordPress plugin before 4.3.1 does not sanitize or escape submitted form-field values before inserting them…	5.4 Medium	N/A	N/A	Oct 7, 2026
CVE-2026-104678: Unknown CP Media Player: The CP Media Player WordPress plugin before 1.3.4 does not perform a capability check on its settings-page handler,…	2.7 Low	N/A	N/A	Oct 7, 2026
CVE-2026-104677: Unknown WP Coder: The WP Coder WordPress plugin before 4.5.2 does not restrict access to its PHP code-execution feature to…	7.2 High	N/A	N/A	Oct 7, 2026
CVE-2026-104653: Unknown Envira Gallery: The Envira Gallery WordPress plugin before 1.16.1 does not sanitise or escape user-supplied gallery display…	6.8 Medium	N/A	N/A	Oct 7, 2026
CVE-2026-104652: Unknown Envira Gallery: The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before…	6.8 Medium	N/A	N/A	Oct 7, 2026

Rows per page

1-25 of 17425

›

MDR Buyer's Guide

Global Threat Landscape Report