The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118765: randombit botan: Botan is a C++ cryptography libraryN/A7.3 HighN/AOct 29, 2026
CVE-2026-118764: isaacs minimatch: minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objectsN/A8.7 HighN/AOct 29, 2026
CVE-2026-118763: sigstore sigstore-js: sigstore-js provides JavaScript libraries for interacting with Sigstore services7.4 HighN/AN/AOct 29, 2026
CVE-2026-118762: monkeytypegame monkeytype: Monkeytype is a minimalistic and customizable typing test9.3 CriticalN/AN/AOct 29, 2026
CVE-2026-115805: Rapid7 Insight Agent: Improper handling of local filesystem paths in Rapid7 Insight Agent on Linux and macOS may allow authenticated local…7.8 HighN/AN/AOct 29, 2026
CVE-2026-11587: Centreon: SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database7.2 HighN/AN/AOct 29, 2026
CVE-2023-7357: Revera FlexNet Publisher: A remote code execution (RCE) vulnerability was identified in the FlexNet Publisher lmadmin web user interfaceN/A8.6 HighN/AOct 29, 2026
CVE-2026-118761: kubeflow pipelines: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows7.5 HighN/AN/AOct 29, 2026
CVE-2026-119115: AWS aws-privateca-issuer: Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes…8.5 High8.4 HighN/AOct 29, 2026
CVE-2026-118760: kubeflow pipelines: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118759: kubeflow pipelines: Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows7.5 HighN/AN/AOct 29, 2026
CVE-2025-12523: Centreon: Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user6.5 MediumN/AN/AOct 29, 2026
CVE-2026-62374: openwallet-foundation: SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT (SD-JWT) specificationN/A7.1 HighN/AOct 29, 2026
CVE-2026-96203: Microsoft Microsoft Edge (Chromium-based): Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.8.8 HighN/AN/AOct 29, 2026
CVE-2026-96199: Microsoft Microsoft Edge (Chromium-based): Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a…8.8 HighN/AN/AOct 29, 2026
CVE-2026-96198: Microsoft Microsoft Edge (Chromium-based): Heap-based buffer overflow in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a…8.8 HighN/AN/AOct 29, 2026
CVE-2026-96196: Microsoft Microsoft Edge (Chromium-based): Incomplete list of disallowed inputs in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a…8.8 HighN/AN/AOct 29, 2026
CVE-2026-96192: Microsoft Microsoft Edge (Chromium-based): Use after free in Microsoft Edge for iOS allows an unauthorized attacker to execute code over a network.8.8 HighN/AN/AOct 29, 2026
CVE-2026-96187: Microsoft Microsoft Edge (Chromium-based): Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized…7.4 HighN/AN/AOct 29, 2026
CVE-2026-93680: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.8 could allow a remote attacker to bypass security restrictions due to improper…9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-93571: Krajowa Izba Rozliczeniowa Szafir: Szafir is vulnerable to Path Traversal in the uploaded filenameN/A2.3 LowN/AOct 29, 2026
CVE-2026-93570: Krajowa Izba Rozliczeniowa: Szafir and Szafir Weryfikująca are vulnerable to XML External Entity (XXE) injectionN/A8.2 HighN/AOct 29, 2026
CVE-2026-90991: IBM Langflow OSS: IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to cause a denial of service due to…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-90872: Progress Software WS_FTP Server: Improper neutralization of directives in dynamically evaluated code in the Manager web console of Progress Software…6.6 MediumN/AN/AOct 29, 2026
CVE-2026-90871: Progress Software WS_FTP Server: Improper limitation of a pathname to a restricted directory in Progress Software WS_FTP Server versions prior to…5.3 MediumN/AN/AOct 29, 2026
1-25 of 538495
›