The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116482: subhajitkhan online-clinic-management-system: A vulnerability has been found in subhajitkhan online-clinic-management-system up to…3.5 Low5.1 MediumN/AOct 26, 2026
CVE-2026-70382: WolfVision: Some externally supplied values stored by the device may be rendered in the web interface without sufficient output…4.1 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-65630: potatosalad jose: Observable Timing Discrepancy vulnerability in potatosalad jose allows recovery of a long-term X25519 private key…N/A5.9 MediumN/AOct 26, 2026
CVE-2026-65632: potatosalad jose: The jose library accepts ECDSA (ES256, ES256K, ES384, and ES512) JWS signatures of a non-canonical lengthN/A5.1 MediumN/AOct 26, 2026
CVE-2026-65631: potatosalad jose: Inefficient Algorithmic Complexity in erlang-jose allows an unauthenticated remote attacker to cause a CPU-exhaustion…N/A6.9 MediumN/AOct 26, 2026
CVE-2026-65629: potatosalad jose: Use of Password Hash With Insufficient Computational Effort in the jose library allows an attacker who obtains a…N/A7.4 HighN/AOct 26, 2026
CVE-2026-65628: potatosalad jose: jose_jwk:shared_secret/2 (exposed in Elixir as JOSE.JWK.shared_secret/2) derives an ECDH shared secret from two JWKsN/A5.9 MediumN/AOct 26, 2026
CVE-2026-65627: potatosalad jose: Improper Handling of Highly Compressed Data (Data Amplification) vulnerability in potatosalad jose (erlang-jose) allows…N/A6.9 MediumN/AOct 26, 2026
CVE-2026-57184: asterisk: Asterisk is an open source private branch exchange and telephony toolkitN/A6.3 MediumN/AOct 26, 2026
CVE-2026-65626: potatosalad jose: The pure-Erlang RSAES-PKCS1-v1_5 decryption in the jose_jwa_pkcs1 module is a Bleichenbacher padding oracleN/A5.9 MediumN/AOct 26, 2026
CVE-2026-65625: potatosalad jose: The pure-Erlang AES-GCM fallback in jose_jwa_aes derives the number of verified authentication tag bits from the…N/A5.9 MediumN/AOct 26, 2026
CVE-2026-70381: WolfVision: An access-control vulnerability has been identified in the web server configuration5.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-57193: asterisk: Asterisk is an open source private branch exchange and telephony toolkitN/A6.9 MediumN/AOct 26, 2026
CVE-2026-70380: WolfVision: A denial-of-service vulnerability has been identified in the Miracast over Infrastructure Connection Establishment…5.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-116479: a2aproject a2a-java: A flaw has been found in a2aproject a2a-java up to 1.2.0.Final4.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-115533: Hugging Face LeRobot: The LeRobot library is vulnerable to arbitrary code execution via unsafe dynamic class instantiation in the…N/AN/AN/AOct 26, 2026
CVE-2026-115927: tornadoweb tornado: Tornado is a Python web framework and asynchronous networking library5.3 MediumN/AN/AOct 26, 2026
CVE-2026-57187: asterisk: Asterisk is an open source private branch exchange and telephony toolkitN/A7.1 HighN/AOct 26, 2026
CVE-2026-116478: a2aproject a2a-go: A vulnerability was detected in a2aproject a2a-go up to 2.4.05.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-57196: asterisk: Asterisk is an open source private branch exchange and telephony toolkitN/A2.3 LowN/AOct 26, 2026
CVE-2026-115924: danielgatis rembg: Rembg is a tool to remove images background8.6 HighN/AN/AOct 26, 2026
CVE-2026-116638: n/a: The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security…N/AN/AN/AOct 26, 2026
CVE-2026-116632: Mozilla Firefox for iOS: A malicious web page could insert arbitrary text into the FaceTime call prompt shown by iOS, potentialy allowing it to…5.4 MediumN/AN/AOct 26, 2026
CVE-2026-116631: Mozilla Firefox for iOS: A malicious web page could open a tel link in a window that was showing a different website, causing the phone-call…5.4 MediumN/AN/AOct 26, 2026
CVE-2026-116476: a2aproject a2a-dotnet: A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview35.4 Medium5.3 MediumN/AOct 26, 2026
1-25 of 416032
›