The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-126187: react: React is a JavaScript library for building user interfacesN/A9.5 CriticalN/ANov 10, 2026
CVE-2024-36309: AMD: Missing Lock Bit Protection in the Northbridge IO (NBIO) could allow a privileged attacker to use an intentionally…N/A4.6 MediumN/ANov 10, 2026
CVE-2026-126261: Fortinet FortiManager: A improper authorization vulnerability in Fortinet FortiManager 8.0.0, FortiManager 7.6.0 through 7.6.7, FortiManager…9.0 CriticalN/AN/ANov 10, 2026
CVE-2026-96437: Kong Inc. Kong Gateway Enterprise: The ai-azure-content-safety plugin in Kong Gateway Enterprise skips inspection of request bodies larger than the…N/A8.2 HighN/ANov 10, 2026
CVE-2026-92558: Kong Inc.: The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway do not escape separator…N/A6.3 MediumN/ANov 10, 2026
CVE-2026-92545: Kong Inc.: The proxy-cache and proxy-cache-advanced plugins in Kong Gateway Enterprise and Kong AI Gateway omit the request…N/A8.7 HighN/ANov 10, 2026
CVE-2026-92443: Kong Inc.: The caching plugins in Kong Gateway Enterprise and Kong AI Gateway may serve a response cached for a request carrying…N/A8.2 HighN/ANov 10, 2026
CVE-2026-92442: Kong Inc.: The graphql-proxy-cache-advanced plugin in Kong Gateway Enterprise omits the caller's identity from the cache key,…N/A8.3 HighN/ANov 10, 2026
CVE-2026-92441: Kong Inc.: Kong Gateway Enterprise and Kong AI Gateway include decoded CR/LF characters from the request path in the…N/A7.8 HighN/ANov 10, 2026
CVE-2026-92439: Kong Inc.: The SAML plugin in Kong Gateway Enterprise does not enforce AudienceRestriction, allowing a valid assertion issued for…N/A7.8 HighN/ANov 10, 2026
CVE-2026-91000: N-able N-central: Missing authentication for critical function vulnerability in N-able N-central allows Privilege EscalationN/A8.4 HighN/ANov 10, 2026
CVE-2026-90834: zephyrproject zephyr: The user-mode syscall verifiers for the 16-bit ("wide data") UART API in drivers/serial/uart_handlers.c validated the…5.5 MediumN/AN/ANov 10, 2026
CVE-2026-90833: zephyrproject zephyr: The simulated EEPROM driver validated access ranges in eeprom_range_is_valid() (drivers/eeprom/eeprom_simulator.c) with…7.8 HighN/AN/ANov 10, 2026
CVE-2026-90832: zephyrproject zephyr: bt_hci_le_per_adv_report_common() in subsys/bluetooth/host/scan.c handles the HCI_LE_Periodic_Advertising_Report (and…4.3 MediumN/AN/ANov 10, 2026
CVE-2026-89324: XTemos Basel Post Types: The Basel Post Types plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including,…9.8 CriticalN/AN/ANov 10, 2026
CVE-2026-87042: zephyrproject zephyr: The IEEE 1588 (PTP) port implementation in subsys/net/lib/ptp/port.c adopted the logMessageInterval field of a received…6.5 MediumN/AN/ANov 10, 2026
CVE-2026-82391: zephyrproject zephyr: The HTTP/2 front-end of the Zephyr HTTP server aliased connection receive state as a scratch output9.1 CriticalN/AN/ANov 10, 2026
CVE-2026-77685: zephyrproject zephyr: The RFCOMM multiplexer control-channel handler in subsys/bluetooth/host/classic/rfcomm.c computed the echo length for a…8.3 HighN/AN/ANov 10, 2026
CVE-2026-67177: Chargemap: Chargemap contains a stored cross site scripting vulnerability5.4 Medium5.1 MediumN/ANov 10, 2026
CVE-2026-67176: Chargemap: Chargemap contains an open redirect vulnerability in the authentication login endpoint5.4 Medium5.1 MediumN/ANov 10, 2026
CVE-2026-67175: Chargemap: Chargemap contains a stored cross-site scripting vulnerability that allows a remote, authenticated attacker to craft a…4.6 Medium5.1 MediumN/ANov 10, 2026
CVE-2026-40670: AMD: Improper check for unusual or exceptional conditions in AMD Secure Encrypted Virtualization - Secure Nested Paging…N/A5.9 MediumN/ANov 10, 2026
CVE-2026-40669: AMD: An off-by-one error in AMD Secure Encrypted Virtualization (SEV) firmware could allow an attacker with hypervisor…N/A4.0 MediumN/ANov 10, 2026
CVE-2026-40668: AMD: Authentication bypass by spoofing in AMD Secure Encrypted Virtualization (SEV) firmware could allow a malicious…N/A4.6 MediumN/ANov 10, 2026
CVE-2026-28249: AMD: Improper preservation of consistency between independent representations of shared state in AMD Secure Encrypted…N/A4.6 MediumN/ANov 10, 2026
1-25 of 557027
›