The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-114523: Drupal Ffmpeg Image Toolkit: Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal…N/AN/AN/AOct 30, 2026
CVE-2026-110738: Drupal Gin Admin Theme: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Gin Admin…N/AN/AN/AOct 30, 2026
CVE-2026-108515: Drupal Drupal core: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal…N/AN/AN/AOct 30, 2026
CVE-2026-108514: Drupal Drupal core: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Drupal…N/AN/AN/AOct 30, 2026
CVE-2026-108099: Drupal Entity List: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Entity List…N/AN/AN/AOct 30, 2026
CVE-2026-108097: Drupal Drupal core: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Drupal Drupal core…N/AN/AN/AOct 30, 2026
CVE-2026-107312: Drupal Examples for Developers: Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for Developers allows Excessive…N/AN/AN/AOct 30, 2026
CVE-2026-107311: Drupal Permissions by Term: Improper Check for Unusual or Exceptional Conditions vulnerability in Drupal Permissions by Term allows Forceful…N/AN/AN/AOct 30, 2026
CVE-2026-107310: Drupal Freelinking: Server-Side Request Forgery (SSRF) vulnerability in Drupal Freelinking allows Server Side Request ForgeryN/AN/AN/AOct 30, 2026
CVE-2026-107309: Drupal Easy Breadcrumb: Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-107308: Drupal Country: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Country…N/AN/AN/AOct 30, 2026
CVE-2026-107307: Drupal SmartLinker AI: Incorrect Authorization vulnerability in Drupal SmartLinker AI allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-107306: Drupal Menu Link Attributes: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Menu Link…N/AN/AN/AOct 30, 2026
CVE-2026-107268: Drupal Two Factor Authentication - TFA / Passwordless Login: Insertion of Sensitive Information Into Sent Data vulnerability in Drupal Two Factor Authentication - TFA /…N/AN/AN/AOct 30, 2026
CVE-2026-107267: Drupal DKAN: Missing Authorization vulnerability in Drupal DKAN allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-107266: Drupal Views Share: Missing Authorization vulnerability in Drupal Views Share allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-107265: Drupal Leaflet: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet…N/AN/AN/AOct 30, 2026
CVE-2026-107264: Drupal Inline Formatter Field: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field…N/AN/AN/AOct 30, 2026
CVE-2026-107263: Drupal Gutenberg: Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-107262: Drupal Advanced Filesystem: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request ForgeryN/AN/AN/AOct 30, 2026
CVE-2026-107261: Drupal Authenticator Login Plus (2FA): Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows…N/AN/AN/AOct 30, 2026
CVE-2026-107260: Drupal Sector Distribution: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector…N/AN/AN/AOct 30, 2026
CVE-2026-107259: Drupal Linked Field: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code…N/AN/AN/AOct 30, 2026
CVE-2026-107258: Drupal Inline Entity Form Dialog: Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-107257: Drupal Actstream: Incorrect Authorization vulnerability in Drupal Actstream allows Forceful BrowsingN/AN/AN/AOct 30, 2026
251-275 of 419148