The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-114044: FreeRDP: FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP…5.3 Medium6.9 Medium0%Oct 21, 2026
CVE-2026-114042: FreeRDP: FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the…6.5 Medium7.1 High0%Oct 21, 2026
CVE-2026-114041: FreeRDP: FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a…6.5 Medium6.9 Medium0%Oct 21, 2026
Red Hat: CVE-2026-114038: device-mapper-multipath: device-mapper-multipath: Information disclosure via malformed format string5.1 MediumN/A0%Oct 21, 2026
CVE-2026-113741: itsourcecode Online Cake Ordering System: A vulnerability has been found in itsourcecode Online Cake Ordering System 1.04.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-113740: itsourcecode Online Cake Ordering System: A flaw has been found in itsourcecode Online Cake Ordering System 1.06.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-113738: R6410418 Jackrong-llm-finetuning-guide: A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d096.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-113736: D-Link DHP-W610AV: A vulnerability has been found in D-Link DHP-W610AV 1.02EUb039.8 Critical8.9 High1%Oct 21, 2026
Alma Linux: CVE-2026-111943: Important: golang security, bug fix, and enhancement update (Multiple Advisories)N/AN/A0%Oct 21, 2026
CVE-2026-105044: Qingteng Host Adaptive Security Platform: Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in…N/A8.5 High1%Oct 21, 2026
CVE-2025-71437: astral-sh uv: Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that…6.5 Medium8.7 High0%Oct 21, 2026
CVE-2021-48020: Out-of-bounds Write6.5 Medium8.3 High0%Oct 21, 2026
CVE-2021-48018: Out-of-bounds Write7.4 High8.3 High0%Oct 21, 2026
CVE-2020-37289: Improper Input Validation3.7 Low6.3 Medium0%Oct 21, 2026
CVE-2020-37288: Always-Incorrect Control Flow Implementation3.7 Low6.3 Medium0%Oct 21, 2026
CVE-2020-37287: Incorrect Calculation of Buffer Size5.9 Medium8.2 High0%Oct 21, 2026
CVE-2026-114083: triggerdotdev trigger.dev: Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets…8.1 High8.6 High0%Oct 21, 2026
CVE-2026-114078: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and…8.1 High7.2 High0%Oct 21, 2026
CVE-2026-114073: triggerdotdev trigger.dev: Trigger.dev CLI before 4.5.9 contains an information disclosure vulnerability that exposes resolved environment secret…5.5 Medium6.8 Medium0%Oct 21, 2026
CVE-2026-114068: triggerdotdev trigger.dev: Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that…8.3 High7.2 High0%Oct 21, 2026
CVE-2026-114063: sveltejs kit: SvelteKit (@sveltejs/kit) from 2.10.0 before 3.0.0 contains a path traversal vulnerability in the vite preview server…7.5 High8.7 High0%Oct 21, 2026
CVE-2026-114058: ArcadeData arcadedb: ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that…4.3 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-114055: vllm-project vllm: vLLM from 0.7.3 before 0.31.0 contains an uncontrolled resource consumption vulnerability that allows remote clients to…7.5 High8.7 High0%Oct 21, 2026
CVE-2026-114053: vllm-project vllm: vLLM from 0.7.3 before 0.31.0 forwards the request-supplied mm_processor_kwargs.code_revision to Transformers…8.1 High9.2 Critical0%Oct 21, 2026
CVE-2026-114048: WWBN AVideo: WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php…3.5 Low5.1 Medium0%Oct 21, 2026
3051-3075 of 522616