The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-89117: SAP_SE SAP NetWeaver Enterprise Portal: SAP NetWeaver Enterprise Portal allows an unauthenticated attacker to inject malicious scripts into a URL parameter6.1 MediumN/A0%Oct 13, 2026
CVE-2026-89116: SAP_SE SAP yeoman-ui: The affected code used child_process.execSync with a shell string for generator installation and uninstallation5.9 MediumN/A0%Oct 13, 2026
CVE-2026-89113: SAP_SE SAP Commerce Cloud (OOTB Code): SAP Commerce Cloud does not sufficiently validate certain user-supplied input before it is incorporated into a database…8.8 HighN/A0%Oct 13, 2026
CVE-2026-89112: SAP_SE CLA-Assistant: The admin API endpoint used to retrieve CLA signature records does not consistently enforce the required authorization…6.5 MediumN/A0%Oct 13, 2026
CVE-2026-89111: SAP_SE SAP Cloud: The SAP Cloud SDK for Python contains an OAuth2 SSRF vulnerability affecting multi-tenant BTP applications10.0 CriticalN/A0%Oct 13, 2026
CVE-2026-89110: SAP_SE SAP NetWeaver Visual Composer: SAP NetWeaver Visual Composer does not perform sufficient authorization checks in certain portal functionality9.9 CriticalN/A0%Oct 13, 2026
CVE-2026-89108: SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service): SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain…9.1 CriticalN/A0%Oct 13, 2026
CVE-2026-89107: SAP_SE SAP S/4HANA (Manage Substitution/Validation Rules): SAP S/4HANA (Manage Substitution/Validation Rules) does not sufficiently validate input processed by rule definition…9.9 CriticalN/A0%Oct 13, 2026
CVE-2026-89106: SAP_SE SAPUI5: SAP UI5 does not perform sufficient input validation under certain configurations4.4 MediumN/A0%Oct 13, 2026
CVE-2026-89105: SAP_SE SAP/cloud-security-services-integration-library: The HybridTokenAuthenticator component of the SAP/cloud-security-services-integration-library accepts tokens from…4.2 MediumN/A0%Oct 13, 2026
CVE-2026-87689: Rapid7 Metasploit Framework: The Metasploit Framework Web Service REST API (msf-ws) exposes the credential store through…9.8 CriticalN/A0%Oct 13, 2026
CVE-2026-76976: SAP_SE SAP NetWeaver Application Server ABAP (Applications based on SAP GUI for HTML): Applications based on SAP GUI for HTML in SAP NetWeaver Application Server ABAP do not sufficiently sanitize…5.4 MediumN/A0%Oct 13, 2026
CVE-2026-76975: SAP_SE SAPUI5 (Support Assistant Overlay): Due to a DOM-Based Cross-Site Scripting (XSS) vulnerability, an unauthenticated attacker could generate a malicious…6.1 MediumN/A0%Oct 13, 2026
CVE-2026-76972: SAP_SE SAP Manufacturing Integration and Intelligence: Due to a Cross-Site Scripting (XSS) vulnerability in SAP Manufacturing Integration and Intelligence, an attacker could…6.5 MediumN/A0%Oct 13, 2026
CVE-2026-58249: SAP_SE SAP NetWeaver and SAP Web Dispatcher (Internet Communication Manager): SAP NetWeaver and SAP Web Dispatcher do not properly validate certain fields in specially crafted requests handled by…7.5 HighN/A0%Oct 13, 2026
CVE-2026-58242: SAP_SE SAP Cloud Connector: SAP Cloud Connector contains an improper authorization check, which could be exploited by a low-privileged attacker…3.5 LowN/A0%Oct 13, 2026
CVE-2026-108945: Improper Control of Generation of Code5.3 Medium4.8 Medium0%Oct 13, 2026
CVE-2026-108944: Improper Control of Generation of Code4.8 Medium2.4 Low0%Oct 13, 2026
CVE-2026-108943: Improper Control of Generation of Code5.3 Medium1.9 Low0%Oct 13, 2026
CVE-2026-108942: Improper Neutralization of Input During Web Page Generation3.5 Low5.1 Medium0%Oct 13, 2026
CVE-2026-96119: IBM i: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to obtain sensitive information or execute…9.9 CriticalN/A1%Oct 13, 2026
CVE-2026-93886: IBM i: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to execute arbitrary script code due to…5.4 MediumN/A0%Oct 13, 2026
CVE-2026-81858: IBM i: IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to cause a denial of service and obtain…8.1 HighN/A0%Oct 13, 2026
CVE-2026-19938: Use After Free5.9 MediumN/A0%Oct 13, 2026
CVE-2026-19937: Missing Release of Resource after Effective Lifetime5.7 MediumN/A0%Oct 13, 2026
3376-3400 of 443854
‹›