The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-114061: sveltejs kit: SvelteKit (@sveltejs/kit) before 3.0.0 contains a cross-site scripting vulnerability in prerendered pages because a…4.7 Medium2.3 Low0%Oct 21, 2026
CVE-2026-114059: ArcadeData arcadedb: ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including…7.5 High7.7 High0%Oct 21, 2026
CVE-2026-114056: ArcadeData arcadedb: ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to…4.3 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-114054: vllm-project vllm: vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache…6.5 Medium7.1 High0%Oct 21, 2026
CVE-2026-114051: vllm-project vllm: vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens,…7.5 High7.1 High0%Oct 21, 2026
CVE-2026-114049: vllm-project vllm: vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to…3.7 Low6.3 Medium0%Oct 21, 2026
CVE-2026-114046: FreeRDP: FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null…6.5 Medium7.1 High0%Oct 21, 2026
CVE-2026-114044: FreeRDP: FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP…5.3 Medium6.9 Medium0%Oct 21, 2026
CVE-2026-114041: FreeRDP: FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a…6.5 Medium6.9 Medium0%Oct 21, 2026
CVE-2021-48020: Out-of-bounds Write6.5 Medium8.3 High0%Oct 21, 2026
CVE-2020-37289: Improper Input Validation3.7 Low6.3 Medium0%Oct 21, 2026
CVE-2026-113735: D-Link DCS-6501LH: A vulnerability was determined in D-Link DCS-6501LH 3.03.023.7 Low2.9 Low1%Oct 21, 2026
CVE-2026-113707: a2aproject a2a-rs: A security flaw has been discovered in a2aproject a2a-rs up to 0.4.45.4 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-113706: a2aproject a2a-rs: A vulnerability was identified in a2aproject a2a-rs up to 0.4.33.5 Low5.1 Medium0%Oct 21, 2026
CVE-2026-109682: Rapid7 Metasploit Framework: Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a…4.7 MediumN/A0%Oct 21, 2026
CVE-2026-109681: Rapid7 Metasploit Framework: The FTP client trusts the server's PASV response IP:port without validation against the control connection target4.7 MediumN/A0%Oct 21, 2026
CVE-2026-113736: D-Link DHP-W610AV: A vulnerability has been found in D-Link DHP-W610AV 1.02EUb039.8 Critical8.9 High1%Oct 21, 2026
CVE-2026-6945: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 20, 2026
CVE-2026-112202: Out-of-bounds ReadN/AN/A0%Oct 20, 2026
CVE-2026-113705: a2aproject a2a-rs: A vulnerability was determined in a2aproject a2a-rs up to 0.4.35.3 Medium6.9 Medium0%Oct 20, 2026
CVE-2026-9825: IBM CyberFraud: IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over…3.7 LowN/A0%Oct 20, 2026
CVE-2026-94402: IBM: IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting6.1 MediumN/A0%Oct 20, 2026
CVE-2026-93888: IBM Sterling Connect Direct for Unix: IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable…7.8 HighN/A0%Oct 20, 2026
CVE-2026-93744: IBM i: IBM i 7.3, 7.4, 7.5, and 7.6 could allow an unathenticated remote attacker to bypass security restrictions due to…6.5 MediumN/A0%Oct 20, 2026
CVE-2026-93442: IBM QRadar: IBM QRadar SIEM 7.6.0.0 through 7.6.0.4, and 7.5.0 through 7.5.0 Update Package 16 Interim Fix 001 could allow a remote…8.2 HighN/A0%Oct 20, 2026
3701-3725 of 417096