The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114116: vyperlang vyper: Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which…5.3 Medium6.0 MediumN/AOct 21, 2026
CVE-2026-114115: vyperlang vyper: Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays…3.7 Low6.3 MediumN/AOct 21, 2026
CVE-2026-114114: vyperlang vyper: Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8…5.3 Medium6.0 MediumN/AOct 21, 2026
CVE-2026-114113: lovell sharp: Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328,…N/A8.4 HighN/AOct 21, 2026
CVE-2026-114112: lovell sharp: Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code…N/A8.9 HighN/AOct 21, 2026
CVE-2026-114111: lovell sharp: sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that,…N/A8.9 HighN/AOct 21, 2026
CVE-2026-114110: astral-sh uv: Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by…5.3 Medium8.7 HighN/AOct 21, 2026
CVE-2026-114109: astral-sh uv: uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114108: HKUDS Vibe-Trading: HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated…9.8 Critical9.3 CriticalN/AOct 21, 2026
CVE-2026-114107: HKUDS Vibe-Trading: HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114106: HKUDS Vibe-Trading: HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read…7.5 High8.7 HighN/AOct 21, 2026
CVE-2026-114105: cthackers adm-zip: Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid,…6.2 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114104: cthackers adm-zip: adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content…5.9 Medium8.2 HighN/AOct 21, 2026
CVE-2026-114103: cthackers adm-zip: adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard…5.3 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114102: cthackers adm-zip: adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the…7.5 High8.7 HighN/AOct 21, 2026
CVE-2026-114101: corazawaf coraza: Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987…4.0 Medium6.3 MediumN/AOct 21, 2026
CVE-2026-114100: corazawaf coraza: Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection…5.8 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114099: corazawaf coraza: Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST…5.8 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114098: jelmer dulwich: Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to…7.8 High7.3 HighN/AOct 21, 2026
CVE-2026-114097: jelmer dulwich: Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that…7.8 High7.3 HighN/AOct 21, 2026
CVE-2026-114096: jelmer dulwich: Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that…7.8 High7.3 HighN/AOct 21, 2026
CVE-2026-114095: jelmer dulwich: Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause…6.5 Medium7.1 HighN/AOct 21, 2026
CVE-2026-114094: jelmer dulwich: Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114093: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114092: triggerdotdev trigger.dev: Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run…6.5 Medium8.3 HighN/AOct 21, 2026
351-375 of 417319
‹›