The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-82814: smub, Duplicator: The Duplicator and Duplicator Pro plugins for WordPress are vulnerable to PHP Object Injection in all versions up to,…8.8 HighN/AN/AOct 21, 2026
CVE-2026-113744: Tenda AC19: A security vulnerability has been detected in Tenda AC19 16.03.10.0710.0 Critical9.3 CriticalN/AOct 21, 2026
CVE-2026-113743: Tenstorrent tt-metal: A weakness has been identified in Tenstorrent tt-metal up to 0.80.06.3 Medium2.1 LowN/AOct 21, 2026
CVE-2026-114198: Mandiant FLARE floss: Deserialization of untrusted data in Mandiant FLARE floss releases before 3.2.0 allows arbitrary code execution when a…N/A8.7 HighN/AOct 21, 2026
CVE-2026-114197: Mandiant FLARE capa: Deserialization of untrusted data in Mandiant FLARE capa releases before 10.0.0 allows arbitrary code execution when a…N/A8.7 HighN/AOct 21, 2026
CVE-2026-114119: Best Practice Software Bp Premier: Best Practice Software Bp Premier before 1.14.1.1128 uses a hardcoded Microsoft SQL Server administrative password that…9.8 Critical9.3 CriticalN/AOct 21, 2026
CVE-2026-114118: vyperlang vyper: Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction…4.8 Medium6.3 MediumN/AOct 21, 2026
CVE-2026-114117: vyperlang vyper: Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where…5.9 Medium8.2 HighN/AOct 21, 2026
CVE-2026-114116: vyperlang vyper: Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), which…5.3 Medium6.0 MediumN/AOct 21, 2026
CVE-2026-114115: vyperlang vyper: Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays…3.7 Low6.3 MediumN/AOct 21, 2026
CVE-2026-114114: vyperlang vyper: Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8…5.3 Medium6.0 MediumN/AOct 21, 2026
CVE-2026-114113: lovell sharp: Sharp before 0.35.0 bundles a version of libvips affected by multiple vulnerabilities (CVE-2026-33327, CVE-2026-33328,…N/A8.4 HighN/AOct 21, 2026
CVE-2026-114112: lovell sharp: Sharp before 0.35.4 bundles a vulnerable libheif dependency that allows attackers to achieve possible remote code…N/A8.9 HighN/AOct 21, 2026
CVE-2026-114111: lovell sharp: sharp before 0.35.5 bundles a librsvg dependency affected by a memory-related vulnerability (CVE-2026-96889) that,…N/A8.9 HighN/AOct 21, 2026
CVE-2026-114110: astral-sh uv: Astral uv before 0.11.6 contains a path traversal vulnerability that allows attackers to delete arbitrary files by…5.3 Medium8.7 HighN/AOct 21, 2026
CVE-2026-114109: astral-sh uv: uv before 0.11.15 contains a path traversal vulnerability that allows malicious wheels to write files outside the…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114108: HKUDS Vibe-Trading: HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated…9.8 Critical9.3 CriticalN/AOct 21, 2026
CVE-2026-114107: HKUDS Vibe-Trading: HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains an indirect prompt injection vulnerability that allows remote…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114106: HKUDS Vibe-Trading: HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a path traversal vulnerability that allows remote attackers to read…7.5 High8.7 HighN/AOct 21, 2026
CVE-2026-114105: cthackers adm-zip: Adm-zip before 0.6.1 contains an incorrect permission assignment vulnerability that allows attackers to set setuid,…6.2 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114104: cthackers adm-zip: adm-zip before 0.6.1 contains an inconsistent entry resolution vulnerability that allows attackers to bypass content…5.9 Medium8.2 HighN/AOct 21, 2026
CVE-2026-114103: cthackers adm-zip: adm-zip 0.6.0 contains a decompression bomb protection bypass that allows attackers to evade the maxOutputLength guard…5.3 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114102: cthackers adm-zip: adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the…7.5 High8.7 HighN/AOct 21, 2026
CVE-2026-114101: corazawaf coraza: Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987…4.0 Medium6.3 MediumN/AOct 21, 2026
CVE-2026-114100: corazawaf coraza: Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection…5.8 Medium6.9 MediumN/AOct 21, 2026
401-425 of 417319
‹›