The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-101103: HMS Networks: The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold…5.5 Medium6.8 Medium0%Oct 20, 2026
CVE-2016-20104: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High1%Oct 20, 2026
CVE-2016-20103: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High0%Oct 20, 2026
CVE-2016-20102: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 20, 2026
CVE-2016-20101: Improper Control of Filename for Include/Require Statement in PHP Program8.1 High9.2 Critical0%Oct 20, 2026
CVE-2016-20100: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High1%Oct 20, 2026
CVE-2015-20128: Improper Neutralization of Special Elements used in an SQL Command8.2 High8.8 High0%Oct 20, 2026
CVE-2015-20125: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High0%Oct 20, 2026
CVE-2015-20124: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High0%Oct 20, 2026
CVE-2015-20123: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High0%Oct 20, 2026
CVE-2014-125134: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High1%Oct 20, 2026
CVE-2014-125133: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High1%Oct 20, 2026
CVE-2014-125132: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 20, 2026
CVE-2014-125131: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 20, 2026
CVE-2012-20005: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 20, 2026
CVE-2012-20004: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 20, 2026
CVE-2012-20003: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 20, 2026
CVE-2012-20002: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High1%Oct 20, 2026
CVE-2026-113728: bulwarkmail webmail: Bulwark Webmail is a self-hosted webmail client for Stalwart Mail Server7.5 HighN/A1%Oct 20, 2026
CVE-2026-86413: curl: When using an *ambient user* in a first transfer doing Negotiate authentication and asked to follow redirects, curl…N/AN/A0%Oct 20, 2026
Ubuntu: USN-8927-1 (CVE-2026-86412): curl vulnerabilitiesN/AN/A0%Oct 20, 2026
CVE-2026-86411: curl: An `ftp://` transfer configured with `CURLUSESSL_NONE` can reuse a pooled FTP control connection that a previous easy…N/AN/A0%Oct 20, 2026
Ubuntu: USN-8927-1 (CVE-2026-86410): curl vulnerabilitiesN/AN/A0%Oct 20, 2026
Red Hat: CVE-2026-86409: curl: curl: stale SigV4 headers sent unintendedN/AN/A0%Oct 20, 2026
Red Hat: CVE-2026-113869: thunderbird: thunderbird: Use-after-free via S/MIME decryption password prompt5.4 MediumN/A0%Oct 20, 2026
4226-4250 of 522616