The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113740: itsourcecode Online Cake Ordering System: A flaw has been found in itsourcecode Online Cake Ordering System 1.06.3 Medium2.1 LowN/AOct 21, 2026
CVE-2026-113738: R6410418 Jackrong-llm-finetuning-guide: A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d096.3 Medium2.1 LowN/AOct 21, 2026
CVE-2026-113737: R6410418 Jackrong-llm-finetuning-guide: A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d095.5 Medium2.0 LowN/AOct 21, 2026
CVE-2026-113736: D-Link DHP-W610AV: A vulnerability has been found in D-Link DHP-W610AV 1.02EUb039.8 Critical8.9 HighN/AOct 21, 2026
CVE-2026-111943: Go standard library crypto/x509: On most platforms, Go uses the given system root certificatesN/AN/AN/AOct 21, 2026
CVE-2026-105044: Qingteng Host Adaptive Security Platform: Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in…N/A8.5 HighN/AOct 21, 2026
CVE-2025-71437: astral-sh uv: Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that…6.5 Medium8.7 HighN/AOct 21, 2026
CVE-2021-48020: vyperlang vyper: Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer…6.5 Medium8.3 HighN/AOct 21, 2026
CVE-2021-48019: vyperlang vyper: Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed…4.8 Medium6.3 MediumN/AOct 21, 2026
CVE-2021-48018: vyperlang vyper: Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as…7.4 High8.3 HighN/AOct 21, 2026
CVE-2020-37289: vyperlang vyper: Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to…3.7 Low6.3 MediumN/AOct 21, 2026
CVE-2020-37288: vyperlang vyper: Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an internal…3.7 Low6.3 MediumN/AOct 21, 2026
CVE-2020-37287: vyperlang vyper: Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex…5.9 Medium8.2 HighN/AOct 21, 2026
CVE-2020-37286: vyperlang vyper: Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer…6.5 Medium8.3 HighN/AOct 21, 2026
CVE-2026-113735: D-Link DCS-6501LH: A vulnerability was determined in D-Link DCS-6501LH 3.03.023.7 Low2.9 LowN/AOct 21, 2026
CVE-2026-113707: a2aproject a2a-rs: A security flaw has been discovered in a2aproject a2a-rs up to 0.4.45.4 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-113706: a2aproject a2a-rs: A vulnerability was identified in a2aproject a2a-rs up to 0.4.33.5 Low5.1 MediumN/AOct 21, 2026
CVE-2026-109682: Rapid7 Metasploit Framework: Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a…4.7 MediumN/AN/AOct 21, 2026
CVE-2026-109681: Rapid7 Metasploit Framework: The FTP client trusts the server's PASV response IP:port without validation against the control connection target4.7 MediumN/AN/AOct 21, 2026
CVE-2026-6945: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 20, 2026
CVE-2026-113705: a2aproject a2a-rs: A vulnerability was determined in a2aproject a2a-rs up to 0.4.35.3 Medium6.9 MediumN/AOct 20, 2026
CVE-2026-112202: Out-of-bounds ReadN/AN/AN/AOct 20, 2026
CVE-2026-9825: IBM CyberFraud: IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over…3.7 LowN/AN/AOct 20, 2026
CVE-2026-94402: IBM: IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting6.1 MediumN/AN/AOct 20, 2026
CVE-2026-93888: IBM Sterling Connect Direct for Unix: IBM Sterling Connect Direct for Unix 6.4.0.0 through 6.4.0.6 and 6.3.0.0 through 6.3.0.7 apnotify utility is vulnerable…7.8 HighN/AN/AOct 20, 2026
526-550 of 417319
‹›