The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2025-60491: n/a: A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows…N/AN/A0%Oct 21, 2026
CVE-2025-60490: n/a: A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC…N/AN/A0%Oct 21, 2026
CVE-2025-60487: n/a: A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2025-60478: n/a: A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2023-7356: Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches…N/AN/A0%Oct 21, 2026
CVE-2026-114437: go-chi chi: In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted…4.8 Medium6.3 Medium0%Oct 21, 2026
CVE-2026-114249: dhikshitha29 Insurance-Management-System: A vulnerability was detected in dhikshitha29 Insurance-Management-System…7.3 High5.5 Medium0%Oct 21, 2026
PHP Vulnerability: CVE-2026-1096199.8 Critical9.2 Critical6%Oct 21, 2026
PHP Vulnerability: CVE-2026-1096189.8 Critical9.2 Critical5%Oct 21, 2026
CVE-2026-104949: EnterpriseDB WarehousePG: WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability…N/A2.3 Low0%Oct 21, 2026
CVE-2026-104948: EnterpriseDB WarehousePG: WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability…N/A7.1 High0%Oct 21, 2026
CVE-2026-104947: EnterpriseDB WarehousePG: WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in…N/A5.3 Medium0%Oct 21, 2026
CVE-2025-71438: n/a: An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows…N/AN/A0%Oct 21, 2026
CVE-2025-60489: n/a: A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box…N/AN/A0%Oct 21, 2026
CVE-2025-60479: n/a: A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2025-0326: WSO2: The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account…N/AN/A0%Oct 21, 2026
CVE-2024-7478: WSO2: When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence…5.8 MediumN/A0%Oct 21, 2026
CVE-2024-6423: WSO2: The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data…4.0 MediumN/A0%Oct 21, 2026
CVE-2024-5563: WSO2 WSO2 Identity Server: Due to an incomplete implementation, reCaptcha is not applied to certain authentication flows even when the reCaptcha…4.8 MediumN/A0%Oct 21, 2026
CVE-2024-5139: WSO2: The Authentication Endpoint accepts user-supplied input without sufficient encoding, allowing for the injection of…6.1 MediumN/A0%Oct 21, 2026
CVE-2024-4989: WSO2 WSO2 API Manager: The callback URL parameter in WSO2 API Manager fails to validate user-supplied input, allowing it to be controlled by…5.4 MediumN/A0%Oct 21, 2026
CVE-2026-97313: ISC BIND 9: A recursive BIND server that receives a query with recursion desired (RD=1) followed by a non-recursive query (RD=0)…7.5 HighN/A0%Oct 21, 2026
CVE-2026-96888: ISC BIND 9: A BIND resolver that is configured with both a "redirect" zone and "qname-minimization strict" may abort with an…7.5 HighN/A0%Oct 21, 2026
CVE-2026-94300: ISC BIND 9: Replaying GSS-TSIG signed UDP messages can result in memory corruption in "`named`"8.1 HighN/A1%Oct 21, 2026
CVE-2026-90484: Apache Software Foundation Apache bRPC: The MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a…N/AN/A0%Oct 21, 2026
576-600 of 413183
‹›