The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-107267: Drupal DKAN: Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing5.3 MediumN/AN/AOct 30, 2026
CVE-2026-107266: Drupal Views Share: Missing Authorization vulnerability in Drupal Views Share allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-107265: Drupal Leaflet: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Leaflet…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-107264: Drupal Inline Formatter Field: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Inline Formatter Field…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-107263: Drupal Gutenberg: Incorrect Authorization vulnerability in Drupal Gutenberg allows Forceful Browsing5.4 MediumN/AN/AOct 30, 2026
CVE-2026-107262: Drupal Advanced Filesystem: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Advanced Filesystem allows Cross Site Request Forgery5.3 MediumN/AN/AOct 30, 2026
CVE-2026-107261: Drupal Authenticator Login Plus (2FA): Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows…4.2 MediumN/AN/AOct 30, 2026
CVE-2026-107260: Drupal Sector Distribution: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Sector…N/AN/AN/AOct 30, 2026
CVE-2026-107259: Drupal Linked Field: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal Linked Field allows Code…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-107258: Drupal Inline Entity Form Dialog: Incorrect Authorization vulnerability in Drupal Inline Entity Form Dialog allows Forceful Browsing5.4 MediumN/AN/AOct 30, 2026
CVE-2026-107257: Drupal Actstream: Incorrect Authorization vulnerability in Drupal Actstream allows Forceful Browsing6.5 MediumN/AN/AOct 30, 2026
CVE-2026-107256: Drupal Shield: Improper Restriction of Excessive Authentication Attempts vulnerability in Drupal Shield allows Brute ForceN/AN/AN/AOct 30, 2026
CVE-2026-107255: Drupal Restrict route by IP: Incorrect Authorization vulnerability in Drupal Restrict route by IP allows Forceful BrowsingN/AN/AN/AOct 30, 2026
CVE-2026-107254: Drupal Authenticator Login Plus (2FA): Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Authenticator Login Plus (2FA) allows…4.8 MediumN/AN/AOct 30, 2026
CVE-2026-107253: Drupal Orphans Media: Vulnerability in Drupal Orphans Media5.9 MediumN/AN/AOct 30, 2026
CVE-2026-107252: Drupal MathJax: LaTeX for Drupal: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal MathJax:…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-107251: Drupal Entity Reference Manager (Merge entities): Incorrect Authorization vulnerability in Drupal Entity Reference Manager (Merge entities) allows Forceful Browsing6.5 MediumN/AN/AOct 30, 2026
CVE-2026-107250: Drupal ECA Helper: Vulnerability in Drupal ECA Helper5.9 MediumN/AN/AOct 30, 2026
CVE-2026-107249: Drupal Block AJAX: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Block AJAX…9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-91920: Red Hat: A flaw was found in the ChunkReader component of the Undertow web server, which is used to handle chunked transfer…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-74915: Imagination Technologies Graphics DDK: A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger a OOB read and/or…N/AN/AN/AOct 30, 2026
CVE-2026-74912: Imagination Technologies Graphics DDK: On GPU systems with the security vulnerability fix for CVE-2026-49746 applied, the mapping range of graphics buffers is…N/AN/AN/AOct 30, 2026
CVE-2026-65587: Imagination Technologies Graphics DDK: A web page that contains unusual WebGPU content loaded into the GPU GLES render process can trigger an OOB write in the…N/AN/AN/AOct 30, 2026
CVE-2026-65586: Imagination Technologies Graphics DDK: Software installed and run as a non-privileged user may conduct improper GPU system calls to free memory in still in…N/AN/AN/AOct 30, 2026
CVE-2026-65584: Imagination Technologies Graphics DDK: Software installed and run as a non-privileged user may conduct improper GPU system calls causing a stack overflow in…N/AN/AN/AOct 30, 2026
601-625 of 418318