The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-97631: TianoCore EDK2: EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”, Classic Buffer Overflow, and…N/A9.5 Critical0%Oct 22, 2026
CVE-2026-75508: graphql-python graphql-core: GraphQL-core is a Python port of the GraphQL.js reference implementation7.5 HighN/A1%Oct 22, 2026
CVE-2026-75507: graphql-python graphql-core: GraphQL-core is a Python port of the GraphQL.js reference implementation7.5 HighN/A1%Oct 22, 2026
CVE-2026-67597: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 22, 2026
CVE-2026-115513: OpenCATS: OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated…8.7 High6.3 Medium0%Oct 22, 2026
CVE-2026-115502: KNIME KNIME Business Hub: A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and…N/A6.3 Medium0%Oct 22, 2026
CVE-2026-115416: AWS Amazon Athena: Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated…7.7 High6.3 Medium0%Oct 22, 2026
CVE-2026-114608: pylint-dev pylint: Pylint is a static code analyser for PythonN/A5.4 Medium0%Oct 22, 2026
CVE-2026-114607: better-auth: Better Auth is an authentication and authorization library for TypeScript9.1 CriticalN/A0%Oct 22, 2026
CVE-2026-114606: jgraph drawio-desktop: draw.io Desktop is the official Electron build of draw.ioN/A5.6 Medium0%Oct 22, 2026
CVE-2026-114605: rthalley dnspython: dnspython is a DNS toolkit for Python7.5 HighN/A0%Oct 22, 2026
CVE-2026-104068: JetBackup: JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows…7.2 High8.6 High1%Oct 22, 2026
CVE-2026-94482: vercel next.js: Next.js is a React framework for building full-stack web applicationsN/A8.2 High0%Oct 22, 2026
CVE-2026-51954: n/a: An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth…N/AN/A1%Oct 22, 2026
CVE-2026-115496: KNIME KNIME Business Hub: Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow…N/A6.9 Medium0%Oct 22, 2026
CVE-2026-115494: KNIME KNIME Business Hub: A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an…N/A5.3 Medium0%Oct 22, 2026
CVE-2026-115482: litespeedtech lsquic: In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered…7.5 HighN/A0%Oct 22, 2026
CVE-2026-115454: KNIME KNIME Business Hub: An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to…N/A5.3 Medium0%Oct 22, 2026
CVE-2026-115453: MarcosCamara01 Ecommerce Template: Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01…N/A7.1 High0%Oct 22, 2026
CVE-2026-115450: MarcosCamara01 Ecommerce Template: External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce…N/A7.1 High0%Oct 22, 2026
CVE-2026-114603: open-telemetry opentelemetry-python: OpenTelemetry Python provides the Python API and SDK for OpenTelemetry5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114487: Devolutions Server: Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and…N/AN/A0%Oct 22, 2026
CVE-2026-114486: Devolutions Server: Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier…N/AN/A0%Oct 22, 2026
CVE-2026-114485: Devolutions Server: Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and…N/AN/A0%Oct 22, 2026
CVE-2026-78846: n/a: AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing.N/AN/A0%Oct 22, 2026
776-800 of 530113
‹›