The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114570: WordPress Foundation WordPress: WordPress Core is vulnerable to Stored Cross-Site Scripting via Quick Edit in all versions up to, and including, 7.0.2…4.9 MediumN/A0%Oct 22, 2026
CVE-2026-114223: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability5.5 Medium6.7 Medium0%Oct 22, 2026
CVE-2026-114222: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has an Authentication Bypass vulnerability6.2 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-114221: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has a Credential Disclosure vulnerability7.4 High5.9 Medium0%Oct 22, 2026
CVE-2026-114220: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has an Improper Certificate Validation vulnerability9.1 Critical9.3 Critical0%Oct 22, 2026
CVE-2026-114219: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has a Hard-coded Credentials vulnerability7.4 High9.1 Critical0%Oct 22, 2026
CVE-2026-114732: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an improper authentication vulnerability in…6.8 MediumN/A0%Oct 22, 2026
CVE-2026-114731: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an uncontrolled resource consumption…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114730: Roundcube Webmail: Roundcube Webmail 1.6.14 before 1.6.20 and 1.7.0 before 1.7.5 is affected by a server-side request forgery filter bypass7.2 HighN/A0%Oct 22, 2026
CVE-2026-114729: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass5.3 MediumN/A0%Oct 22, 2026
CVE-2026-110353: HAProxy, Haproxy: HAProxy 3.2 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (worker-thread CPU…7.5 HighN/A1%Oct 22, 2026
CVE-2026-110354: HAProxy, HAProxy Technologies: HAProxy 3 before 3.4.6 allows a remote unauthenticated attacker to cause a denial of service (persistent worker-thread…7.5 HighN/A1%Oct 22, 2026
CVE-2026-96398: Drupal Webform: Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing4.3 MediumN/A0%Oct 22, 2026
CVE-2026-96392: Drupal AI CKEditor: Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Drupal AI CKEditor allows Code…3.5 LowN/A0%Oct 22, 2026
CVE-2026-96391: Drupal Webform REST: Missing Authorization vulnerability in Drupal Webform REST allows Forceful BrowsingN/AN/A0%Oct 22, 2026
CVE-2026-96390: Drupal Editoria11y Accessibility Checker: Privilege Defined With Unsafe Actions vulnerability in Drupal Editoria11y Accessibility Checker allows Privilege…4.3 MediumN/A0%Oct 22, 2026
CVE-2026-96388: Drupal Tawk.to - Live chat application: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Tawk.to - Live chat application allows Cross Site Request…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-96387: Drupal Stop administrator login: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Stop administrator login allows…3.8 LowN/A0%Oct 22, 2026
CVE-2026-96386: Drupal Smart Content: Missing Authorization vulnerability in Drupal Smart Content allows Forceful Browsing6.5 MediumN/A0%Oct 22, 2026
CVE-2026-96385: Drupal REST & JSON API Authentication for Drupal: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal REST & JSON API Authentication for…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-96384: Drupal Mermaid Diagram Field: Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing3.5 LowN/A0%Oct 22, 2026
CVE-2026-96382: Drupal Diba carousel slider: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba…4.6 MediumN/A0%Oct 22, 2026
CVE-2026-96380: Drupal CSS Usage Analyzer: Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing6.5 MediumN/A0%Oct 22, 2026
CVE-2026-96379: Drupal CookieCuttr: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal…N/AN/A0%Oct 22, 2026
CVE-2026-96378: Drupal Commerce Decoupled Checkout: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce…4.3 MediumN/A0%Oct 22, 2026
776-800 of 545063
‹›