The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-11854: Improper Neutralization of Input During Web Page Generation6.1 MediumN/A0%Oct 28, 2026
CVE-2026-118655: Double Decoding of the Same Data5.9 MediumN/A0%Oct 28, 2026
CVE-2026-118654: Improper Limitation of a Pathname to a Restricted Directory5.9 MediumN/A0%Oct 28, 2026
CVE-2026-118653: Authentication Bypass by Spoofing5.3 MediumN/A0%Oct 28, 2026
CVE-2026-118652: Improper Neutralization of Input During Web Page Generation6.1 MediumN/A0%Oct 28, 2026
CVE-2026-118651: Origin Validation Error5.3 MediumN/A0%Oct 28, 2026
CVE-2026-118650: Improper Handling of URL Encoding (Hex Encoding)7.5 HighN/A0%Oct 28, 2026
CVE-2026-118266: Cross-Site Request Forgery (CSRF)5.3 MediumN/A0%Oct 28, 2026
CVE-2026-117574: Authorization Bypass Through User-Controlled Key9.1 CriticalN/A0%Oct 28, 2026
CVE-2026-115415: Undefined Security Weakness6.5 Medium5.9 Medium0%Oct 28, 2026
CVE-2026-109411: Improper Handling of Case Sensitivity8.1 HighN/A1%Oct 28, 2026
CVE-2025-14260: Server-Side Request Forgery (SSRF)8.3 HighN/A0%Oct 28, 2026
CVE-2026-118688: UNIX Symbolic Link (Symlink) Following7.9 High8.8 High0%Oct 28, 2026
CVE-2026-118687: Unintended Proxy or Intermediary6.5 Medium8.3 High0%Oct 28, 2026
CVE-2026-118686: Inefficient Regular Expression Complexity7.5 High8.7 High0%Oct 28, 2026
CVE-2026-118685: Incorrect Authorization6.5 Medium6.9 Medium0%Oct 28, 2026
CVE-2026-118684: Use of a Broken or Risky Cryptographic Algorithm5.9 Medium8.2 High0%Oct 28, 2026
CVE-2026-118683: Improper Control of Generation of Code8.8 High8.6 High0%Oct 28, 2026
CVE-2026-118681: Authentication Bypass Using an Alternate Path or Channel3.7 Low6.3 Medium0%Oct 28, 2026
CVE-2026-118680: Improper Limitation of a Pathname to a Restricted Directory4.4 Medium5.9 Medium0%Oct 28, 2026
CVE-2026-118679: Server-Side Request Forgery (SSRF)7.5 High6.9 Medium0%Oct 28, 2026
CVE-2026-118678: Improperly Controlled Modification of Object Prototype Attributes7.1 High7.1 High0%Oct 28, 2026
CVE-2026-118677: Improper Authorization in Handler for Custom URL Scheme5.9 Medium5.9 Medium0%Oct 28, 2026
CVE-2026-118676: Incorrect Authorization7.1 High5.1 Medium0%Oct 28, 2026
CVE-2026-118675: Incorrect Authorization7.1 High5.1 Medium0%Oct 28, 2026
801-825 of 520238