The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-87951: Drupal SAML SSO - Service Provider: Insecure Storage of Sensitive Information vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded…3.8 LowN/A0%Oct 22, 2026
CVE-2026-87950: Drupal SAML SSO - Service Provider: Use of Hard-coded Credentials vulnerability in Drupal SAML SSO - Service Provider allows Retrieve Embedded Sensitive…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-87949: Drupal SAML SSO - Service Provider: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -…3.3 LowN/A0%Oct 22, 2026
CVE-2026-87948: Drupal SAML SSO - Service Provider: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -…3.5 LowN/A0%Oct 22, 2026
CVE-2026-87947: Drupal SAML SSO - Service Provider: Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature…4.8 MediumN/A0%Oct 22, 2026
CVE-2026-87946: Drupal SAML SSO - Service Provider: Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force4.8 MediumN/A0%Oct 22, 2026
CVE-2026-87945: Drupal SAML SSO - Service Provider: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-87944: Drupal SAML SSO - Service Provider: Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle…4.8 MediumN/A0%Oct 22, 2026
CVE-2026-87943: Drupal SAML SSO - Service Provider: Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing6.5 MediumN/A0%Oct 22, 2026
CVE-2026-87941: Drupal Patreon: Vulnerability in Drupal PatreonN/AN/A0%Oct 22, 2026
CVE-2026-87938: Drupal CSP log: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log…N/AN/A0%Oct 22, 2026
CVE-2026-84913: Drupal AI Translate: Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing4.6 MediumN/A0%Oct 22, 2026
CVE-2026-84912: Drupal AI (Artificial Intelligence): Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing4.6 MediumN/A0%Oct 22, 2026
CVE-2026-84911: Drupal AI (Artificial Intelligence): Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal AI…3.1 LowN/A0%Oct 22, 2026
CVE-2026-84910: Drupal Advanced Search: Missing Authorization vulnerability in Drupal Advanced Search allows Forceful Browsing4.2 MediumN/A0%Oct 22, 2026
CVE-2026-114728: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a remote content blocking bypass in the handling…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114727: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 passes potentially unsafe content into ImageMagick when resizing…8.3 HighN/A0%Oct 22, 2026
CVE-2026-114726: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability in the…5.8 MediumN/A0%Oct 22, 2026
CVE-2026-114725: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability5.0 MediumN/A0%Oct 22, 2026
CVE-2026-114724: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 contains an object injection primitive in…7.4 HighN/A0%Oct 22, 2026
CVE-2026-114723: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the ImageMagick resource limits to be bypassed during…3.7 LowN/A0%Oct 22, 2026
CVE-2026-114722: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSS scoping bypass in HTML messages6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114721: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 allows the disabled_actions configuration setting to be bypassed3.1 LowN/A0%Oct 22, 2026
CVE-2026-114720: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an IMAP command injection vulnerability7.1 HighN/A1%Oct 22, 2026
CVE-2026-114719: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk…3.7 LowN/A0%Oct 22, 2026
826-850 of 545063
‹›