The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-96384: Drupal Mermaid Diagram Field: Incorrect Authorization vulnerability in Drupal Mermaid Diagram Field allows Forceful Browsing3.5 LowN/A0%Oct 22, 2026
CVE-2026-96382: Drupal Diba carousel slider: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Diba…4.6 MediumN/A0%Oct 22, 2026
CVE-2026-96380: Drupal CSS Usage Analyzer: Missing Authorization vulnerability in Drupal CSS Usage Analyzer allows Forceful Browsing6.5 MediumN/A0%Oct 22, 2026
CVE-2026-96379: Drupal CookieCuttr: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal…N/AN/A0%Oct 22, 2026
CVE-2026-96378: Drupal Commerce Decoupled Checkout: Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Drupal Commerce…4.3 MediumN/A0%Oct 22, 2026
CVE-2026-96377: Drupal Combined image style: Allocation of Resources Without Limits or Throttling vulnerability in Drupal Combined image style allows Excessive…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-96376: Drupal Cloud: Improper Neutralization of Special Elements used in an OS Command ("OS Command Injection") vulnerability in Drupal…6.4 MediumN/A1%Oct 22, 2026
CVE-2026-96375: Drupal Cloud: Improper Certificate Validation vulnerability in Drupal Cloud allows Adversary in the Middle (AiTM)4.8 MediumN/A0%Oct 22, 2026
CVE-2026-96374: Drupal Project Browser: Cross-Site Request Forgery (CSRF) vulnerability in Drupal Project Browser allows Cross Site Request Forgery4.2 MediumN/A0%Oct 22, 2026
CVE-2026-96373: Drupal Webform: Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing3.3 LowN/A0%Oct 22, 2026
CVE-2026-96372: Drupal Webform: Insufficient Granularity of Access Control vulnerability in Drupal Webform allows Forceful Browsing5.4 MediumN/A0%Oct 22, 2026
CVE-2026-96371: Drupal Webform: Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS5.4 MediumN/A0%Oct 22, 2026
CVE-2026-96370: Drupal Webform: Incorrect Authorization vulnerability in Drupal Webform allows Server Side Request Forgery5.4 MediumN/A0%Oct 22, 2026
CVE-2026-96369: Drupal Webform: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Webform allows Exploiting Incorrectly…3.1 LowN/A0%Oct 22, 2026
CVE-2026-96368: Drupal Webform: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform…4.6 MediumN/A0%Oct 22, 2026
CVE-2026-96367: Drupal Webform: Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS4.6 MediumN/A0%Oct 22, 2026
CVE-2026-96366: Drupal Webform: Incorrect Authorization vulnerability in Drupal Webform allows Forceful Browsing5.3 MediumN/A0%Oct 22, 2026
CVE-2026-96365: Drupal Webform: Allocation of Resources Without Limits or Throttling vulnerability in Drupal Webform allows Excessive Allocation7.5 HighN/A0%Oct 22, 2026
CVE-2026-96364: Drupal Webform: Improper Control of Interaction Frequency vulnerability in Drupal Webform allows Functionality Misuse5.3 MediumN/A0%Oct 22, 2026
CVE-2026-96363: Drupal Webform: Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSSN/AN/A0%Oct 22, 2026
CVE-2026-96362: Drupal Webform: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform…4.2 MediumN/A0%Oct 22, 2026
CVE-2026-96361: Drupal Webform: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform…4.6 MediumN/A0%Oct 22, 2026
CVE-2026-96360: Drupal Webform: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform…3.5 LowN/A0%Oct 22, 2026
CVE-2026-96359: Drupal Webform: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform…4.6 MediumN/A0%Oct 22, 2026
CVE-2026-96358: Drupal Webform: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Webform…4.6 MediumN/A0%Oct 22, 2026
851-875 of 413321
‹›