The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114102: cthackers adm-zip: adm-zip before 0.6.1 contains a denial of service vulnerability that allows unauthenticated attackers to crash the…7.5 High8.7 HighN/AOct 21, 2026
CVE-2026-114101: corazawaf coraza: Coraza before 3.8.1 extracts multipart upload filenames with Go's mime.ParseMediaType, which silently ignores RFC 5987…4.0 Medium6.3 MediumN/AOct 21, 2026
CVE-2026-114100: corazawaf coraza: Coraza from 3.0.4 before 3.8.1 contains a request body inspection bypass because request-body processor selection…5.8 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114099: corazawaf coraza: Coraza from 3.0.0 before 3.8.1 has a JSON body processor that flattens nested properties into dot-separated ARGS_POST…5.8 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114098: jelmer dulwich: Dulwich from 0.22.5 before 1.2.8 contains a path traversal vulnerability in stash.py pop() that allows attackers to…7.8 High7.3 HighN/AOct 21, 2026
CVE-2026-114097: jelmer dulwich: Dulwich from 0.23.1 before 1.2.8 contains a path traversal vulnerability in CommitFilter._apply_index_filter() that…7.8 High7.3 HighN/AOct 21, 2026
CVE-2026-114096: jelmer dulwich: Dulwich from 0.24.0 before 1.2.8 contains a symlink following vulnerability in porcelain.checkout(paths=[...]) that…7.8 High7.3 HighN/AOct 21, 2026
CVE-2026-114095: jelmer dulwich: Dulwich before 1.2.9 contains a denial of service vulnerability in Pack.resolve_object that allows attackers to cause…6.5 Medium7.1 HighN/AOct 21, 2026
CVE-2026-114094: jelmer dulwich: Dulwich before 1.2.9 fails to validate DOS drive letter prefixes in Git tree path elements on Windows, allowing…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114093: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains a cross-site request forgery vulnerability that allows remote attackers to log out…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114092: triggerdotdev trigger.dev: Trigger.dev before 4.5.0 performs no authentication or organization check in the action handler of the dashboard run…6.5 Medium8.3 HighN/AOct 21, 2026
CVE-2026-114091: triggerdotdev trigger.dev: Trigger.dev before 4.5.0 looks up runs by friendlyId alone in the api.v1.runs.$runParam.replay route without scoping…5.3 Medium6.0 MediumN/AOct 21, 2026
CVE-2026-114090: trigger.dev cli-v3: Trigger.dev cli-v3 from 3.0.0 before 4.5.4 contains a missing authentication vulnerability in the trigger dev --mcp…7.1 High7.6 HighN/AOct 21, 2026
CVE-2026-114089: triggerdotdev trigger.dev: Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114088: triggerdotdev trigger.dev: Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that…6.5 Medium8.3 HighN/AOct 21, 2026
CVE-2026-114087: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 self-hosted Docker Compose deployments using the default secrets from…8.1 High9.2 CriticalN/AOct 21, 2026
CVE-2026-114086: triggerdotdev trigger.dev: Trigger.dev before 4.5.5 contains a missing authentication vulnerability in the realtime streams POST handler that…5.3 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114085: triggerdotdev trigger.dev: Trigger.dev through 4.7.6 contains a missing authentication vulnerability in the supervisor workload server that allows…7.9 High8.8 HighN/AOct 21, 2026
CVE-2026-114084: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the /realtime/v1/runs endpoint, which concatenates…7.7 High8.3 HighN/AOct 21, 2026
CVE-2026-114083: triggerdotdev trigger.dev: Trigger.dev before 4.5.0-rc.3 contains a path traversal vulnerability in the api/v1/packets and api/v2/packets…8.1 High8.6 HighN/AOct 21, 2026
CVE-2026-114082: triggerdotdev trigger.dev: Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write…8.1 High7.2 HighN/AOct 21, 2026
CVE-2026-114081: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an SQL injection vulnerability in the TSQL query compiler, which concatenates…7.7 High8.3 HighN/AOct 21, 2026
CVE-2026-114080: triggerdotdev trigger.dev: Trigger.dev before 4.5.2 contains a blind server-side request forgery vulnerability that allows authenticated project…5.0 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114079: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust…5.4 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114078: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and…8.1 High7.2 HighN/AOct 21, 2026
76-100 of 414767
‹›