The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-87949: Drupal SAML SSO - Service Provider: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -…3.3 LowN/A0%Oct 22, 2026
CVE-2026-87948: Drupal SAML SSO - Service Provider: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SAML SSO -…3.5 LowN/A0%Oct 22, 2026
CVE-2026-87947: Drupal SAML SSO - Service Provider: Improper Verification of Cryptographic Signature vulnerability in Drupal SAML SSO - Service Provider allows Signature…4.8 MediumN/A0%Oct 22, 2026
CVE-2026-87946: Drupal SAML SSO - Service Provider: Observable Timing Discrepancy vulnerability in Drupal SAML SSO - Service Provider allows Brute Force4.8 MediumN/A0%Oct 22, 2026
CVE-2026-87945: Drupal SAML SSO - Service Provider: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal SAML SSO - Service Provider allows Fake the…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-87944: Drupal SAML SSO - Service Provider: Improper Certificate Validation vulnerability in Drupal SAML SSO - Service Provider allows Adversary in the Middle…4.8 MediumN/A0%Oct 22, 2026
CVE-2026-87943: Drupal SAML SSO - Service Provider: Missing Authorization vulnerability in Drupal SAML SSO - Service Provider allows Forceful Browsing6.5 MediumN/A0%Oct 22, 2026
CVE-2026-87942: Drupal SafeDelete: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal SafeDelete…4.6 MediumN/A0%Oct 22, 2026
CVE-2026-87941: Drupal Patreon: Vulnerability in Drupal PatreonN/AN/A0%Oct 22, 2026
CVE-2026-87940: Drupal Key auth: Use of Web Browser Cache Containing Sensitive Information vulnerability in Drupal Key auth allows Exploiting…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-87939: Drupal Feed Block: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Feed Block…4.2 MediumN/A0%Oct 22, 2026
CVE-2026-87938: Drupal CSP log: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal CSP log…N/AN/A0%Oct 22, 2026
CVE-2026-87937: Drupal Central Authentication System (CAS) Server: URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Drupal Central Authentication System (CAS) Server…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-87936: Drupal amazee.ai Private AI Provider: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Drupal amazee.ai…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-84924: Drupal Email Verification / SMS Verification / OTP Verification: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Email…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-84923: Drupal Email Verification / SMS Verification / OTP Verification: Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Email Verification / SMS Verification…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-84921: Drupal Webform Submissions Delete: Missing Authorization vulnerability in Drupal Webform Submissions Delete allows Forceful Browsing5.3 MediumN/A0%Oct 22, 2026
CVE-2026-84920: Drupal Unpublished Node Permissions: Incorrect Authorization vulnerability in Drupal Unpublished Node Permissions allows Forceful Browsing5.3 MediumN/A0%Oct 22, 2026
CVE-2026-84919: Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal PhotoSwipe…4.6 MediumN/A0%Oct 22, 2026
CVE-2026-84918: Drupal Monobank payment API: Improper Verification of Cryptographic Signature vulnerability in Drupal Monobank payment API allows Signature Spoof3.7 LowN/A0%Oct 22, 2026
CVE-2026-84917: Drupal Jsonapi Role Access: Incorrect Authorization vulnerability in Drupal Jsonapi Role Access allows Forceful Browsing6.5 MediumN/A0%Oct 22, 2026
CVE-2026-84916: Drupal Islandora: Missing Authorization vulnerability in Drupal Islandora allows Forceful Browsing3.7 LowN/A0%Oct 22, 2026
CVE-2026-84915: Drupal Component blocks: Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting") vulnerability in Drupal Component…4.6 MediumN/A0%Oct 22, 2026
CVE-2026-84914: Drupal Calculate Working Days: Missing Authorization vulnerability in Drupal Calculate Working Days allows Forceful Browsing5.3 MediumN/A0%Oct 22, 2026
CVE-2026-84913: Drupal AI Translate: Missing Authorization vulnerability in Drupal AI Translate allows Forceful Browsing4.6 MediumN/A0%Oct 22, 2026
976-1000 of 530113
‹›