The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2020-37287: vyperlang vyper: Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex…5.9 Medium8.2 High0%Oct 21, 2026
CVE-2020-37286: vyperlang vyper: Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer…6.5 Medium8.3 High0%Oct 21, 2026
CVE-2026-114082: triggerdotdev trigger.dev: Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write…8.1 High7.2 High0%Oct 21, 2026
CVE-2026-114077: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that…7.1 High6.1 Medium0%Oct 21, 2026
CVE-2026-114067: triggerdotdev trigger.dev: Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session…6.5 Medium7.1 High0%Oct 21, 2026
CVE-2026-114062: sveltejs kit: SvelteKit before 3.0.0 contains a server-side request forgery vulnerability that allows remote attackers to reach…5.3 Medium6.9 Medium0%Oct 21, 2026
CVE-2026-114057: ArcadeData arcadedb: ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that…4.3 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-114052: vllm-project vllm: vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches…7.5 High8.7 High0%Oct 21, 2026
CVE-2026-114047: FreeRDP: FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts…6.8 Medium7.6 High0%Oct 21, 2026
CVE-2026-114042: FreeRDP: FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the…6.5 Medium7.1 High0%Oct 21, 2026
CVE-2026-113735: D-Link DCS-6501LH: A vulnerability was determined in D-Link DCS-6501LH 3.03.023.7 Low2.9 Low1%Oct 21, 2026
CVE-2026-113707: a2aproject a2a-rs: A security flaw has been discovered in a2aproject a2a-rs up to 0.4.45.4 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-113706: a2aproject a2a-rs: A vulnerability was identified in a2aproject a2a-rs up to 0.4.33.5 Low5.1 Medium0%Oct 21, 2026
CVE-2026-109682: Rapid7 Metasploit Framework: Metasploit Framework versions before 6.5.7 allow HTTP requests made through send_request_cgi! to follow redirects to a…4.7 MediumN/A0%Oct 21, 2026
CVE-2026-109681: Rapid7 Metasploit Framework: The FTP client trusts the server's PASV response IP:port without validation against the control connection target4.7 MediumN/A0%Oct 21, 2026
CVE-2025-60479: n/a: A NULL pointer dereference in the StatSFVec2f function (/scene_manager/scene_stats.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2025-71438: n/a: An out-of-bounds read in gf_odf_ac4_cfg_dsi_v1 (/odf/descriptors.c) in GPAC Project/MP4Box before v26.07.0 allows…N/AN/A0%Oct 21, 2026
CVE-2025-60478: n/a: A use-after-free in the gf_filter_packet_destroy function (/filter_core/filter_pck.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2025-60469: n/a: A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC…N/AN/A0%Oct 21, 2026
CVE-2025-60476: n/a: A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2026-6945: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 20, 2026
CVE-2026-113705: a2aproject a2a-rs: A vulnerability was determined in a2aproject a2a-rs up to 0.4.35.3 Medium6.9 Medium0%Oct 20, 2026
CVE-2026-112202: Out-of-bounds ReadN/AN/A0%Oct 20, 2026
CVE-2026-9825: IBM CyberFraud: IBM Cyber Fraud 1.0.0 through 1.0.2 has a missing secure attribute allowing sensitive cookies to be transmitted over…3.7 LowN/A0%Oct 20, 2026
CVE-2026-94402: IBM: IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting6.1 MediumN/A0%Oct 20, 2026
1001-1025 of 416054
‹›