The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114406: Red Hat: The system certificate authority (CA) store in Red Hat products, distributed via ca-certificates RPM packages, included…6.8 MediumN/A0%Oct 21, 2026
CVE-2026-96643: python-pillow Pillow: Pillow is a Python imaging libraryN/A7.1 High0%Oct 21, 2026
CVE-2026-114378: itsourcecode Online Cake Ordering System: A vulnerability was detected in itsourcecode Online Cake Ordering System 1.06.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-114141: BinaryMuse toml-node: toml-node is a TOML parser for Node.js and the browserN/A8.7 High0%Oct 21, 2026
CVE-2026-85518: Red Hat: A flaw was found in OpenSCAP6.1 MediumN/A0%Oct 21, 2026
CVE-2026-114438: Red Hat: A flaw was found in the Update User Locale required action of the Keycloak identity and access management solution4.2 MediumN/A0%Oct 21, 2026
CVE-2026-114376: leomoon-studios wiki-go: A weakness has been identified in leomoon-studios wiki-go up to 1.9.16.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-114374: leomoon-studios wiki-go: A vulnerability was identified in leomoon-studios wiki-go up to 1.9.14.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-114362: n/a HarnessRouter: A flaw has been found in HarnessRouter up to 0.31.126.3 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-114136: encode django-rest-framework: Django REST framework is a toolkit for building Web APIs7.5 HighN/A0%Oct 21, 2026
CVE-2026-114135: jupyter-server jupyter_server: Jupyter Server is the backend for Jupyter web applications8.8 HighN/A0%Oct 21, 2026
CVE-2026-112408: AWS Amazon SageMaker Python SDK: Missing verification of source of a communication channel in the default_bucket() function in Amazon SageMaker Python…8.1 High9.4 Critical1%Oct 21, 2026
CVE-2026-111815: Apache Software Foundation Apache Traffic Server: Apache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate…10.0 Critical7.8 High0%Oct 21, 2026
CVE-2026-111814: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one…10.0 Critical7.8 High0%Oct 21, 2026
CVE-2026-111812: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers…10.0 Critical7.0 High0%Oct 21, 2026
CVE-2026-111811: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the…9.0 Critical9.4 Critical0%Oct 21, 2026
CVE-2026-111809: Apache Software Foundation Apache Traffic Server: Apache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding9.3 Critical6.9 Medium0%Oct 21, 2026
CVE-2026-114375: leomoon-studios wiki-go: A security flaw has been discovered in leomoon-studios wiki-go up to 1.9.16.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-112381: Apache Software Foundation Apache Traffic Server: Apache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close…5.9 Medium8.2 High0%Oct 21, 2026
CVE-2026-111817: Apache Software Foundation Apache Traffic Server: Apache Traffic Server can stall a chunked transfer that it passes through with its trailers removed…5.3 Medium6.9 Medium0%Oct 21, 2026
CVE-2026-79976: zephyrproject zephyr: The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctp_i2c_gpio_target.c emulates a small pseudo-register file,…7.1 HighN/A0%Oct 21, 2026
CVE-2026-78119: zephyrproject zephyr: The Nuvoton NPCX eSPI driver parses Target-Attached-Flash (TAF) requests in espi_taf_parse()…6.3 MediumN/A0%Oct 21, 2026
CVE-2026-78118: zephyrproject zephyr: The kernel helper z_waitq_head() (kernel/include/wait_q.h) reads the head of a thread wait queue, but on SMP systems it…7.0 HighN/A0%Oct 21, 2026
CVE-2026-78117: zephyrproject zephyr: The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hci_infineon_psoc6_bless.c stored the outgoing HCI packet…4.2 MediumN/A0%Oct 21, 2026
CVE-2026-78116: zephyrproject zephyr: The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails5.2 MediumN/A0%Oct 21, 2026
1051-1075 of 413321
‹›