The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-119504: DynamiApps Frontend Admin by DynamiApps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps…7.1 HighN/AN/ANov 9, 2026
CVE-2026-119503: Welcart Welcart e-Commerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-119497: wpWax Directorist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-119483: 10Web Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker…7.1 HighN/AN/ANov 9, 2026
CVE-2026-113508: Apache Software Foundation Apache Airflow: Apache Airflow's logout endpoint attempted to revoke the presented token on the server, but any failure during…N/AN/AN/ANov 9, 2026
CVE-2026-113504: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker stopped descending into nested structures after five levels, so a secret registered…N/AN/AN/ANov 9, 2026
CVE-2026-111455: Apache Software Foundation Apache Airflow: Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission…N/AN/AN/ANov 9, 2026
CVE-2026-111454: Apache Software Foundation Apache Airflow: Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset…N/AN/AN/ANov 9, 2026
CVE-2026-111453: Apache Software Foundation Apache Airflow: Apache Airflow's API endpoint for deleting an asset's queued events checked Dag edit permission against the `dag_id`…N/AN/AN/ANov 9, 2026
CVE-2026-111452: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under…N/AN/AN/ANov 9, 2026
CVE-2026-111421: Apache Software Foundation Apache Airflow: Apache Airflow's Task Execution API stored XCom values written by a task without the reserved-key check applied…N/AN/AN/ANov 9, 2026
CVE-2026-111403: WP Inventory WP Inventory Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP…7.1 HighN/AN/ANov 9, 2026
CVE-2026-111395: Apache Software Foundation Apache Airflow: Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`N/AN/AN/ANov 9, 2026
CVE-2026-107474: Apache Software Foundation Apache Airflow: The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed…N/AN/AN/ANov 9, 2026
CVE-2026-101031: Apache Software Foundation Apache Airflow: The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with…N/AN/AN/ANov 9, 2026
CVE-2026-76185: Apache Software Foundation Apache Airflow Task SDK: Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters,…N/AN/AN/ANov 9, 2026
CVE-2026-94249: TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk: Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Liderahenk allows…8.1 HighN/AN/ANov 9, 2026
CVE-2026-92606: TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer: Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research…6.0 MediumN/AN/ANov 9, 2026
CVE-2026-124585: Chengdu Feiyuxing Technology: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r117759.9 Critical8.6 HighN/ANov 9, 2026
CVE-2026-124582: n/a WebTorrent: A vulnerability was identified in WebTorrent up to 2.8.5/3.0.214.3 Medium2.1 LowN/ANov 9, 2026
CVE-2026-124581: itsourcecode Airline Reservation System: A vulnerability was determined in itsourcecode Airline Reservation System 1.07.3 High5.5 MediumN/ANov 9, 2026
CVE-2026-123870: Eclipse Foundation otterdog: The otterdog webapp evaluates a format-string built from the incoming GitHub webhook JSON body using Python's eval()N/A9.5 CriticalN/ANov 9, 2026
CVE-2026-116337: qt Qt Framework: Uncontrolled resource consumption vulnerability in the Qt Framework HTTP response handling functionality of the Qt…N/A0.6 LowN/ANov 9, 2026
CVE-2026-124584: wummel patool: A vulnerability has been found in wummel patool 4.1.04.4 Medium4.8 MediumN/ANov 9, 2026
CVE-2026-124578: Pantum BP5100DW: A security vulnerability has been detected in Pantum BP5100DW 3.A.4.75.3 Medium6.9 MediumN/ANov 9, 2026
101-125 of 418829
‹›