The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-9869: Totolink: A stack-based buffer overflow vulnerability exists in the boa formTR069Config functionality of X2000R (version(s):…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-9827: Totolink: A arbitrary file write vulnerability exists in the boa formUploadFile functionality of X2000R (version(s):…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-9817: Totolink: A stack-based buffer overflow vulnerability exists in the boa formUploadFile functionality of X2000R (version(s):…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-9814: Totolink: An OS command injection vulnerability exists in the boa formWizard newPass functionality of X2000R (version(s):…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-9660: Totolink: Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-9659: Totolink: Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formFilter functionality of X2000R…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-94266: curl: libcurl could accidentally return a URL for `curl_easy_getinfo()`'s `CURLINFO_EFFECTIVE_URL` option containing…N/AN/AN/AOct 20, 2026
CVE-2026-94265: curl: When processing an HTTP redirect to a URL containing userinfo (a `username:password` component), curl might erroneously…N/AN/AN/AOct 20, 2026
CVE-2026-92391: curl: A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during…N/AN/AN/AOct 20, 2026
CVE-2026-92390: curl: When invoked with `--remote-header-name` (`-J`), curl fails to preserve its documented anti-clobbering protection if an…N/AN/AN/AOct 20, 2026
CVE-2026-92389: curl: libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting…N/AN/AN/AOct 20, 2026
CVE-2026-92388: curl: When an FTP wildcard `LIST` operation fails, libcurl omits the restoration path meant for successful listings, leaving…N/AN/AN/AOct 20, 2026
CVE-2026-92387: curl: By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit…N/AN/AN/AOct 20, 2026
CVE-2026-92386: curl: When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make `curl` write a record…N/AN/AN/AOct 20, 2026
CVE-2026-87866: curl: When built with wolfSSL, curl can successfully validate a pinned public key hash against a key the TLS peer does not…N/AN/AN/AOct 20, 2026
CVE-2026-87865: curl: When libcurl uses libssh2 with a hashed `known_hosts` file, an unrelated initial entry can cause host key validation to…N/AN/AN/AOct 20, 2026
CVE-2026-87864: curl: Enabling `CURLOPT_CRLF` causes curl to advertise the raw input byte count in the `IMAP APPEND {N}` literal while…N/AN/AN/AOct 20, 2026
CVE-2026-87863: curl: An authenticated HTTPS origin can supply an HSTS `max-age` value that the parser accepts, but time serialization later…N/AN/AN/AOct 20, 2026
CVE-2026-87862: curl: Importing a `includeSubDomains` parent HSTS entry before a longer-lived child entry, silently drops the childN/AN/AN/AOct 20, 2026
CVE-2026-87861: curl: When using ambient user credentials, an HTTP request directed to one origin may be dispatched over a connection…N/AN/AN/AOct 20, 2026
CVE-2026-86415: curl: libcurl's connection cache match function never considers the automatic client certificate option, so a cached, already…N/AN/AN/AOct 20, 2026
CVE-2026-86414: curl: An HTTP proxy can trick libcurl into sending the origin's credentials (Basic password, or a Negotiate/Kerberos ticket)…N/AN/AN/AOct 20, 2026
CVE-2026-42026: Totolink: Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-42025: Totolink: Multiple exploitable stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup dhcp_dns functionality…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-42024: Totolink: Multiple stack-based buffer overflow vulnerabilities exist in the boa formIpv6Setup static network configuration…9.1 CriticalN/AN/AOct 20, 2026
1326-1350 of 407346
‹›