The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-109189: Server-Side Request Forgery (SSRF)6.3 Medium2.1 Low0%Oct 13, 2026
CVE-2026-109160: URL Redirection to Untrusted Site4.3 Medium2.1 Low0%Oct 13, 2026
CVE-2026-78557: Siemens Industrial Edge App Publisher: A vulnerability has been identified in Industrial Edge App Publisher (All versions < V1.27.9)8.3 High7.7 High0%Oct 13, 2026
CVE-2026-63357: Siemens: Affected devices do not properly sanitize calculated signal data contained in imported calculated signal files before…6.1 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-63356: Siemens: Affected devices do not properly sanitize calculated signal names contained in imported CSV trace files before…6.1 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-63355: Siemens: Affected devices do not properly sanitize signal names contained in imported CSV trace files before rendering them in…6.1 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-63354: Siemens: Affected devices do not properly validate and sanitize visual marker data contained in imported CSV trace files before…9.6 Critical9.4 Critical0%Oct 13, 2026
CVE-2026-63353: Siemens: Affected devices do not properly sanitize comment fields contained in imported trace files before rendering them on the…9.6 Critical9.4 Critical0%Oct 13, 2026
CVE-2026-63352: Siemens: Affected devices do not properly sanitize calculated signal data contained in imported CSV trace files before rendering…6.1 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-63351: Siemens: Affected devices do not properly validate and sanitize visual properties of calculated signals contained in imported…6.1 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-63350: Siemens: Affected devices do not properly restrict executable content contained in imported trace files9.6 Critical9.4 Critical0%Oct 13, 2026
CVE-2026-96535: Cross-site Scripting (XSS)N/A5.1 Medium0%Oct 13, 2026
CVE-2026-103418: Improper Neutralization of Input During Web Page Generation8.8 HighN/A0%Oct 13, 2026
CVE-2026-89269: Unknown WP Testimonials: The WP Testimonials WordPress plugin through 1.4.13 does not properly escape testimonial content and reverses…6.8 MediumN/A0%Oct 13, 2026
CVE-2026-92883: GitLab: GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and…8.7 HighN/A0%Oct 13, 2026
CVE-2026-89108: SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service): SAP Manufacturing Integration and Intelligence does not sufficiently enforce authorization boundaries within certain…9.1 CriticalN/A0%Oct 13, 2026
CVE-2026-75076: IBM Aspera Enterprise WebApps: IBM Aspera Enterprise WebApps 1.0.0 through 1.0.6 could allow a remote attacker to obtain sensitive information due to…4.3 MediumN/A0%Oct 12, 2026
CVE-2026-75063: IBM Planning Analytics: IBM Planning Analytics 2.0, and 2.1 could allow a remote authenticated attacker to execute arbitrary JavaScript due to…5.4 MediumN/A0%Oct 12, 2026
CVE-2026-18541: Improper Neutralization of Input During Web Page Generation5.4 MediumN/A0%Oct 12, 2026
CVE-2026-109595: Improper Limitation of a Pathname to a Restricted Directory5.5 Medium6.7 Medium0%Oct 12, 2026
CVE-2025-71432: Improper Neutralization of Input During Web Page Generation8.1 High8.6 High0%Oct 12, 2026
CVE-2025-71430: Improper Neutralization of Input During Web Page Generation5.4 Medium5.1 Medium0%Oct 12, 2026
CVE-2026-84319: 0xJacky nginx-ui: Nginx UI is a web user interface for the Nginx web server8.3 HighN/A0%Oct 12, 2026
CVE-2026-109565: Improper Neutralization of Input During Web Page Generation6.1 Medium5.3 Medium0%Oct 12, 2026
CVE-2026-104774: Encoding Error5.8 MediumN/A0%Oct 12, 2026
126-150 of 16381
‹›