The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-113355: chatwoot: Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to…4.8 Medium4.8 Medium0%Oct 20, 2026
CVE-2026-113350: marmelab react-admin: react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts…5.4 Medium5.1 Medium0%Oct 20, 2026
CVE-2026-11959: FacturaScripts: Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or…N/A6.9 Medium0%Oct 20, 2026
CVE-2026-112148: LY Corporation LIFF SDK: A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting…N/A5.1 Medium0%Oct 20, 2026
Red Hat: CVE-2026-110725: fast-uri: fast-uri: Cross-site scripting via unescaped colon in relative URI paths3.7 LowN/A0%Oct 20, 2026
Red Hat: CVE-2026-110306: fast-uri: fast-uri: Cross-Site Scripting via improper URI scheme decoding6.1 MediumN/A0%Oct 20, 2026
CVE-2026-4413: Improper Neutralization of Input During Web Page Generation6.1 MediumN/A0%Oct 19, 2026
CVE-2026-3295: Improper Neutralization of Input During Web Page Generation7.4 HighN/A0%Oct 19, 2026
CVE-2026-111757: Double Decoding of the Same Data5.3 MediumN/A0%Oct 19, 2026
CVE-2023-38375: Improper Neutralization of Input During Web Page Generation6.1 MediumN/A0%Oct 19, 2026
CVE-2025-6623: Improper Neutralization of Input During Web Page Generation4.3 MediumN/A0%Oct 19, 2026
CVE-2026-112290: Improper Neutralization of Input During Web Page Generation4.7 Medium2.3 Low0%Oct 19, 2026
CVE-2026-112184: Improper Neutralization of Input During Web Page GenerationN/A4.8 Medium0%Oct 19, 2026
CVE-2026-106933: Improper Neutralization of Input During Web Page Generation6.8 MediumN/A0%Oct 19, 2026
CVE-2026-112111: Improper Neutralization of Input During Web Page GenerationN/A5.1 Medium0%Oct 18, 2026
CVE-2026-110981: Improper Neutralization of Input During Web Page Generation7.1 HighN/A0%Oct 18, 2026
CVE-2026-111903: Improper Neutralization of Input During Web Page Generation5.4 Medium5.1 Medium0%Oct 17, 2026
CVE-2026-111894: Improper Neutralization of Input During Web Page Generation5.4 Medium5.1 Medium0%Oct 17, 2026
CVE-2026-111713: Improper Neutralization of Input During Web Page Generation5.4 Medium5.1 Medium0%Oct 16, 2026
CVE-2026-110590: Missing Authorization7.5 HighN/A0%Oct 16, 2026
CVE-2026-109990: Improper Neutralization of Input During Web Page Generation7.2 HighN/A0%Oct 16, 2026
CVE-2026-111284: Improper Neutralization of Input During Web Page Generation5.4 Medium5.1 Medium0%Oct 15, 2026
CVE-2026-63430: Improper Neutralization of Input During Web Page GenerationN/A6.3 Medium1%Oct 15, 2026
CVE-2026-55240: Improper Neutralization of Special Elements Used in a Template Engine9.1 CriticalN/A1%Oct 15, 2026
CVE-2026-110878: Improper Neutralization of Input During Web Page Generation5.4 Medium5.1 Medium0%Oct 15, 2026
126-150 of 10652