The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114052: vllm-project vllm: vLLM after 0.24.0 and before 0.31.0 contains a memory exhaustion vulnerability in MOSS-Audio model serving that caches…7.5 High8.7 HighN/AOct 21, 2026
CVE-2026-114051: vllm-project vllm: vLLM before 0.31.0 skips the min_tokens <= max_tokens check for /inference/v1/generate requests with a null max_tokens,…7.5 High7.1 HighN/AOct 21, 2026
CVE-2026-114050: vllm-project vllm: vLLM before 0.31.0 uses a client-supplied multimodal uuid verbatim as cache identity with no consistency check on cache…7.5 High7.1 HighN/AOct 21, 2026
CVE-2026-114049: vllm-project vllm: vLLM before 0.31.0 contains a cross-request mask leak in InputBatch.condense() that allows remote attackers to…3.7 Low6.3 MediumN/AOct 21, 2026
CVE-2026-114048: WWBN AVideo: WWBN AVideo before 24.0 contains a cross-site request forgery vulnerability in legacy endpoints like playlistStatus.php…3.5 Low5.1 MediumN/AOct 21, 2026
CVE-2026-114047: FreeRDP: FreeRDP from 2.0.0 before 3.32.0 contains an improper certificate validation vulnerability in its proxy that accepts…6.8 Medium7.6 HighN/AOct 21, 2026
CVE-2026-114046: FreeRDP: FreeRDP 3.0.0 before 3.32.0 contains a null-pointer dereference in the smartcard emulation backend that accepts a null…6.5 Medium7.1 HighN/AOct 21, 2026
CVE-2026-114045: FreeRDP: FreeRDP before 3.32.1 contains a heap-based buffer overflow in the server-side rdpsnd channel because an integer…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114044: FreeRDP: FreeRDP before 3.32.1 contains a heap out-of-bounds read vulnerability in the Android client that allows malicious RDP…5.3 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114043: FreeRDP: FreeRDP before 3.32.1 contains a heap-based out-of-bounds read in WinPR's clipboard PNG-to-CF_DIB synthesis because…6.5 Medium7.1 HighN/AOct 21, 2026
CVE-2026-114042: FreeRDP: FreeRDP 3.32.0 contains a use-after-free vulnerability in the drdynvc channel that frees a pool-owned stream with the…6.5 Medium7.1 HighN/AOct 21, 2026
CVE-2026-114041: FreeRDP: FreeRDP before 3.32.1 on Windows contains a heap out-of-bounds read in client_cli_present_gateway_message that passes a…6.5 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114038: Red Hat: A flaw was found in device-mapper-multipath5.1 MediumN/AN/AOct 21, 2026
CVE-2026-113741: itsourcecode Online Cake Ordering System: A vulnerability has been found in itsourcecode Online Cake Ordering System 1.04.3 Medium2.1 LowN/AOct 21, 2026
CVE-2026-113740: itsourcecode Online Cake Ordering System: A flaw has been found in itsourcecode Online Cake Ordering System 1.06.3 Medium2.1 LowN/AOct 21, 2026
CVE-2026-113738: R6410418 Jackrong-llm-finetuning-guide: A vulnerability has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d096.3 Medium2.1 LowN/AOct 21, 2026
CVE-2026-113737: R6410418 Jackrong-llm-finetuning-guide: A flaw has been found in R6410418 Jackrong-llm-finetuning-guide up to ef2b17f2798cd18cd85375080c35a58397ad0d095.5 Medium2.0 LowN/AOct 21, 2026
CVE-2026-113736: D-Link DHP-W610AV: A vulnerability has been found in D-Link DHP-W610AV 1.02EUb039.8 Critical8.9 HighN/AOct 21, 2026
CVE-2026-111943: Go standard library crypto/x509: On most platforms, Go uses the given system root certificatesN/AN/AN/AOct 21, 2026
CVE-2026-105044: Qingteng Host Adaptive Security Platform: Improper Neutralization of Special Elements used in an OS Command in Security Toolbox versions before 20260929 in…N/A8.5 HighN/AOct 21, 2026
CVE-2025-71437: astral-sh uv: Astral uv before 0.8.22 contains a path traversal vulnerability in source distribution (sdist) tar extraction that…6.5 Medium8.7 HighN/AOct 21, 2026
CVE-2021-48020: vyperlang vyper: Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer…6.5 Medium8.3 HighN/AOct 21, 2026
CVE-2021-48019: vyperlang vyper: Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a fixed…4.8 Medium6.3 MediumN/AOct 21, 2026
CVE-2021-48018: vyperlang vyper: Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locations as…7.4 High8.3 HighN/AOct 21, 2026
CVE-2020-37289: vyperlang vyper: Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decimals(), to…3.7 Low6.3 MediumN/AOct 21, 2026
126-150 of 407473
‹›