The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113393: DrayTek Vigor2960: A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 82186.3 Medium2.1 LowN/AOct 20, 2026
CVE-2026-96582: Eclipse Foundation Eclipse ThreadX - USBX: A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow4.9 MediumN/AN/AOct 20, 2026
CVE-2026-91041: Eclipse Foundation Eclipse ThreadX - FileX: Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log…7.8 HighN/AN/AOct 20, 2026
CVE-2026-113392: DrayTek Vigor2960: A vulnerability was found in DrayTek Vigor2960 1.5.1.6 Revision 82187.4 High2.1 LowN/AOct 20, 2026
CVE-2026-113399: Mozilla Firefox: Incorrect boundary conditions in the SVG componentN/AN/AN/AOct 20, 2026
CVE-2026-113391: DrayTek Vigor2960: A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 82189.9 Critical8.6 HighN/AOct 20, 2026
CVE-2026-113620: Eclipse Foundation Eclipse ioFog: In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not…9.8 CriticalN/AN/AOct 20, 2026
CVE-2026-113619: Eclipse Foundation Eclipse ioFog: In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template…7.5 HighN/AN/AOct 20, 2026
CVE-2026-113583: cypht-org cypht: Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers…6.1 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113496: Red Hat: A flaw was found in cockpit-machines5.0 MediumN/AN/AOct 20, 2026
CVE-2026-113495: Red Hat: A flaw was found in cockpit-machines5.0 MediumN/AN/AOct 20, 2026
CVE-2026-113388: n/a opensource-socialnetwork: A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.14.3 Medium1.9 LowN/AOct 20, 2026
CVE-2026-105949: Red Hat: Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all…8.8 HighN/AN/AOct 20, 2026
CVE-2026-105312: Red Hat: A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…9.9 CriticalN/AN/AOct 20, 2026
CVE-2026-105311: Red Hat: The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…7.7 HighN/AN/AOct 20, 2026
CVE-2026-113389: DrayTek Vigor2960: A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 82189.9 Critical8.6 HighN/AOct 20, 2026
CVE-2026-18205: Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax…6.1 MediumN/AN/AOct 20, 2026
CVE-2026-113384: Optimal IdM OptimalCloud: A flaw has been found in Optimal IdM OptimalCloud 5.04.3 Medium2.1 LowN/AOct 20, 2026
CVE-2026-113382: arizu-id fast-tunnel: A security vulnerability has been detected in arizu-id fast-tunnel 1.0.06.3 Medium2.1 LowN/AOct 20, 2026
CVE-2026-113358: lavalite cms: LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows…7.5 High8.7 HighN/AOct 20, 2026
CVE-2026-113356: DokuWiki: DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft…7.5 High7.7 HighN/AOct 20, 2026
CVE-2026-113354: Finsys dockhand: Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit…6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-113353: ThimPress LearnPress: LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113349: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent()…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-112785: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename,…4.3 Medium5.3 MediumN/AOct 20, 2026
126-150 of 407346
‹›