The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113459: TYPO3 Extension "TYPO3 AI Integration Extension": In versions running on TYPO3 10 and 11, the configured OpenAI API key is embedded in every backend page, so that the…N/A7.1 HighN/AOct 20, 2026
CVE-2026-113442: TYPO3 Extension "TYPO3 Fluid-Form by coding.ms": Values entered by visitors were placed into the HTML summary email without being escapedN/A5.3 MediumN/AOct 20, 2026
CVE-2026-113381: n/a Osclass: A weakness has been identified in Osclass up to 8.3.17.3 High5.5 MediumN/AOct 20, 2026
CVE-2026-113378: mcollina mcp-ripgrep: A security flaw has been discovered in mcollina mcp-ripgrep up to 0.4.05.3 Medium1.9 LowN/AOct 20, 2026
CVE-2026-112240: TYPO3 Extension "TYPO3 Fluid-Form by coding.ms": The download link for files uploaded through a form relied on a token that could be predictedN/A6.3 MediumN/AOct 20, 2026
CVE-2026-112239: TYPO3 Extension "TYPO3 AI Integration Extension": The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page…N/A7.2 HighN/AOct 20, 2026
CVE-2026-112238: TYPO3 Extension "File manager": The file search of the extension builds its database conditions by wrapping the search term in quotes itselfN/A8.7 HighN/AOct 20, 2026
CVE-2026-112237: TYPO3 Extension "Kitodo.Presentation": The extension provides a public proxy endpoint that fetches a URL on behalf of the visitorN/A6.9 MediumN/AOct 20, 2026
CVE-2026-112071: TYPO3 Extension "TYPO3 Shop by coding.ms": The order cancellation function accepts an order identifier from the request and acts on that order without checking…N/A6.9 MediumN/AOct 20, 2026
CVE-2026-112070: TYPO3 Extension "Analytics": The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard…N/A5.3 MediumN/AOct 20, 2026
CVE-2026-112069: TYPO3 Extension "FAL Protect": The extension no longer applied its access protection to files in file storages that use a non-default relative base…N/A6.3 MediumN/AOct 20, 2026
CVE-2026-112068: TYPO3 Extension "Analytics": The backend module does not check whether a backend user has access to the requested siteN/A5.3 MediumN/AOct 20, 2026
CVE-2026-112067: TYPO3 Extension "Accessible Form Captcha": The extension hides the correct answer to each CAPTCHA inside the image data of the CAPTCHA itselfN/A6.9 MediumN/AOct 20, 2026
CVE-2026-112066: TYPO3 Extension "sgalinski Cookie Consent": The JSON import of the cookie consent configuration did not respect the backend user's permissionsN/A7.1 HighN/AOct 20, 2026
CVE-2026-112065: TYPO3 Extension "sgalinski Cookie Consent": The routes that provide consent history and statistics data did not check whether the backend user had access to the…N/A5.3 MediumN/AOct 20, 2026
CVE-2026-112064: TYPO3 Extension "sgalinski Cookie Consent": The backend module for reviewing the consent history accepted sorting, grouping and index options from the request and…N/A7.1 HighN/AOct 20, 2026
CVE-2026-111844: Brizy: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brizy Brizy brizy…6.5 MediumN/AN/AOct 20, 2026
CVE-2026-92287: Apache Software Foundation: Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1N/AN/AN/AOct 20, 2026
CVE-2026-43848: Advantech ADAM-3600: A vulnerability in the bulk port configuration functionality could allow an unauthenticated attacker to crash the…N/A6.9 MediumN/AOct 20, 2026
CVE-2026-43847: Advantech ADAM-3600: A vulnerability in the proprietary protocol could allow an attacker to brute force the administrator password without…N/A8.2 HighN/AOct 20, 2026
CVE-2026-43846: Advantech ADAM-3600: A stack-based buffer overflow vulnerability in a non-functional feature could allow an authenticated attacker to…N/A8.6 HighN/AOct 20, 2026
CVE-2026-43845: Advantech ADAM-3600: A vulnerability in the password reset mechanism could allow an attacker to bypass the authentication mechanism.N/A9.2 CriticalN/AOct 20, 2026
CVE-2026-43844: Advantech ADAM-3600: A vulnerability in the proprietary protocol could allow an attacker to bypass the authentication mechanism.N/A9.3 CriticalN/AOct 20, 2026
CVE-2026-43843: Advantech ADAM-3600: An integer overflow vulnerability in the license manager service could allow an unauthenticated attacker to crash the…N/A6.9 MediumN/AOct 20, 2026
CVE-2026-43842: Advantech ADAM-3600: A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to…N/A6.9 MediumN/AOct 20, 2026
1801-1825 of 407346
‹›