The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-43840: Advantech ADAM-3600: A NULL pointer dereference vulnerability in the license manager service could allow an unauthenticated attacker to…N/A6.9 MediumN/AOct 20, 2026
CVE-2026-43839: Advantech ADAM-3600: A NULL pointer dereference vulnerability in the logs management functionality could allow an unauthenticated attacker…N/A8.7 HighN/AOct 20, 2026
CVE-2026-43838: Advantech ADAM-3600: A stack-based buffer overflow vulnerability in the login functionality could allow an attacker to achieve code…N/A9.2 CriticalN/AOct 20, 2026
CVE-2026-43837: Advantech ADAM-3600: A buffer overflow vulnerability in the password verification functionality could allow an attacker with guest…N/A7.5 HighN/AOct 20, 2026
CVE-2026-43836: Advantech ADAM-3600: A vulnerability could allow an attacker to forge a packet to execute arbitrary commands with maximum privileges.N/A9.3 CriticalN/AOct 20, 2026
CVE-2026-11960: FacturaScripts: Enumeration of unauthenticated users in FacturaScripts, version 2025.61N/A6.9 MediumN/AOct 20, 2026
CVE-2026-11959: FacturaScripts: Stored Cross-Site Scripting (XSS) in FacturaScripts, version 2025.61, caused by a lack of adequate validation or…N/A6.9 MediumN/AOct 20, 2026
CVE-2026-113469: Stormshield Stormshield Network Security: A failure has been identified in the SNS during dynamic data files signature check7.5 HighN/AN/AOct 20, 2026
CVE-2026-113465: Stormshield Stormshield Network Security: It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel6.6 MediumN/AN/AOct 20, 2026
CVE-2026-101201: qt: A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of…N/A4.3 MediumN/AOct 20, 2026
CVE-2026-43835: Advantech ADAM-3600: A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware…N/A8.6 HighN/AOct 20, 2026
CVE-2026-43834: Advantech ADAM-3600: A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to…N/A7.5 HighN/AOct 20, 2026
CVE-2026-113407: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-113406: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-113405: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-111090: Stormshield Stormshield Network Security: A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and…7.8 HighN/AN/AOct 20, 2026
CVE-2024-2323: WSO2: The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history…4.8 MediumN/AN/AOct 20, 2026
CVE-2026-112177: Red Hat: A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 87.3 HighN/AN/AOct 20, 2026
CVE-2026-93878: Divigear DiviGear Carousel: The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action…6.4 MediumN/AN/AOct 20, 2026
CVE-2026-113404: Uniong WebITR: WebITR developed by Uniong has a Insecure Deserialization vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-113403: ArmorX Global Technology ArmorX Spam: ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-113402: ArmorX Global Technology ArmorX Spam: ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-112148: LY Corporation LIFF SDK: A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting…N/A5.1 MediumN/AOct 20, 2026
CVE-2026-110725: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js3.7 LowN/AN/AOct 20, 2026
CVE-2026-110306: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js6.1 MediumN/AN/AOct 20, 2026
1826-1850 of 407346
‹›