The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-87043: zephyrproject zephyr: The entropy-device random number generator in subsys/random/random_entropy_device.c returned early with -ENODEV from…4.8 MediumN/AN/ANov 4, 2026
CVE-2026-87041: zephyrproject zephyr: The RTIO submission-queue verifier rtio_vrfy_sqe() in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before…7.8 HighN/AN/ANov 4, 2026
CVE-2026-87040: zephyrproject zephyr: The nRF link-layer receive paths of the open-source Bluetooth LE Controller did not validate the on-air LENGTH field of…8.3 HighN/AN/ANov 4, 2026
CVE-2026-87039: zephyrproject zephyr: The user-mode syscall verifier z_vrfy_i2s_configure() in drivers/i2s/i2s_handlers.c copies the caller's struct…7.8 HighN/AN/ANov 4, 2026
CVE-2026-87038: zephyrproject zephyr: The user-mode verification handler for the i3c_transfer() system call, z_vrfy_i3c_transfer() in…7.0 HighN/AN/ANov 4, 2026
CVE-2026-16511: zephyrproject zephyr: Two RTIO syscall verifiers, in subsys/rtio/rtio_syscalls.c (subsys/rtio/rtio_handlers.c before v4.3.0), did not…8.8 HighN/AN/ANov 4, 2026
CVE-2026-85036: zephyrproject zephyr: The Bluetooth Classic AVDTP layer defers releasing a session's stream endpoints: bt_avdtp_l2cap_disconnected() in…5.7 MediumN/AN/ANov 4, 2026
CVE-2026-11753: LY Corporation Armeria: A vulnerability has been identified in armeria-saml versions prior to 1.41.1, where attacker-controlled RelayState is…N/A5.1 MediumN/ANov 4, 2026
CVE-2026-105296: Akeeba Ltd.: Multiple Akeeba products lack the anti-CSRF check on some actions5.4 Medium5.1 MediumN/ANov 4, 2026
CVE-2026-11749: LY Corporation Armeria: A vulnerability has been identified in armeria-saml prior to 1.41.1, where bearer assertions are not enforced for…N/A7.6 HighN/ANov 4, 2026
CVE-2026-80335: Unisoc (Shanghai) Technologies Co., Ltd. Bootloader: In the bootloader download module, there is a possible out-of-bounds write due to a failure to reset a global offset…7.6 HighN/AN/ANov 4, 2026
CVE-2026-79405: Unisoc (Shanghai) Technologies Co., Ltd. Modem: In Modem Firmware, there is a possible system crash due to improper input validation of dedicated PUCCH configuration7.5 HighN/AN/ANov 4, 2026
CVE-2026-121803: Out-of-bounds Write9.3 CriticalN/AN/ANov 4, 2026
CVE-2026-121802: better-auth Better Auth: @better-auth/expo before 1.7.16 allows certain account-takeover outcomes (e.g., unauthenticated changes of any…9.1 CriticalN/AN/ANov 4, 2026
CVE-2026-121618: Linksys E5600: A weakness has been identified in Linksys E5600 1.1.0.265.3 Medium5.5 MediumN/ANov 4, 2026
CVE-2026-121617: Linksys E5600: A security flaw has been discovered in Linksys E5600 1.1.0.267.5 High7.7 HighN/ANov 4, 2026
CVE-2026-121616: Linksys E5600: A vulnerability was identified in Linksys E5600 1.1.0.265.3 Medium5.5 MediumN/ANov 4, 2026
CVE-2026-121615: Linksys E5600: A vulnerability was determined in Linksys E5600 1.1.0.2610.0 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-84730: ASUS Router firmware: Stack-based buffer overflow in certain ASUS Router firmware allows an unauthenticated nearby attacker to execute…N/A8.7 HighN/ANov 4, 2026
CVE-2026-84729: ASUS Router firmware: Out-of-bounds write in certain ASUS Router firmware allow an unauthenticated nearby attacker to write data beyond the…N/A7.2 HighN/ANov 4, 2026
CVE-2026-121609: Qihoo 360 Whole Home Router M5: A vulnerability was identified in Qihoo 360 Whole Home Router M5 4.0.17.156610.0 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-121608: Qihoo 360: A vulnerability was determined in Qihoo 360 D603-2, D600-2 and D606-6 up to 6.3.27.3 High5.5 MediumN/ANov 4, 2026
CVE-2026-121607: Qihoo 360: A vulnerability was found in Qihoo 360 D603-2, D600-2, D606-6 and D706 up to 6.4.910.0 Critical9.3 CriticalN/ANov 4, 2026
CVE-2026-112116: ASUS System Control Interface: An exposed IOCTL with insufficient access control in ASUS System Control Interface allows a local, low-privileged user…N/A8.5 HighN/ANov 4, 2026
CVE-2026-110464: ASUS Armoury Crate: Missing authorization in ASUS Armoury Crate allows a local attacker to write content into a specific file or registry…N/A6.9 MediumN/ANov 4, 2026
176-200 of 414969
‹›