The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-115537: gedelumbung HospitalManagement: A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a84.3 Medium5.3 MediumN/AOct 23, 2026
CVE-2026-19678: onPhase onPhase Forms: A server-side request forgery (SSRF) vulnerability in the unauthenticated form service in version 11.0.14 in onPhase…N/A8.7 HighN/AOct 23, 2026
CVE-2026-19677: onPhase onPhase Forms: An authentication bypass vulnerability in the public onPhase/ frevvo registration form version 11.0.14 allows an…N/A9.3 CriticalN/AOct 23, 2026
CVE-2026-115536: gedelumbung HospitalManagement: A security flaw has been discovered in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a84.3 Medium5.3 MediumN/AOct 23, 2026
CVE-2026-115486: Red Hat: A flaw was found in the iscsiuio component of open-iscsi7.1 HighN/AN/AOct 23, 2026
CVE-2026-115485: Red Hat: A flaw was found in the iscsiuio component of open-iscsi6.3 MediumN/AN/AOct 23, 2026
CVE-2026-115484: Red Hat: A flaw was found in the iscsiuio component of open-iscsi7.6 HighN/AN/AOct 23, 2026
CVE-2026-115535: gedelumbung HospitalManagement: A vulnerability was identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a82.4 Low4.8 MediumN/AOct 23, 2026
CVE-2026-115534: gedelumbung HospitalManagement: A vulnerability was determined in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a84.3 Medium5.3 MediumN/AOct 22, 2026
CVE-2026-110825: Kiloview E3 Firmware: The ONVIF device service on affected Kiloview E3 NDI encoder firmware accepts hostname, DNS, and NTP configuration…7.5 High8.7 HighN/AOct 22, 2026
CVE-2026-92450: Kiloview E3 Firmware: The authentication framework used by affected Kiloview E3 NDI encoder firmware signs session JSON Web Tokens using an…7.5 High8.7 HighN/AOct 22, 2026
CVE-2026-110243: Kiloview E3 Firmware: The network management service on affected Kiloview E3 NDI encoder firmware fails to validate the network interface…9.9 Critical9.4 CriticalN/AOct 22, 2026
CVE-2026-107861: Kiloview E3 Firmware: The system control service on affected Kiloview E3 NDI encoder firmware fails to sanitize the hostname parameter…9.9 Critical9.4 CriticalN/AOct 22, 2026
CVE-2026-110491: Kiloview E3 Firmware: The ONVIF service on the E3 can be rendered unresponsive by sending malformed or incomplete requests to certain…7.5 High6.9 MediumN/AOct 22, 2026
CVE-2026-105265: Kiloview E3 Firmware: A vulnerability exists in the the time zone parameter and does not properly validate user input, which may allow an…5.3 Medium6.0 MediumN/AOct 22, 2026
CVE-2026-96616: Kiloview E3 Firmware: Authentication tokens issued by the E3's web management interface on login are given an expiration time far beyond any…6.5 Medium8.3 HighN/AOct 22, 2026
CVE-2026-111100: Kiloview E3 Firmware: The ONVIF device service on the E3 responds to certain informational requests without requiring authentication5.3 Medium6.9 MediumN/AOct 22, 2026
CVE-2026-109122: Kiloview E3 Firmware: The network management service on affected Kiloview E3 NDI encoder firmware fails to sanitize one field used when…9.1 Critical9.4 CriticalN/AOct 22, 2026
CVE-2026-110063: Microsoft VM Inspector for Azure Virtual Machines: Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an…10.0 CriticalN/AN/AOct 22, 2026
CVE-2026-83938: Microsoft Azure Kubernetes Configuration Service: Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker…10.0 CriticalN/AN/AOct 22, 2026
CVE-2026-96185: Microsoft Microsoft Exchange Online: Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.7.5 HighN/AN/AOct 22, 2026
CVE-2026-97785: Microsoft Microsoft Entra application proxy: Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.10.0 CriticalN/AN/AOct 22, 2026
CVE-2026-108456: Microsoft Azure AI Foundry: Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a…7.7 HighN/AN/AOct 22, 2026
CVE-2026-105014: Microsoft Azure Pipelines: Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an…9.1 CriticalN/AN/AOct 22, 2026
CVE-2026-111594: InterSystems IRIS for Health: InterSystems IRIS for Health has TLS/SSL encryption turned off by default, which may enable an attacker to view…8.1 High9.2 CriticalN/AOct 22, 2026
1-25 of 418797
›