The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113358: lavalite cms: LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows…7.5 High8.7 HighN/AOct 20, 2026
CVE-2026-113356: DokuWiki: DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft…7.5 High7.7 HighN/AOct 20, 2026
CVE-2026-113354: Finsys dockhand: Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit…6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-113353: ThimPress LearnPress: LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113351: libexpat: libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte…5.9 Medium8.2 HighN/AOct 20, 2026
CVE-2026-113349: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent()…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-112787: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-112785: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename,…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-112783: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-108089: Apache Software Foundation Apache Cocoon: ** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere…7.5 HighN/AN/AOct 20, 2026
CVE-2026-108088: Apache Software Foundation Apache Cocoon: ** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache CocoonN/AN/AN/AOct 20, 2026
CVE-2026-108087: Apache Software Foundation Apache Cocoon: ** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection')…N/AN/AN/AOct 20, 2026
CVE-2026-108086: Apache Software Foundation Apache Cocoon: ** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion')…N/AN/AN/AOct 20, 2026
CVE-2026-108062: Eclipse Foundation Eclipse CSI - PIA: Pre-authentication OIDC discovery and JWKS fetches run synchronously on the asyncio event loop, so one unauthenticated…N/A6.9 MediumN/AOct 20, 2026
CVE-2026-107597: Eclipse Foundation Eclipse CSI - PIA: PIA's token verification (`verify_token` in `pia/oidc.py`) fetches the OIDC discovery document of an allowlisted issuer…N/A5.1 MediumN/AOct 20, 2026
CVE-2026-113357: tester-army @e2e-dev/github: @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to…3.5 Low5.1 MediumN/AOct 20, 2026
CVE-2026-113355: chatwoot: Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to…4.8 Medium4.8 MediumN/AOct 20, 2026
CVE-2026-113352: uTox: uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending…7.5 High7.7 HighN/AOct 20, 2026
CVE-2026-113350: marmelab react-admin: react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts…5.4 Medium5.1 MediumN/AOct 20, 2026
CVE-2026-112786: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-112784: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-85267: Google Cloud Cloud Shell: A Cross-Site WebSocket Hijacking vulnerability in Cloud Shell prior to 2026-07-22 on Google Cloud Platform allows an…N/A8.7 HighN/AOct 20, 2026
CVE-2026-43858: Advantech ADAM-3600: A stack-based buffer overflow vulnerability could allow a remote authenticated attacker to achieve arbitrary code…N/A8.6 HighN/AOct 20, 2026
CVE-2026-43857: Advantech ADAM-3600: A vulnerability could allow a remote authenticated attacker to achieve arbitrary code execution with privileges on the…N/A8.6 HighN/AOct 20, 2026
CVE-2026-43856: Advantech ADAM-3600: A stack-based buffer overflow vulnerability in the FileProcess::CheckDir function could allow a remote authenticated…N/A8.6 HighN/AOct 20, 2026
226-250 of 407346
‹›