The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111658: SiteServer SSCMS: SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows…3.8 Low5.1 MediumN/AOct 16, 2026
CVE-2026-111657: beikeshop: BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111656: zhimaAi chatwiki: ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111655: zoujingli think-plugs-admin: ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows…3.8 Low5.1 MediumN/AOct 16, 2026
CVE-2026-111654: kerwincui FastBee: FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated…6.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111653: 53AI 53AIHub: 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111652: 3xxx engineercms: Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111651: risesoft-y9 Digital-Infrastructure: Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111650: HoshinoSuzumi chronoframe: ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that…8.6 High8.8 HighN/AOct 16, 2026
CVE-2026-111649: rocboss paopao-ce: Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111648: build-admin buildadmin: BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend…2.7 Low5.1 MediumN/AOct 16, 2026
CVE-2026-111647: PickMall lilishop: PickMall lilishop through 5.0.0 contains an insecure direct object reference vulnerability that allows authenticated…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111646: javahuang SurveyKing: SurveyKing before 1.13.0 contains a missing authorization vulnerability that allows unauthenticated attackers to…5.9 Medium8.2 HighN/AOct 16, 2026
CVE-2026-111645: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111644: l429609201 misaka_danmu_server: Misaka Danmu Server through 2.8.9 contains a missing authentication vulnerability that allows unauthenticated attackers…7.3 High6.9 MediumN/AOct 16, 2026
CVE-2026-111643: l429609201 misaka_danmu_server: Misaka Danmu Server through 2.8.9 contains an authentication bypass vulnerability that allows unauthenticated attackers…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111642: FastapiAdmin: FastapiAdmin through 3.0 contains a hard-coded JWT signing secret in backend/app/config/setting.py that allows…8.8 High8.7 HighN/AOct 16, 2026
CVE-2026-111641: FastapiAdmin: FastapiAdmin through 3.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111640: kuaifan dootask: DooTask through 1.9.66 contains a missing authorization vulnerability in WebSocketDialog::checkDialog() that skips the…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111639: mlogclub bbs-go: bbs-go through 4.4.6 contains an authentication bypass vulnerability in the /api/login/google_one_tap endpoint that…8.1 High8.6 HighN/AOct 16, 2026
CVE-2026-111638: moul sshportal: sshportal through 1.19.5 contains a missing authorization vulnerability in the management shell 'key show' command that…7.7 High8.3 HighN/AOct 16, 2026
CVE-2026-111637: Blair2004 NexoPOS: NexoPOS through 6.2.4 contains a missing authentication vulnerability that allows unauthenticated attackers to read…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111636: OpenBMB StaffDeck: OpenBMB StaffDeck through 0.5.6 contains an authentication bypass vulnerability that allows unauthenticated attackers…8.1 High9.2 CriticalN/AOct 16, 2026
CVE-2026-111635: helicalinsight: Helical Insight through 7.0.0 contains a path traversal vulnerability that allows authenticated viewers to read files…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111634: helicalinsight: Helical Insight through 7.0.0 contains an sql injection vulnerability that allows authenticated viewers to inject SQL…8.1 High8.6 HighN/AOct 16, 2026
226-250 of 413491
‹›