The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111633: SeriaWei ZKEACMS: ZKEACMS through 4.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge REST…8.6 High8.8 HighN/AOct 16, 2026
CVE-2026-111632: aureuserp: Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows authenticated API users to create…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111631: 10up Distributor: Distributor before 2.3.2 contains a missing authorization vulnerability that allows Contributor-level users to invoke…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111630: colinin abp-next-admin: abp-next-admin 10.2.0 through 10.6.0 contains an insecure direct object reference vulnerability in the…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111629: IoTSharp: IoTSharp through 3.6.1 contains an insecure direct object reference vulnerability that allows any authenticated user to…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111628: 10up Distributor: 10up Distributor before 2.3.2 contains a PHP object injection vulnerability that allows Contributor-level users to…5.0 Medium2.3 LowN/AOct 16, 2026
CVE-2026-111627: hestiacp: HestiaCP before 1.10.5 contains an authorization bypass vulnerability that allows non-ROOT_USER administrators to…7.2 High8.6 HighN/AOct 16, 2026
CVE-2026-111626: Webreaper Damselfly: Webreaper Damselfly through 4.5.3 contains an authentication bypass vulnerability that allows unauthenticated attackers…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111625: 10up Distributor: 10up Distributor before 2.3.2 contains a missing authorization vulnerability in ajax_push() that allows…5.0 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111624: umbraco Umbraco-CMS: Umbraco CMS before 17.7.1 and 18.2.1 contains a missing authorization vulnerability that allows unauthenticated clients…3.7 Low6.3 MediumN/AOct 16, 2026
CVE-2026-111623: joey-zhou xiaozhi-esp32-server-java: Xiaozhi-esp32-server-java through 6.1.0 contains an authentication bypass vulnerability that allows unauthenticated…5.6 Medium6.3 MediumN/AOct 16, 2026
CVE-2026-111622: a466350665 smart-sso: smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated…6.8 Medium7.6 HighN/AOct 16, 2026
CVE-2026-111621: TDuckCloud tduck-survey-form: TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111620: O2OA: O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows…5.3 Medium6.0 MediumN/AOct 16, 2026
CVE-2026-111619: zyx0814 FilePress: FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111618: coaidev CoAI: CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111617: MGdaasLab WHartTest: WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to…6.5 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111616: Oqtane Oqtane Framework: Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site…4.9 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111615: gz-yami mall4cloud: Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111614: devlive-community DataCap: DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111613: alldatacenter alldata: AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111612: qaiu netdisk-fast-download: netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111611: roncoo roncoo-education: roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111610: b3log Solo: B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111609: PKP Open Journal Systems: PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal…3.8 Low5.1 MediumN/AOct 16, 2026
251-275 of 503580
‹›