The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2024-2323: WSO2: The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history…4.8 MediumN/AN/AOct 20, 2026
CVE-2026-113404: Uniong WebITR: WebITR developed by Uniong has a Insecure Deserialization vulnerability8.8 High8.7 HighN/AOct 20, 2026
CVE-2026-113403: ArmorX Global Technology ArmorX Spam: ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-113402: ArmorX Global Technology ArmorX Spam: ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-112148: LY Corporation LIFF SDK: A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting…N/A5.1 MediumN/AOct 20, 2026
CVE-2026-110725: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js3.7 LowN/AN/AOct 20, 2026
CVE-2026-110306: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js6.1 MediumN/AN/AOct 20, 2026
CVE-2026-110180: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js4.8 MediumN/AN/AOct 20, 2026
CVE-2026-110095: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js3.7 LowN/AN/AOct 20, 2026
CVE-2026-93878: Divigear DiviGear Carousel: The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action…6.4 MediumN/AN/AOct 20, 2026
CVE-2026-97627: Atsumi Electric Co., Ltd.: Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd7.2 High8.6 HighN/AOct 20, 2026
CVE-2026-96903: Unknown Easy Property Listings: The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its…4.3 MediumN/AN/AOct 20, 2026
CVE-2026-96902: Unknown Easy Property Listings: The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public…5.3 MediumN/AN/AOct 20, 2026
CVE-2026-93300: EventOn EventON - Subscriber: The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all…7.5 HighN/AN/AOct 20, 2026
CVE-2026-100737: Atsumi Electric Co., Ltd.: Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd4.9 Medium6.9 MediumN/AOct 20, 2026
CVE-2026-113386: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 are affected by IMAP command injection7.1 HighN/AN/AOct 20, 2026
CVE-2026-113380: Signal RingRTC: In the RingRTC library before 2.72.0 for Signal, a peer that saturates a call's FSM queue can interfere with the…N/A9.3 CriticalN/AOct 20, 2026
CVE-2026-109831: GNU Project UnRTF: UnRTF by GNU Project is vulnerable to out-of-bounds write5.4 Medium5.1 MediumN/AOct 20, 2026
CVE-2026-86467: Apache Software Foundation Apache Airflow Amazon provider: Apache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the…N/AN/AN/AOct 20, 2026
CVE-2026-12489: Zyxel EX3501-T0 firmware: An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through…6.5 MediumN/AN/AOct 20, 2026
CVE-2026-75753: ASUS Router: Missing Authentication for a Critical Function in certain ASUS routers allows an unauthorized nearby user to send…N/A5.3 MediumN/AOct 20, 2026
CVE-2026-17518: ASUS Router: Buffer Copy without Checking Size of Input in certain ASUS router models allows an adjacent authenticated user to…N/A8.2 HighN/AOct 20, 2026
CVE-2026-105299: Cloudflare https://github.com/cloudflare/pingora: Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through…8.7 HighN/AN/AOct 20, 2026
CVE-2026-102438: ASUS: An uncontrolled search path element vulnerability in ASUS Armoury Crate allows local users to execute arbitrary code…N/A8.5 HighN/AOct 20, 2026
CVE-2026-86981: Apple macOS: An out-of-bounds write issue was addressed with improved bounds checking5.5 MediumN/AN/AOct 20, 2026
251-275 of 407346
‹›