The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111406: PT Norther Lights Production MapSVG: Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG…9.9 CriticalN/AN/AOct 19, 2026
CVE-2026-111398: PT Norther Lights Production MapSVG: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights…7.7 HighN/AN/AOct 19, 2026
CVE-2026-110898: WPDeveloper Essential Addons for Elementor: Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor…6.4 MediumN/AN/AOct 19, 2026
CVE-2026-110887: HivePress: Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote…9.9 CriticalN/AN/AOct 19, 2026
CVE-2026-110379: Ays Pro Quiz Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz…7.1 HighN/AN/AOct 19, 2026
CVE-2026-108837: Apache Software Foundation Apache Kylin: Allocation of resources without limits or throttling vulnerability in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108833: Apache Software Foundation Apache Kylin: Default startup profile miss security settings in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108823: Apache Software Foundation Apache Kylin: Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108780: Apache Software Foundation Apache Kylin: Potential JDBC source configuration validation vulnerability in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108776: Apache Software Foundation Apache Kylin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108771: Apache Software Foundation Apache Kylin: Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108766: Apache Software Foundation Apache Kylin: Missing authorization on jdbc source config update in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108764: Apache Software Foundation Apache Kylin: Server-Side request forgery (SSRF) vulnerability in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108762: Apache Software Foundation Apache Kylin: Path-confinement bypass during metadata backup deletion in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-13695: Integratec: SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects…N/A8.8 HighN/AOct 19, 2026
CVE-2026-112180: MISP: MISP contains a data integrity flaw in its event deletion logicN/A5.1 MediumN/AOct 19, 2026
CVE-2026-112179: MISP: In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote pushN/A5.3 MediumN/AOct 19, 2026
CVE-2026-112178: MISP: MISP contains an access control flaw in the proposal (shadow attribute) visibility logicN/A7.1 HighN/AOct 19, 2026
CVE-2026-112161: Mobatek MobaXterm: MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrityN/A8.5 HighN/AOct 19, 2026
CVE-2026-112098: n/a DeepPavlov: A security flaw has been discovered in DeepPavlov up to 1.7.06.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-112097: SourceCodester Inventory System: A vulnerability was found in SourceCodester Inventory System 1.03.5 Low5.1 MediumN/AOct 19, 2026
CVE-2026-112096: SourceCodester Inventory System: A vulnerability has been found in SourceCodester Inventory System 1.03.5 Low2.0 LowN/AOct 19, 2026
CVE-2026-112095: SourceCodester Inventory System: A flaw has been found in SourceCodester Inventory System 1.03.5 Low2.0 LowN/AOct 19, 2026
CVE-2026-111438: openGauss-server: 在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求…6.5 MediumN/AN/AOct 19, 2026
CVE-2026-104679: Yamaha Corporation VOCALOID6 Editor: VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references7.1 High6.9 MediumN/AOct 19, 2026
301-325 of 409174
‹›