The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110804: Devolutions Server: Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-110287: Devolutions Server: Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-107617: Guangzhou Juan IoT Technology Co., Ltd.: An attacker can use a hard-coded credential to log in to EseeCloud devices.9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-105664: Guangzhou Juan IoT Technology Co., Ltd.: The endpoint exposes an observable response discrepancy when processing ID values5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-68571: Apache Software Foundation Apache Kylin: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-64959: Apache Software Foundation Apache Kylin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…N/AN/AN/AOct 16, 2026
CVE-2026-64610: Apache Software Foundation Apache Kylin: Deserialization of Untrusted Data vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-63619: Apache Software Foundation Apache Kylin: Missing Authorization vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-63618: Apache Software Foundation Apache Kylin: Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache…7.5 HighN/AN/AOct 16, 2026
CVE-2026-111555: Red Hat: A flaw was found in luksmeta6.0 MediumN/AN/AOct 16, 2026
CVE-2026-111409: YITH YITH PayPal Express Checkout for WooCommerce: Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-111405: PT Norther Lights Production MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-111400: IdeaBox Creations PowerPack Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-111399: PT Norther Lights Production MapSVG: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights…8.5 HighN/AN/AOct 16, 2026
CVE-2026-111397: PT Norther Lights Production MapSVG: Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-111396: Liquid Web / StellarWP Advanced Post Manager: Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows…7.1 HighN/AN/AOct 16, 2026
CVE-2026-110903: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-110901: WPMU DEV SmartCrawl: Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting…5.4 MediumN/AN/AOct 16, 2026
CVE-2026-110900: Liquid Web / StellarWP BookIt: Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-110896: WP Chill Passster: Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-110380: Arraytics WP Event Solution: Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-107564: gocsaf Development Community csaf_provider: An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-105958: Red Hat: A flaw was found in spice-server7.5 HighN/AN/AOct 16, 2026
CVE-2026-111391: sgl-project sglang: SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers…8.1 High9.2 CriticalN/AOct 16, 2026
CVE-2026-111390: erupts erupt: Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data…5.3 Medium6.0 MediumN/AOct 16, 2026
301-325 of 412906
‹›