The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-107621: J4Care dcm4chee-arc-light: JPEGParser can enter an infinite loop while parsing a specially crafted or truncated stream.7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-106705: n/a: ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module8.8 HighN/AN/AOct 16, 2026
CVE-2026-105667: J4Care dcm4chee-arc-light: In the default configuration, the HL7 listener accepts ADT^A40 patient-merge messages without authenticating the…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-105279: J4Care dcm4chee-arc-light: In the default configuration, the archive accepts DICOM associations from an unregistered calling AE9.1 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-105273: J4Care dcm4chee-arc-light: MP4Parser does not adequately validate MP4 box sizes7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-101021: J4Care dcm4chee-arc-light: MultipartInputStream performs inefficient boundary matching and unnecessary buffer copying7.5 High8.7 HighN/AOct 16, 2026
CVE-2025-52097: n/a: Cross Site Scripting vulnerability in InstantASP ltd, InstantForum.NET v.4.1.4 allows an attacker to execute arbitrary…N/AN/AN/AOct 16, 2026
CVE-2026-97858: Guangzhou Juan IoT Technology Co., Ltd.: An attacker can cause the server to unbind the target device from its current owner and rebind it to the requesting…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-97470: themefic: The Tourfic – AI Powered Travel Booking, Hotel Booking & Car Rental plugin for WordPress is vulnerable to Stored…6.4 MediumN/AN/AOct 16, 2026
CVE-2026-90821: Arcadia Technology, LLC Crafty Controller: An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote,…5.4 MediumN/AN/AOct 16, 2026
CVE-2026-18516: Arcadia Technology, LLC Crafty Controller: An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated…9.6 CriticalN/AN/AOct 16, 2026
CVE-2026-111593: Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce…N/AN/AN/AOct 16, 2026
CVE-2026-111413: aThemeArt aThemeArt Theme Helper: Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross…8.8 HighN/AN/AOct 16, 2026
CVE-2026-110806: Devolutions Server: Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-110805: Devolutions Server: Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an…2.6 LowN/AN/AOct 16, 2026
CVE-2026-110804: Devolutions Server: Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-110287: Devolutions Server: Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-107617: Guangzhou Juan IoT Technology Co., Ltd.: An attacker can use a hard-coded credential to log in to EseeCloud devices.9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-105664: Guangzhou Juan IoT Technology Co., Ltd.: The endpoint exposes an observable response discrepancy when processing ID values5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-68571: Apache Software Foundation Apache Kylin: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-64959: Apache Software Foundation Apache Kylin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…N/AN/AN/AOct 16, 2026
CVE-2026-64610: Apache Software Foundation Apache Kylin: Deserialization of Untrusted Data vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-63619: Apache Software Foundation Apache Kylin: Missing Authorization vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-63618: Apache Software Foundation Apache Kylin: Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache…7.5 HighN/AN/AOct 16, 2026
CVE-2026-111555: Red Hat: A flaw was found in luksmeta6.0 MediumN/AN/AOct 16, 2026
351-375 of 400934
‹›