The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-90821: Arcadia Technology, LLC Crafty Controller: An input neutralization vulnerability in the Webhook URL form field component of Crafty Controller allows a remote,…5.4 MediumN/AN/AOct 16, 2026
CVE-2026-18516: Arcadia Technology, LLC Crafty Controller: An output escaping vulnerability in the Audit Logs component of Crafty Controller allows a remote, unauthenticated…9.6 CriticalN/AN/AOct 16, 2026
CVE-2026-111593: Rejected reason: This CVE ID was reserved for a reported issue in the PDF Invoices & Packing Slips for WooCommerce…N/AN/AN/AOct 16, 2026
CVE-2026-111413: aThemeArt aThemeArt Theme Helper: Cross-Site Request Forgery (CSRF) vulnerability in aThemeArt aThemeArt Theme Helper athemeart-theme-helper allows Cross…8.8 HighN/AN/AOct 16, 2026
CVE-2026-110806: Devolutions Server: Incorrect authorization in add-on properties in Devolutions Server 2026.3.8.0 and earlier allows an authenticated user…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-110805: Devolutions Server: Server-side request forgery in PingOne groups endpoint in Devolutions Server 2026.3.8.0 and earlier allows an…2.6 LowN/AN/AOct 16, 2026
CVE-2026-110804: Devolutions Server: Improperly controlled modification of JIT elevation settings in PAM checkout in Devolutions Server 2026.3.8.0 and…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-110287: Devolutions Server: Improper access control in asset contact password in Devolutions Server 2026.3.8.0 and earlier allows an authenticated…4.3 MediumN/AN/AOct 16, 2026
CVE-2026-107617: Guangzhou Juan IoT Technology Co., Ltd.: An attacker can use a hard-coded credential to log in to EseeCloud devices.9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-105664: Guangzhou Juan IoT Technology Co., Ltd.: The endpoint exposes an observable response discrepancy when processing ID values5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-68571: Apache Software Foundation Apache Kylin: Improper Control of Generation of Code ('Code Injection') vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-64959: Apache Software Foundation Apache Kylin: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for…N/AN/AN/AOct 16, 2026
CVE-2026-64610: Apache Software Foundation Apache Kylin: Deserialization of Untrusted Data vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-63619: Apache Software Foundation Apache Kylin: Missing Authorization vulnerability in Apache KylinN/AN/AN/AOct 16, 2026
CVE-2026-63618: Apache Software Foundation Apache Kylin: Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache…7.5 HighN/AN/AOct 16, 2026
CVE-2026-111555: Red Hat: A flaw was found in luksmeta6.0 MediumN/AN/AOct 16, 2026
CVE-2026-111409: YITH YITH PayPal Express Checkout for WooCommerce: Missing Authorization vulnerability in YITH YITH PayPal Express Checkout for WooCommerce…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-111405: PT Norther Lights Production MapSVG: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PT Norther Lights…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-111400: IdeaBox Creations PowerPack Addons for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-111399: PT Norther Lights Production MapSVG: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in PT Norther Lights…8.5 HighN/AN/AOct 16, 2026
CVE-2026-111397: PT Norther Lights Production MapSVG: Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-111396: Liquid Web / StellarWP Advanced Post Manager: Missing Authorization vulnerability in Liquid Web / StellarWP Advanced Post Manager advanced-post-manager allows…7.1 HighN/AN/AOct 16, 2026
CVE-2026-110903: Liquid Web / StellarWP The Events Calendar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Liquid Web /…6.5 MediumN/AN/AOct 16, 2026
CVE-2026-110901: WPMU DEV SmartCrawl: Authorization Bypass Through User-Controlled Key vulnerability in WPMU DEV SmartCrawl smartcrawl-seo allows Exploiting…5.4 MediumN/AN/AOct 16, 2026
CVE-2026-110900: Liquid Web / StellarWP BookIt: Missing Authorization vulnerability in Liquid Web / StellarWP BookIt bookit allows Exploiting Incorrectly Configured…5.3 MediumN/AN/AOct 16, 2026
351-375 of 408239
‹›