The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-25716: Hallo Welt! GmbH BlueSpice: Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any…7.1 High7.1 HighN/AOct 23, 2026
CVE-2026-16762: qt: An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate…N/A8.7 HighN/AOct 23, 2026
CVE-2026-115657: KNIME KNIME Analytics Platform: When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before…N/A4.8 MediumN/AOct 23, 2026
CVE-2026-112862: xnau webdesign Participants Database: Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112860: xnau webdesign Participants Database: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign…9.3 CriticalN/AN/AOct 23, 2026
CVE-2026-112838: e4jvikwp VikRentCar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp…7.1 HighN/AN/AOct 23, 2026
CVE-2026-112837: Ruben Garcia GamiPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia…8.5 HighN/AN/AOct 23, 2026
CVE-2026-112835: e4jvikwp VikRentCar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp…7.1 HighN/AN/AOct 23, 2026
CVE-2026-112825: Magepeople inc. Car Rental Manager: Missing Authorization vulnerability in Magepeople inc6.5 MediumN/AN/AOct 23, 2026
CVE-2026-112821: Knit Pay: Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access…6.5 MediumN/AN/AOct 23, 2026
CVE-2026-112359: Amauri.IO WPMobile.App: Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured…7.5 HighN/AN/AOct 23, 2026
CVE-2025-58403: CGM CGM CLININET: CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied dataN/A5.1 MediumN/AOct 23, 2026
CVE-2025-30054: CGM CGM CLININET: CGM CLININET is vulnerable to local privilege escalationN/A9.3 CriticalN/AOct 23, 2026
CVE-2025-30053: CGM CGM CLININET: The CGM CLININET application runs the cgm-updater process listening on an open network port without any authenticationN/A6.9 MediumN/AOct 23, 2026
CVE-2025-30052: CGM CGM CLININET: The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofingN/A8.8 HighN/AOct 23, 2026
CVE-2025-30051: CGM CGM CLININET: The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials,…N/A6.8 MediumN/AOct 23, 2026
CVE-2025-30050: CGM CGM CLININET: CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified…N/A9.4 CriticalN/AOct 23, 2026
CVE-2025-30049: CGM CGM CLININET: The CGM CLININET application stores user passwords as unsalted MD5 hashesN/A8.2 HighN/AOct 23, 2026
CVE-2025-30047: CGM CGM CLININET: CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted dataN/A9.4 CriticalN/AOct 23, 2026
CVE-2025-30046: CGM CGM CLININET: In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run…N/A9.0 CriticalN/AOct 23, 2026
CVE-2025-30045: CGM CGM CLININET: CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF…N/A8.6 HighN/AOct 23, 2026
CVE-2025-30043: CGM CGM CLININET: CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment pathN/A7.1 HighN/AOct 23, 2026
CVE-2026-93489: ASUS Router: Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge…N/A8.7 HighN/AOct 23, 2026
CVE-2026-75779: ASUS Router: Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request…N/A8.6 HighN/AOct 23, 2026
CVE-2026-75775: ASUS Router: Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute…N/A7.7 HighN/AOct 23, 2026
401-425 of 413321
‹›