The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-116823: yeswiki: YesWiki before 4.7.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to…6.1 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-116822: yeswiki: YesWiki before 4.7.0 contains a path traversal vulnerability in BazarListeAction that allows unauthenticated attackers…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116821: yeswiki: YesWiki before 4.7.0 contains a read-ACL bypass in AclService::updateRequestWithACL, which interpolates usernames into…6.5 Medium7.1 HighN/AOct 27, 2026
CVE-2026-116820: yeswiki: YesWiki from 4.6.0 before 4.7.0 contains an information disclosure vulnerability that allows unauthenticated attackers…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116819: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to…8.5 High8.4 HighN/AOct 27, 2026
CVE-2026-116818: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains an unauthenticated ClickHouse sql injection vulnerability that allows remote attackers…8.2 High8.8 HighN/AOct 27, 2026
CVE-2026-116817: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to access…6.5 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116815: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains an improper escaping vulnerability in sankey.service.ts that allows authenticated…4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-116814: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains an information exposure vulnerability that writes database connection URLs and email…6.5 Medium7.1 HighN/AOct 27, 2026
CVE-2026-116813: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains an sql injection vulnerability in ConversionService.getConversion that allows…6.5 Medium7.1 HighN/AOct 27, 2026
CVE-2026-116812: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains a sql injection vulnerability in profileColumnAccess in cohort.service.ts that allows…6.5 Medium7.1 HighN/AOct 27, 2026
CVE-2026-116811: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains a sandbox escape vulnerability in the js-runtime validator that allows a project member…8.8 High8.7 HighN/AOct 27, 2026
CVE-2026-116810: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains a missing authorization vulnerability that allows unauthenticated attackers to read any…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116809: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains a missing authorization vulnerability in the event.bots tRPC procedure that allows…5.3 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116808: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to read cross-tenant…7.2 High8.6 HighN/AOct 27, 2026
CVE-2026-116807: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains an sql injection vulnerability that allows authenticated users to bypass tenant scoping…6.5 Medium7.0 HighN/AOct 27, 2026
CVE-2026-116806: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains a missing authorization vulnerability in the onboarding.project tRPC mutation that…5.4 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-116805: Openpanel-dev openpanel: OpenPanel before 3.0.0 contains an information disclosure vulnerability that allows read-level project members to…4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-116804: cure53 DOMPurify: DOMPurify from 3.4.4 before 3.4.17 contains a SAFE_FOR_TEMPLATES bypass that lets attackers preserve template…6.1 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-116803: cure53 DOMPurify: DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to keep event handlers…6.1 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-116802: cure53 DOMPurify: DOMPurify before 3.4.17 contains a cross-site scripting vulnerability that allows attackers to bypass the SMIL…6.1 Medium5.1 MediumN/AOct 27, 2026
CVE-2026-116801: parse-community parse-server: Parse Server before 8.6.105 and 9.0.0 before 9.10.5-alpha.6 does not validate the owning object reference in $relatedTo…4.3 Medium5.3 MediumN/AOct 27, 2026
CVE-2026-116800: WWBN AVideo: WWBN AVideo before 29.5.0 contains a local file inclusion vulnerability that allows unauthenticated attackers to…6.2 Medium6.9 MediumN/AOct 27, 2026
CVE-2026-116604: SourceCodester Online Food Ordering System: A vulnerability has been found in SourceCodester Online Food Ordering System 1.06.5 Medium5.5 MediumN/AOct 27, 2026
CVE-2026-116603: SourceCodester Online Food Ordering System: A flaw has been found in SourceCodester Online Food Ordering System 1.04.7 Medium2.0 LowN/AOct 27, 2026
451-475 of 522616