The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-112821: Knit Pay: Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access…6.5 MediumN/A0%Oct 23, 2026
CVE-2026-112359: Amauri.IO WPMobile.App: Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured…7.5 HighN/A0%Oct 23, 2026
CVE-2026-112230: Unknown Popup Builder: The Popup Builder WordPress plugin before 4.4.6 does not perform authorization checks before trashing popup content in…3.7 LowN/A0%Oct 23, 2026
CVE-2026-115221: Red Hat: A flaw was found in FreeIPA5.4 MediumN/A0%Oct 22, 2026
CVE-2026-114620: authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers5.4 MediumN/A0%Oct 22, 2026
CVE-2026-114619: authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers4.6 MediumN/A0%Oct 22, 2026
CVE-2026-114618: authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers6.8 MediumN/A0%Oct 22, 2026
CVE-2026-114617: authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers4.2 MediumN/A0%Oct 22, 2026
CVE-2026-114615: authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers7.4 HighN/A0%Oct 22, 2026
CVE-2026-114614: authlib: Authlib is a Python library which builds OAuth and OpenID Connect servers2.6 LowN/A0%Oct 22, 2026
CVE-2026-115509: jitsucom jitsu: Jitsu console before 2.14.0-beta.41 contains an incorrect authorization vulnerability in sources/state.ts handlers that…4.2 Medium2.3 Low0%Oct 22, 2026
CVE-2026-115376: lxc incus: Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 contains an authorization bypass vulnerability that allows…7.7 High8.3 High0%Oct 22, 2026
CVE-2026-115373: lxc incus: Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 contains a missing authorization vulnerability in GET…6.3 Medium7.0 High0%Oct 22, 2026
CVE-2026-115371: lxc incus: Incus 6.0.3 before 6.0.7, 6.6.0 before 7.0.2, and 7.1.0 before 7.5.0 contains an improper authorization vulnerability…7.1 High7.1 High0%Oct 22, 2026
CVE-2026-115366: openbao: OpenBao from 2.3.0 before 2.6.3 contains an improper authorization vulnerability that allows privileged child-namespace…2.6 Low2.0 Low0%Oct 22, 2026
CVE-2026-115365: openbao: OpenBao from 2.3.0 before 2.6.3 contains an incorrect authorization vulnerability in its ACL policy cache that allows…6.6 Medium7.5 High0%Oct 22, 2026
CVE-2026-115364: openbao: OpenBao before 2.6.3 contains a missing authorization check that allows attackers to stop Agent and Proxy services by…2.2 Low2.1 Low0%Oct 22, 2026
CVE-2026-114519: Roskus Prospero Flow CRM: Missing Authorization (CWE-862) in the user API of Roskus Prospero Flow CRM from 2.0.0 before 5.26.0 allows a user with…N/A8.6 High0%Oct 22, 2026
CVE-2026-113876: SmileCDR HAPI FHIR: SmileCDR HAPI FHIR does not correctly check authorization for conditional create actions4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-93336: Canonical Juju: Missing authorization in the unit resources download route in Canonical Juju 4.0 through 4.0.15 allows a…N/A7.1 High0%Oct 22, 2026
CVE-2026-115516: KNIME KNIME Business Hub SaaS: An incorrect authorization issue exposes basic account information to unauthorized remote users in KNIME Business Hub…N/A6.9 MediumN/AOct 22, 2026
CVE-2026-115502: KNIME KNIME Business Hub: A missing authorization check allows anyone having access to a "link without login" for a DataApp to list and…N/A6.3 Medium0%Oct 22, 2026
CVE-2026-115416: AWS Amazon Athena: Incorrect authorization checks in Amazon Athena engine version 3 query processing could have allowed an authenticated…7.7 High6.3 Medium0%Oct 22, 2026
CVE-2026-114607: better-auth: Better Auth is an authentication and authorization library for TypeScript9.1 CriticalN/A0%Oct 22, 2026
CVE-2026-114606: jgraph drawio-desktop: draw.io Desktop is the official Electron build of draw.ioN/A5.6 Medium0%Oct 22, 2026
26-50 of 12125
‹›