The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-108764: Apache Software Foundation Apache Kylin: Server-Side request forgery (SSRF) vulnerability in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-13695: Integratec: SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects…N/A8.8 HighN/AOct 19, 2026
CVE-2026-112180: MISP: MISP contains a data integrity flaw in its event deletion logicN/A5.1 MediumN/AOct 19, 2026
CVE-2026-112179: MISP: In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote pushN/A5.3 MediumN/AOct 19, 2026
CVE-2026-112178: MISP: MISP contains an access control flaw in the proposal (shadow attribute) visibility logicN/A7.1 HighN/AOct 19, 2026
CVE-2026-112161: Mobatek MobaXterm: MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrityN/A8.5 HighN/AOct 19, 2026
CVE-2026-112098: n/a DeepPavlov: A security flaw has been discovered in DeepPavlov up to 1.7.06.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-112097: SourceCodester Inventory System: A vulnerability was found in SourceCodester Inventory System 1.03.5 Low5.1 MediumN/AOct 19, 2026
CVE-2026-112096: SourceCodester Inventory System: A vulnerability has been found in SourceCodester Inventory System 1.03.5 Low2.0 LowN/AOct 19, 2026
CVE-2026-112095: SourceCodester Inventory System: A flaw has been found in SourceCodester Inventory System 1.03.5 Low2.0 LowN/AOct 19, 2026
CVE-2026-111438: openGauss-server: 在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求…6.5 MediumN/AN/AOct 19, 2026
CVE-2026-104679: Yamaha Corporation VOCALOID6 Editor: VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references7.1 High6.9 MediumN/AOct 19, 2026
CVE-2026-108762: Apache Software Foundation Apache Kylin: Path-confinement bypass during metadata backup deletion in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-112183: MISP: MISP contains a CSS injection vulnerability in the remote event preview featureN/A4.8 MediumN/AOct 19, 2026
CVE-2026-112100: n/a DeepPavlov: A vulnerability was determined in DeepPavlov up to 1.7.05.5 Medium5.1 MediumN/AOct 19, 2026
CVE-2026-110887: HivePress: Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Remote…9.9 CriticalN/AN/AOct 19, 2026
CVE-2026-111398: PT Norther Lights Production MapSVG: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in PT Norther Lights…7.7 HighN/AN/AOct 19, 2026
CVE-2026-110898: WPDeveloper Essential Addons for Elementor: Incorrect Privilege Assignment vulnerability in WPDeveloper Essential Addons for Elementor…6.4 MediumN/AN/AOct 19, 2026
CVE-2026-111407: Themeum Tutor LMS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Themeum Tutor LMS…6.5 MediumN/AN/AOct 19, 2026
CVE-2026-111408: ExpressTech Quiz And Survey Master: Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object…8.8 HighN/AN/AOct 19, 2026
CVE-2026-110379: Ays Pro Quiz Maker: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ays Pro Quiz…7.1 HighN/AN/AOct 19, 2026
CVE-2026-111406: PT Norther Lights Production MapSVG: Unrestricted Upload of File with Dangerous Type vulnerability in PT Norther Lights Production MapSVG…9.9 CriticalN/AN/AOct 19, 2026
CVE-2026-112094: michaelrsweet mxml: A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.65.5 Medium2.0 LowN/AOct 19, 2026
CVE-2026-112093: subhajitkhan online-clinic-management-system: A vulnerability has been found in subhajitkhan online-clinic-management-system up to…4.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-112092: subhajitkhan online-clinic-management-system: A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a5784.3 Medium2.1 LowN/AOct 19, 2026
26-50 of 409174
‹›