The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-116486: easymock objenesis: Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects…4.5 Medium2.0 LowN/AOct 26, 2026
CVE-2026-116485: huangxd- danmu_api: danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify…9.8 Critical9.3 CriticalN/AOct 26, 2026
CVE-2026-116219: dolibarr: Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that…7.2 High8.6 HighN/AOct 26, 2026
CVE-2026-116218: dolibarr: Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to…7.6 High7.2 HighN/AOct 26, 2026
CVE-2026-116217: francoisjacquet rosariosis: RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in…6.1 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116216: maccmspro, magicblack maccms10: MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows…5.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-116215: maccmspro, magicblack maccms10: MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated…3.1 Low2.3 LowN/AOct 26, 2026
CVE-2026-116214: maccmspro, magicblack maccms10: MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers…9.1 Critical9.3 CriticalN/AOct 26, 2026
CVE-2026-116213: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that…4.9 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-116212: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows…5.4 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-116210: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows…6.5 Medium7.1 HighN/AOct 26, 2026
CVE-2026-116281: n/a Kameleo: A vulnerability was identified in Kameleo up to 5.0.1.263.3 Low4.8 MediumN/AOct 26, 2026
CVE-2026-107157: Qt: Out-of-bounds read vulnerability in QCborValue::fromCbor() impacts Qt Framework.N/A2.0 LowN/AOct 26, 2026
CVE-2026-115196: An Open Redirect vulnerability exists in the public form submission endpoint (/form/submit) of Mautic5.4 MediumN/AN/AOct 26, 2026
CVE-2026-115195: A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table})6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115194: A path traversal vulnerability exists in the Mautic Asset API6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115193: A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 78.2 HighN/AN/AOct 26, 2026
CVE-2026-115192: An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type})7.1 HighN/AN/AOct 26, 2026
CVE-2026-116280: n/a Kameleo: A vulnerability was determined in Kameleo up to 5.0.1.265.5 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-115191: A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax)7.1 HighN/AN/AOct 26, 2026
CVE-2026-115190: An insecure deserialization (PHP object injection) vulnerability exists in Mautic's handling of segment filters and…8.0 HighN/AN/AOct 26, 2026
CVE-2026-115189: A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic8.8 HighN/AN/AOct 26, 2026
CVE-2026-115188: An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 79.9 CriticalN/AN/AOct 26, 2026
CVE-2026-116275: AllenAI AllenNLP: A vulnerability was found in AllenAI AllenNLP up to 2.10.16.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116492: frappe crm: Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged…6.5 Medium7.1 HighN/AOct 26, 2026
26-50 of 546512
‹›