The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114605: rthalley dnspython: dnspython is a DNS toolkit for Python7.5 HighN/AN/AOct 22, 2026
CVE-2026-104068: JetBackup: JetBackup plugin for WordPress before 3.1.24.10 contains a symlink-based arbitrary file write vulnerability that allows…7.2 High8.6 HighN/AOct 22, 2026
CVE-2026-54532: CloudPirates-io helm-charts: CloudPirates Open Source Helm Charts is a collection of Helm charts6.9 MediumN/AN/AOct 22, 2026
CVE-2026-94482: vercel next.js: Next.js is a React framework for building full-stack web applicationsN/A8.2 HighN/AOct 22, 2026
CVE-2026-51954: n/a: An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth…N/AN/AN/AOct 22, 2026
CVE-2026-115496: KNIME KNIME Business Hub: Overly informative error messages in the catalog functionality of KNIME Business Hub prior to version 1.18.5 may allow…N/A6.9 MediumN/AOct 22, 2026
CVE-2026-115494: KNIME KNIME Business Hub: A flaw in the cross-site request forgery (CSRF) prevention of KNIME Business Hub prior to version 1.19.0 allows an…N/A5.3 MediumN/AOct 22, 2026
CVE-2026-115482: litespeedtech lsquic: In lsquic before 4.9.0, the HTTP/3 implementation can use an excessive amount of memory because the number of buffered…7.5 HighN/AN/AOct 22, 2026
CVE-2026-115454: KNIME KNIME Business Hub: An excessive resource allocation issue in the remote workflow editing capabilities of KNIME Business Hub prior to…N/A5.3 MediumN/AOct 22, 2026
CVE-2026-115453: MarcosCamara01 Ecommerce Template: Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01…N/A7.1 HighN/AOct 22, 2026
CVE-2026-115450: MarcosCamara01 Ecommerce Template: External Control of Assumed-Immutable Web Parameter (CWE-472) in the cart and checkout flow of MarcosCamara01 Ecommerce…N/A7.1 HighN/AOct 22, 2026
CVE-2026-114603: open-telemetry opentelemetry-python: OpenTelemetry Python provides the Python API and SDK for OpenTelemetry5.3 MediumN/AN/AOct 22, 2026
CVE-2026-114487: Devolutions Server: Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and…N/AN/AN/AOct 22, 2026
CVE-2026-114486: Devolutions Server: Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier…N/AN/AN/AOct 22, 2026
CVE-2026-114485: Devolutions Server: Insufficient protection of sensitive information in the user list endpoint in Devolutions Server 2026.3.10.0 and…N/AN/AN/AOct 22, 2026
CVE-2026-78846: n/a: AiDot Linkind Matter Smart Plug 1.01.32 is vulnerable to Buffer Overflow via SSDP local header parsing.N/AN/AN/AOct 22, 2026
CVE-2026-78801: n/a: An issue in SKYWORTH DIGITAL CO., LTD SK-WR6640X Wi-Fi 6 Dual-Band Fiber Router (AX1800M) V1.0.3 allows a remote…N/AN/AN/AOct 22, 2026
CVE-2026-61791: schorschii OCO-Server: OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile…7.4 HighN/AN/AOct 22, 2026
CVE-2026-16477: MTW CleanShot X: CleanShot X for macOS insecurely deserializes untrusted data embedded in a .cleanshot project file (editable screenshot…N/A8.4 HighN/AOct 22, 2026
CVE-2026-114515: schorschii OCO-Server: OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile…6.5 MediumN/AN/AOct 22, 2026
CVE-2026-114510: stevereiner flexible-graphrag: Flexible GraphRAG is a Python framework for building graph and retrieval-augmented generation applications across…7.1 HighN/AN/AOct 22, 2026
CVE-2026-113872: multer: multer is a middleware for Node.js that handles multipart/form-data file uploads7.5 HighN/AN/AOct 22, 2026
CVE-2026-111181: body-parser: body-parser is body parsing middleware for Node.js and Express7.5 HighN/AN/AOct 22, 2026
CVE-2026-94502: Silicon Labs EmberZNet: In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write…N/A7.5 HighN/AOct 22, 2026
CVE-2026-92709: rsyslog: Rsyslog is a rocket-fast system for log processing8.1 HighN/AN/AOct 22, 2026
26-50 of 416054
‹›