The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-112007: schismtracker Schism Tracker: Schism Tracker through 20260524 contains a heap out-of-bounds write vulnerability in fmt_ult_load_song() in fmt/ult.c…6.1 Medium6.9 MediumN/AOct 18, 2026
CVE-2026-112006: OpenTelemetry opentelemetry-exporter-otlp-proto-http: OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 before 1.45.0 contains an improper certificate validation…6.5 Medium8.3 HighN/AOct 18, 2026
CVE-2026-112005: clidey whodb: WhoDB 0.104.0 before 0.135.0 contains a path traversal vulnerability that allows remote attackers to read and write…7.7 High9.2 CriticalN/AOct 18, 2026
CVE-2026-112004: teableio teable: Teable before 2026-10-12T12-45-53Z.3331 contains an authorization bypass vulnerability that allows authenticated users…3.1 Low2.3 LowN/AOct 18, 2026
CVE-2026-112003: ProjectSend: ProjectSend 2.0.0 before 2.7.0 contains a path validation flaw in OrphanFileScanner::isOrphan() that allows staff with…5.9 Medium6.0 MediumN/AOct 18, 2026
CVE-2026-112002: ProjectSend: ProjectSend 2.5.0 before 2.7.0 contains an unverified password change vulnerability in PasswordController::update()…6.8 Medium7.6 HighN/AOct 18, 2026
CVE-2026-112001: ProjectSend: ProjectSend 2.0.0 before 2.7.0 contains an incorrect authorization vulnerability that allows restricted API token…7.2 High8.6 HighN/AOct 18, 2026
CVE-2026-112000: vanus-labs vanus: Vanus 0.8.0 through 0.9.0 contains a missing authorization vulnerability in the gateway that allows any authenticated…7.6 High7.2 HighN/AOct 18, 2026
CVE-2026-111999: vanus-labs vanus: Vanus 0.8.0 through 0.9.0 contains a missing authentication vulnerability that allows unauthenticated remote attackers…7.5 High8.7 HighN/AOct 18, 2026
CVE-2026-111998: vanus-labs vanus: Vanus 0.8.0 through 0.9.0 contains a default credentials vulnerability that allows unauthenticated remote attackers to…9.8 Critical9.3 CriticalN/AOct 18, 2026
CVE-2026-111985: AUTOMATIC1111 stable-diffusion-webui: A vulnerability was found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.14.3 Medium2.1 LowN/AOct 18, 2026
CVE-2026-111984: AUTOMATIC1111 stable-diffusion-webui: A vulnerability has been found in AUTOMATIC1111 stable-diffusion-webui up to 1.10.14.3 Medium2.1 LowN/AOct 18, 2026
CVE-2026-110897: IdeaBox Creations PowerPack Lite for Beaver Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in IdeaBox Creations…7.1 HighN/AN/AOct 18, 2026
CVE-2026-110895: DevItems Support Genix: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in DevItems Support…8.5 HighN/AN/AOct 18, 2026
CVE-2026-110886: QuantumCloud Conversational Forms for ChatBot: Deserialization of Untrusted Data vulnerability in QuantumCloud Conversational Forms for ChatBot conversational-forms…9.8 CriticalN/AN/AOct 18, 2026
CVE-2026-110885: HivePress: Improper Control of Generation of Code ('Code Injection') vulnerability in HivePress HivePress hivepress allows Code…6.5 MediumN/AN/AOct 18, 2026
CVE-2026-110883: VideoWhisper.com 2Way VideoCalls and Random Chat: Authentication Bypass by Primary Weakness vulnerability in VideoWhisper.com 2Way VideoCalls and Random Chat…6.5 MediumN/AN/AOct 18, 2026
CVE-2026-110880: Kit Kit (formerly ConvertKit): Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly…6.5 MediumN/AN/AOct 18, 2026
CVE-2026-110383: WP E-Signature Electronic Signature Add-on for Fluent Forms: Authorization Bypass Through User-Controlled Key vulnerability in WP E-Signature Electronic Signature Add-on for Fluent…7.5 HighN/AN/AOct 18, 2026
CVE-2026-110382: NSquared Simply Schedule Appointments: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NSquared Simply…7.1 HighN/AN/AOct 18, 2026
CVE-2026-110373: Hamid Alinia Login with phone number: Incorrect Privilege Assignment vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows…8.1 HighN/AN/AOct 18, 2026
CVE-2026-110372: Brainstorm Force OttoKit: Incorrect Privilege Assignment vulnerability in Brainstorm Force OttoKit suretriggers allows Privilege Escalation.This…9.8 CriticalN/AN/AOct 18, 2026
CVE-2026-110365: WPExperts Advanced File Manager: Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced allows Exploiting…6.5 MediumN/AN/AOct 18, 2026
CVE-2026-109895: Arraytics Booktics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Arraytics…7.1 HighN/AN/AOct 18, 2026
CVE-2026-109894: Arraytics Booktics: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics…9.3 CriticalN/AN/AOct 18, 2026
476-500 of 406803
‹›