The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-109812: Moxa AIG-302 Series: A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial…N/A6.9 Medium0%Oct 16, 2026
CVE-2026-105228: Deltaww ISPSoft: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.N/A7.0 High0%Oct 16, 2026
CVE-2026-105227: Deltaww ISPSoft: This vulnerability allows remote attackers to disclose sensitive information on affected installations of Delta ISPSoft.N/A7.0 High0%Oct 16, 2026
CVE-2026-100159: ays-pro: The Popup Box plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions 6.4.1 to 6.4.24.8 MediumN/A0%Oct 16, 2026
CVE-2026-92777: Lenovo: A potential vulnerability was reported in some Lenovo Tablets that could allow a user with physical access to an…6.4 Medium5.4 Medium0%Oct 16, 2026
CVE-2026-92629: Lenovo Baiying PC Client: A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in…7.3 High7.0 High0%Oct 16, 2026
CVE-2026-89062: Lenovo Energy Management Driver: A potential out-of-bounds write vulnerability was reported in the Lenovo Energy Management driver that could allow a…5.5 Medium6.8 Medium0%Oct 16, 2026
CVE-2026-89057: Lenovo: A potential authentication bypass vulnerability was reported in some Lenovo tablets that could allow a user with…6.8 Medium7.0 High0%Oct 16, 2026
CVE-2026-84823: Red Hat: A flaw was found in WildFly7.1 HighN/A0%Oct 16, 2026
CVE-2026-75941: Lenovo Legion Zone Application: A potential vulnerability was reported in the Lenovo Legion Zone application, distributed exclusively in the Chinese…8.0 High8.6 High0%Oct 16, 2026
CVE-2026-16755: Lenovo: A potential vulnerability was reported in Lenovo Smart Camera C33, distributed exclusively in the Chinese market, that…5.3 Medium6.0 Medium0%Oct 16, 2026
CVE-2026-16754: Lenovo: A potential improper certificate validation vulnerability was reported in Lenovo Smart Camera C33, distributed…4.8 Medium5.9 Medium0%Oct 16, 2026
CVE-2026-111210: n/a bitcoinj: A vulnerability was determined in bitcoinj up to 0.177.3 High5.5 Medium0%Oct 16, 2026
CVE-2026-8311: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 15, 2026
CVE-2026-5819: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 15, 2026
CVE-2026-2937: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 15, 2026
CVE-2026-107316: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 15, 2026
CVE-2026-107172: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 15, 2026
CVE-2025-3778: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 15, 2026
CVE-2026-96806: Apache Software Foundation Apache Airflow Keycloak provider: The Apache Airflow Keycloak auth manager did not end the session on logout: the logout route revoked the presented…5.8 MediumN/A0%Oct 15, 2026
CVE-2026-94135: Apache Software Foundation Apache Airflow SFTP provider: The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH…4.3 MediumN/A0%Oct 15, 2026
CVE-2026-94134: Apache Software Foundation: The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or…9.1 CriticalN/A0%Oct 15, 2026
CVE-2026-92228: Apache Software Foundation Apache Airflow Keycloak provider: The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role…6.5 MediumN/A0%Oct 15, 2026
CVE-2026-111369: ClassroomIO: ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson…7.1 High7.1 High0%Oct 15, 2026
CVE-2026-111368: ClassroomIO: ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission…6.4 Medium6.1 Medium0%Oct 15, 2026
501-525 of 412906
‹›