The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114404: PHPOffice PHPPresentation: PHPOffice PHPPresentation 1.2.0 contains a cross-site scripting vulnerability in the HTML writer that allows attackers…6.1 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114403: PHPOffice PHPPresentation: PHPOffice PHPPresentation through 1.2.0 contains an insecure deserialization vulnerability that allows attackers to…8.1 High9.2 CriticalN/AOct 21, 2026
CVE-2026-114402: polonel trudesk: Trudesk through 1.2.11 contains a path traversal and authorization bypass vulnerability in…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114401: polonel trudesk: Trudesk through 1.2.11 contains a regular expression injection vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114400: polonel trudesk: Trudesk through 1.2.11 contains a missing authentication vulnerability that allows unauthenticated attackers to…5.9 Medium8.2 HighN/AOct 21, 2026
CVE-2026-114399: polonel trudesk: Trudesk through 1.2.11 contains a path traversal vulnerability that allows administrators to delete arbitrary files by…6.5 Medium7.0 HighN/AOct 21, 2026
CVE-2026-114398: polonel trudesk: Trudesk through 1.2.11 contains an unrestricted file upload vulnerability that allows any authenticated user to place…5.4 Medium5.1 MediumN/AOct 21, 2026
CVE-2026-114397: polonel trudesk: Trudesk through 1.2.11 contains a missing authentication vulnerability in debug routes enabled whenever NODE_ENV is…7.4 High8.3 HighN/AOct 21, 2026
CVE-2026-114396: polonel trudesk: Trudesk through 1.2.11 contains a server-side JavaScript injection vulnerability that allows authenticated users to…7.1 High7.1 HighN/AOct 21, 2026
CVE-2026-114395: polonel trudesk: Trudesk through 1.2.11 contains an authorization bypass vulnerability in apiMessages.send that allows authenticated…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114394: polonel trudesk: Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to post content…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114393: polonel trudesk: Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to modify…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114392: polonel trudesk: Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows authenticated users to read tickets…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114391: easysoft zentaopms: ZenTao PMS before 22.3 contains an authorization bypass vulnerability in commonModel::isOpenMethod() that lets…7.1 High7.1 HighN/AOct 21, 2026
CVE-2026-114390: chamilo chamilo-lms: Chamilo LMS from 2.0.0-alpha.1 before 2.0.0-RC.3 contains a missing authorization vulnerability in legacy AJAX handlers…5.3 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114389: chamilo chamilo-lms: Chamilo LMS from 2.0.0-alpha.4 before 2.0.0-RC.3 contains a missing authorization vulnerability in…4.3 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-114388: chamilo chamilo-lms: Chamilo LMS 2.0.0 pre-releases from 2.0.0-alpha.1 before 2.0.0-RC.3 contain a missing access control vulnerability in…5.3 Medium6.9 MediumN/AOct 21, 2026
CVE-2026-114387: shopperlabs shopper: Shopper from 2.0.0 before 2.6.0 contains a missing authorization vulnerability that allows admin-panel users holding…8.8 High8.7 HighN/AOct 21, 2026
CVE-2026-114386: pydantic pydantic-ai-harness: Pydantic AI Harness before 0.59.0 fails to enforce UsageLimits.tool_calls_limit on nested tool calls dispatched from…4.8 Medium6.3 MediumN/AOct 21, 2026
CVE-2026-114248: dhikshitha29 Insurance-Management-System: A security vulnerability has been detected in dhikshitha29 Insurance-Management-System…5.3 Medium5.5 MediumN/AOct 21, 2026
CVE-2026-114245: dhikshitha29 Insurance-Management-System: A weakness has been identified in dhikshitha29 Insurance-Management-System…7.3 High5.5 MediumN/AOct 21, 2026
CVE-2026-114243: dhikshitha29 Insurance-Management-System: A security flaw has been discovered in dhikshitha29 Insurance-Management-System…7.3 High5.5 MediumN/AOct 21, 2026
CVE-2026-114120: WPDeveloper SchedulePress: SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level…5.4 Medium5.3 MediumN/AOct 21, 2026
CVE-2026-111849: Magepeople inc. WpTravelly: Missing Authorization vulnerability in Magepeople inc5.3 MediumN/AN/AOct 21, 2026
CVE-2026-81755: Apache Software Foundation Apache bRPC: Uncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote…N/AN/AN/AOct 21, 2026
551-575 of 414140
‹›