The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-94135: Apache Software Foundation Apache Airflow SFTP provider: The Apache Airflow SFTP provider's deferrable code paths (`SFTPTrigger`, `SFTPHookAsync`, `SFTPClientPool`) disable SSH…4.3 MediumN/A0%Oct 15, 2026
CVE-2026-94134: Apache Software Foundation: The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or…9.1 CriticalN/A0%Oct 15, 2026
CVE-2026-92228: Apache Software Foundation Apache Airflow Keycloak provider: The Apache Airflow Keycloak provider's multi-team provisioning (`_attach_team_permissions`) granted every team role…6.5 MediumN/A0%Oct 15, 2026
CVE-2026-111369: ClassroomIO: ClassroomIO through 1.0.0 contains an incorrect authorization vulnerability in the PUT and DELETE /:lessonId lesson…7.1 High7.1 High0%Oct 15, 2026
CVE-2026-111368: ClassroomIO: ClassroomIO through 1.0.0 contains an insecure direct object reference vulnerability in the Hono API course submission…6.4 Medium6.1 Medium0%Oct 15, 2026
CVE-2026-111367: Use of Default Cryptographic Key6.5 Medium6.9 Medium0%Oct 15, 2026
CVE-2026-111366: cool-team-official cool-admin-midway: cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows department-limited admins to…7.2 High8.6 High0%Oct 15, 2026
CVE-2026-111365: cool-team-official cool-admin-midway: cool-admin-midway through 8.0.0 contains an authorization bypass vulnerability that allows non-superadmin admins to…6.0 Medium7.0 High0%Oct 15, 2026
CVE-2026-111364: mindoc-org MinDoc: MinDoc through 2.2-beta.2 contains an insecure direct object reference vulnerability in DocumentController.Content that…6.5 Medium7.1 High0%Oct 15, 2026
CVE-2026-111363: dataelement bisheng: BISHENG through 3.0.0-beta4 contains an insecure direct object reference vulnerability that allows authenticated…6.5 Medium7.1 High0%Oct 15, 2026
CVE-2026-111359: Authorization Bypass Through User-Controlled Key7.1 High7.1 High0%Oct 15, 2026
CVE-2026-111358: mettle sendportal-core: SendPortal sendportal-core through 4.0.1 contains an authorization bypass vulnerability that allows authenticated…5.4 Medium5.3 Medium0%Oct 15, 2026
CVE-2026-111356: magicblack MacCMS: MacCMS v10 through 2026.1000.4056 does not limit attempts on the six-digit password recovery code, allowing…7.4 High9.1 Critical0%Oct 15, 2026
CVE-2026-111355: zhontai Admin.Core: zhontai Admin.Core through 10.1.0 contains an authorization bypass vulnerability that allows authenticated users to…6.3 Medium5.3 Medium0%Oct 15, 2026
CVE-2026-111354: crmeb crmeb_java: crmeb_java through 3.1 contains an authorization bypass vulnerability that allows authenticated members to read other…3.1 Low2.3 Low0%Oct 15, 2026
CVE-2026-111353: Missing Authorization4.3 Medium5.3 Medium0%Oct 15, 2026
CVE-2026-111352: Incorrect Authorization8.8 High8.7 High0%Oct 15, 2026
CVE-2026-111351: metasfresh: metasfresh through 5.175 contains a missing record-level authorization vulnerability in BoardRestController that allows…4.2 Medium2.3 Low0%Oct 15, 2026
CVE-2026-111350: Papermark: Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows…5.0 Medium2.3 Low0%Oct 15, 2026
CVE-2026-111349: puemos Craftplan: Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows…5.3 Medium6.9 Medium0%Oct 15, 2026
CVE-2026-111348: Authorization Bypass Through User-Controlled Key5.4 Medium5.3 Medium0%Oct 15, 2026
CVE-2026-111347: opsre go-ldap-admin: go-ldap-admin through 0.6.2 embeds a hard-coded RSA private key, published in the public repository, that protects…5.9 Medium8.2 High0%Oct 15, 2026
CVE-2026-111346: easysoft zentaopms: ZenTao PMS through 22.6 contains an authorization bypass vulnerability in action::editComment that allows authenticated…5.4 Medium5.3 Medium0%Oct 15, 2026
CVE-2026-111345: polonel trudesk: Trudesk through 1.2.11 contains an authorization bypass vulnerability that allows any authenticated user to read…4.3 Medium5.3 Medium0%Oct 15, 2026
CVE-2026-111344: apitable: APITable through 1.14.0-beta contains an authorization bypass vulnerability that allows authenticated users to read…4.3 Medium5.3 Medium0%Oct 15, 2026
576-600 of 408260
‹›