The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-51954: n/a: An issue in Webasyst Framework 4.0.3 and before allows a remote attacker to execute arbitrary code via a crafted OAuth…N/AN/A1%Oct 22, 2026
CVE-2026-115453: MarcosCamara01 Ecommerce Template: Authorization Bypass Through User-Controlled Key (CWE-639) in the cart and wishlist repositories of MarcosCamara01…N/A7.1 High0%Oct 22, 2026
CVE-2026-114487: Devolutions Server: Missing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0 through 2026.3.10.0 and…N/AN/A0%Oct 22, 2026
CVE-2026-114486: Devolutions Server: Incorrect authorization in the Devolutions Gateway token generation in Devolutions Server 2026.3.10.0 and earlier…N/AN/A0%Oct 22, 2026
CVE-2026-115334: uselotus lotus: Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows…6.8 Medium7.6 High0%Oct 22, 2026
CVE-2026-115325: gravitl netmaker: Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows…8.3 High8.7 High0%Oct 22, 2026
CVE-2026-115323: evershopcommerce evershop: EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows…7.3 High6.9 Medium0%Oct 22, 2026
CVE-2026-115322: bytebase: Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and…4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-115321: bytebase: Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows…4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-112842: Cozmoslabs Paid Member Subscriptions: Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114699: yoomoney ЮKassa для WooCommerce: Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114698: myCred: Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-114696: miniOrange Page Restriction WordPress (WP): Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-112312: ACF Extended: Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured…7.5 HighN/A0%Oct 22, 2026
CVE-2026-112218: Ahmad Majestic Support: Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-111842: WP Sunshine Sunshine Photo Cart: Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-110894: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-110893: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114182: IdeaBox Creations PowerPack Addons for Elementor: Missing Authorization vulnerability in IdeaBox Creations PowerPack Addons for Elementor powerpack-lite-for-elementor…4.3 MediumN/A0%Oct 22, 2026
CVE-2026-114180: Wpmet Metform: Missing Authorization vulnerability in Wpmet Metform metform allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114175: DigitalME eRoom: Missing Authorization vulnerability in DigitalME eRoom eroom-zoom-meetings-webinar allows Exploiting Incorrectly…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-112843: WP Chill Strong Testimonials: Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly…4.3 MediumN/A0%Oct 22, 2026
CVE-2026-112826: eLightUp Falcon – WordPress Optimizations & Tweaks: Missing Authorization vulnerability in eLightUp Falcon – WordPress Optimizations & Tweaks falcon allows Exploiting…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-111847: Kings Plugins MarketKing: Missing Authorization vulnerability in Kings Plugins MarketKing marketking-multivendor-marketplace-for-woocommerce…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-114223: NewType Infortech NT OneAPP: NT OneAPP developed by NewType Infortech has an Exposure of Sensitive Information vulnerability5.5 Medium6.7 Medium0%Oct 22, 2026
51-75 of 12125
‹›