The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120427: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated…4.3 Medium5.3 MediumN/ANov 2, 2026
CVE-2026-120426: OpenCSG CSGHub: OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve…7.5 High8.7 HighN/ANov 2, 2026
CVE-2026-120425: munafio Chatify: Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that…6.5 Medium7.1 HighN/ANov 2, 2026
CVE-2026-120318: Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing…7.2 High8.6 HighN/ANov 2, 2026
CVE-2026-118052: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without…N/A6.8 MediumN/ANov 2, 2026
CVE-2025-71450: benhoyt inih: inih before r63 contains a one-byte stack buffer under-read in ini_parse_stream() in ini.c that allows attackers to…3.3 Low4.8 MediumN/ANov 2, 2026
CVE-2025-62819: n/a: Keyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a client certificate via…N/AN/AN/ANov 2, 2026
CVE-2026-115654: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager's thread-control services do not check that…N/A6.9 MediumN/ANov 2, 2026
CVE-2026-115653: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the PendSV handler of the Cortex-M module ports saves a…N/A7.0 HighN/ANov 2, 2026
CVE-2026-114408: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX NetX Duo versions 6.4.5.202504 through 6.5.2.202603a, built with IPv6 path MTU discovery, the ICMPv6…N/A8.7 HighN/ANov 2, 2026
CVE-2026-74993: Starnet Computer and Network Systems Inventory Tracking Application: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer…7.5 HighN/AN/ANov 2, 2026
CVE-2026-120463: sassanix Warracker: Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an…6.5 Medium6.0 MediumN/ANov 2, 2026
CVE-2026-114364: Apache Software Foundation Apache Syncope: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-113687: Apache Software Foundation Apache Syncope: Improper isolation or compartmentalization vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-113511: Apache Software Foundation Apache Syncope: Authorization bypass through User-Controlled key vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-111959: Apache Software Foundation Apache Arrow Rust: Out-of-bounds read vulnerability in Apache Arrow Rust (`arrow` crate), from version 33.0.0 through to versions 57.3.1,…N/AN/AN/ANov 2, 2026
CVE-2026-110535: Apache Software Foundation Apache Syncope: Improper Privilege Management vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-109083: Apache Software Foundation Apache Syncope: Improper isolation or compartmentalization vulnerability in Apache SyncopeN/AN/AN/ANov 2, 2026
CVE-2026-105602: joomshaper.com Helix Ultimate extension for Joomla: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Mega Menu Badge Text in Helix Ultimate <…N/A8.6 HighN/ANov 2, 2026
CVE-2026-105601: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - Reflected XSS in StageIt 1.0-5.7.5, 6.0-6.3.5N/A5.3 MediumN/ANov 2, 2026
CVE-2026-105600: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5N/A8.6 HighN/ANov 2, 2026
CVE-2026-103420: php-web-design.com StageIt extension for Joomla: Joomla Extension - php-web-design.com - CSRF for various actions in StageIt 1.0-5.7.5, 6.0-6.3.5N/A7.2 HighN/ANov 2, 2026
CVE-2026-103419: joomshaper.com Helix Ultimate extension for Joomla: Joomla Extension - joomshaper.com - Stored Cross-Site Scripting (XSS) in Media Picker in Helix Ultimate < 2.2.11.N/A8.6 HighN/ANov 2, 2026
CVE-2026-102802: regularlabs.com: Joomla Extension - regularlabs.com - PHP code injection vector in Sourcerer extension < 17.0.1 when used with Articles…N/A8.9 HighN/ANov 2, 2026
CVE-2026-102801: regularlabs.com: Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere…N/A5.1 MediumN/ANov 2, 2026
51-75 of 574114
‹›