The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-93630: Zimbra Zimbra Collaboration Suite: A hostname canonicalization vulnerability in the email HTML sanitizers of Zimbra Collaboration Suite (ZCS) allows an…4.3 MediumN/AN/AOct 23, 2026
CVE-2026-55606: openwrt odhcpd: odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt6.5 MediumN/AN/AOct 23, 2026
CVE-2026-53918: openwrt odhcpd: odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrtN/A8.8 HighN/AOct 23, 2026
CVE-2026-53920: openwrt odhcpd: odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrtN/A8.7 HighN/AOct 23, 2026
CVE-2026-115754: yahoo serialize-javascript: serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to…4.7 Medium2.3 LowN/AOct 23, 2026
CVE-2026-53921: openwrt odhcpd: odhcpd is the DHCPv6, DHCPv4, and router-advertisement server used by OpenWrt9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-93629: Zimbra Zimbra Collaboration Suite: An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to…5.3 MediumN/AN/AOct 23, 2026
CVE-2026-93628: Zimbra Zimbra Collaboration Suite: An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an…5.3 MediumN/AN/AOct 23, 2026
CVE-2026-93627: Zimbra Zimbra Collaboration Suite: An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows…5.3 MediumN/AN/AOct 23, 2026
CVE-2026-50053: Zimbra Zimbra Collaboration Suite: A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/*…8.7 HighN/AN/AOct 23, 2026
CVE-2026-10632: Zimbra Zimbra Collaboration Suite: A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an…8.7 HighN/AN/AOct 23, 2026
CVE-2026-115752: SignalK signalk-server: Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store…4.2 Medium2.3 LowN/AOct 23, 2026
CVE-2026-115751: agentfront mcp-from-openapi: Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows…3.7 Low6.3 MediumN/AOct 23, 2026
CVE-2026-115750: agentfront mcp-from-openapi: mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture…3.7 Low6.3 MediumN/AOct 23, 2026
CVE-2026-115749: hydra-ecosystem hydra-ray-launcher: hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import…3.3 Low4.8 MediumN/AOct 23, 2026
CVE-2026-112848: AivahThemes Hostme v2: Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112849: AivahThemes Hostme v2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes…7.1 HighN/AN/AOct 23, 2026
CVE-2026-112850: AncoraThemes Your Dress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.1 HighN/AN/AOct 23, 2026
CVE-2026-112854: axiomthemes Holistic Center: Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112847: ThemeREX ZenSoul: Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112846: ThemeREX Group Save Life: Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112851: ThemeREX Group HotLock: Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112852: ThemeREX Group Helion: Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue…8.1 HighN/AN/AOct 23, 2026
CVE-2026-112853: axiomthemes Hallelujah: Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112856: ThemeREX Group Vagabonds: Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This…9.8 CriticalN/AN/AOct 23, 2026
51-75 of 545063
‹›