The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-116274: n/a JIZHICMS: A vulnerability has been found in JIZHICMS up to 2.5.64.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116219: dolibarr: Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that…7.2 High8.6 HighN/AOct 26, 2026
CVE-2026-116218: dolibarr: Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to…7.6 High7.2 HighN/AOct 26, 2026
CVE-2026-116217: francoisjacquet rosariosis: RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in…6.1 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116216: maccmspro, magicblack maccms10: MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows…5.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-116215: maccmspro, magicblack maccms10: MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated…3.1 Low2.3 LowN/AOct 26, 2026
CVE-2026-116214: maccmspro, magicblack maccms10: MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers…9.1 Critical9.3 CriticalN/AOct 26, 2026
CVE-2026-116213: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem() that…4.9 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-116212: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows…5.4 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-116210: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows…6.5 Medium7.1 HighN/AOct 26, 2026
CVE-2026-115700: benoitc hackney: Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a…N/A6.9 MediumN/AOct 26, 2026
CVE-2026-115693: benoitc hackney: Improper Certificate Validation vulnerability in hackney_ssl in benoitc hackney allows an on-path attacker to…N/A9.1 CriticalN/AOct 26, 2026
CVE-2026-115269: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit…N/A8.7 HighN/AOct 26, 2026
CVE-2026-115196: URL Redirection to Untrusted Site ('Open Redirect')5.4 MediumN/AN/AOct 26, 2026
CVE-2026-115195: Missing Authorization6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115194: A path traversal vulnerability exists in the Mautic Asset API6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115193: Cross-site Scripting (XSS)8.2 HighN/AN/AOct 26, 2026
CVE-2026-115192: SQL Injection7.1 HighN/AN/AOct 26, 2026
CVE-2026-115191: SQL Injection7.1 HighN/AN/AOct 26, 2026
CVE-2026-115190: Deserialization of Untrusted Data8.0 HighN/AN/AOct 26, 2026
CVE-2026-115189: Improper Neutralization of Special Elements Used in a Template Engine8.8 HighN/AN/AOct 26, 2026
CVE-2026-115188: Code Injection9.9 CriticalN/AN/AOct 26, 2026
CVE-2026-114216: mtrudel bandit: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') vulnerability in the HTTP/1.1 chunked…N/A6.3 MediumN/AOct 26, 2026
CVE-2026-114213: mtrudel bandit: Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel…N/A8.7 HighN/AOct 26, 2026
CVE-2026-113440: benoitc hackney: Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain…N/A6.0 MediumN/AOct 26, 2026
51-75 of 546512
‹›