The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-93629: Zimbra Zimbra Collaboration Suite: An organizer authentication vulnerability in Zimbra Collaboration Suite (ZCS) allows an unauthenticated email sender to…5.3 MediumN/AN/AOct 23, 2026
CVE-2026-93628: Zimbra Zimbra Collaboration Suite: An attendee authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows an…5.3 MediumN/AN/AOct 23, 2026
CVE-2026-93627: Zimbra Zimbra Collaboration Suite: An organizer authentication vulnerability in the email calendar processing of Zimbra Collaboration Suite (ZCS) allows…5.3 MediumN/AN/AOct 23, 2026
CVE-2026-50053: Zimbra Zimbra Collaboration Suite: A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/*…8.7 HighN/AN/AOct 23, 2026
CVE-2026-10632: Zimbra Zimbra Collaboration Suite: A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an…8.7 HighN/AN/AOct 23, 2026
CVE-2026-115752: SignalK signalk-server: Signal K Server from 2.28.0-beta.2 before 2.34.0 contains a server-side request forgery vulnerability in the App Store…4.2 Medium2.3 LowN/AOct 23, 2026
CVE-2026-115751: agentfront mcp-from-openapi: Agentfront mcp-from-openapi from 2.2.0 before 2.9.0 contains a server-side request forgery vulnerability that allows…3.7 Low6.3 MediumN/AOct 23, 2026
CVE-2026-115750: agentfront mcp-from-openapi: mcp-from-openapi from 2.5.0 before 2.9.0 contains a credential exposure vulnerability that allows attackers to capture…3.7 Low6.3 MediumN/AOct 23, 2026
CVE-2026-115749: hydra-ecosystem hydra-ray-launcher: hydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 contains an arbitrary module import…3.3 Low4.8 MediumN/AOct 23, 2026
CVE-2026-112848: AivahThemes Hostme v2: Deserialization of Untrusted Data vulnerability in AivahThemes Hostme v2 hostmev2 allows Object Injection.This issue…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112849: AivahThemes Hostme v2: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AivahThemes…7.1 HighN/AN/AOct 23, 2026
CVE-2026-112850: AncoraThemes Your Dress: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.1 HighN/AN/AOct 23, 2026
CVE-2026-112854: axiomthemes Holistic Center: Deserialization of Untrusted Data vulnerability in axiomthemes Holistic Center holistic-center allows Object…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112847: ThemeREX ZenSoul: Deserialization of Untrusted Data vulnerability in ThemeREX ZenSoul zensoul allows Object Injection.This issue affects…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112846: ThemeREX Group Save Life: Deserialization of Untrusted Data vulnerability in ThemeREX Group Save Life save-life allows Object Injection.This…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112851: ThemeREX Group HotLock: Deserialization of Untrusted Data vulnerability in ThemeREX Group HotLock hotlock allows Object Injection.This issue…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112852: ThemeREX Group Helion: Deserialization of Untrusted Data vulnerability in ThemeREX Group Helion helion allows Object Injection.This issue…8.1 HighN/AN/AOct 23, 2026
CVE-2026-112853: axiomthemes Hallelujah: Deserialization of Untrusted Data vulnerability in axiomthemes Hallelujah hallelujah allows Object Injection.This issue…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112856: ThemeREX Group Vagabonds: Deserialization of Untrusted Data vulnerability in ThemeREX Group Vagabonds vagabonds allows Object Injection.This…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112857: axiomthemes Reprizo: Deserialization of Untrusted Data vulnerability in axiomthemes Reprizo reprizo allows Object Injection.This issue…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112858: axiomthemes Rhodos: Deserialization of Untrusted Data vulnerability in axiomthemes Rhodos rhodos allows Object Injection.This issue affects…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112859: ThemeREX Group Little Birdies: Deserialization of Untrusted Data vulnerability in ThemeREX Group Little Birdies little-birdies allows Object…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112855: axiomthemes Redy: Deserialization of Untrusted Data vulnerability in axiomthemes Redy redy allows Object Injection.This issue affects…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112863: Hogash KALLYAS: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Hogash KALLYAS…7.1 HighN/AN/AOct 23, 2026
CVE-2026-115730: i18next i18next-http-backend: i18next-http-backend 4.0.2 contains an incomplete fix in interpolateUrl() that allows attackers to redirect translation…3.1 Low2.3 LowN/AOct 23, 2026
51-75 of 545063
‹›