The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-115331: uselotus lotus: Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL…8.8 High8.7 HighN/AOct 22, 2026
CVE-2026-115330: uselotus lotus: Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute…8.8 High8.7 HighN/AOct 22, 2026
CVE-2026-115329: uselotus lotus: Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object()…5.9 Medium6.0 MediumN/AOct 22, 2026
CVE-2026-115328: riclolsen json-scada: JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js…8.8 High8.7 HighN/AOct 22, 2026
CVE-2026-115327: CESNET libyang: libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in…5.3 Medium6.0 MediumN/AOct 22, 2026
CVE-2026-115326: Webkul QloApps: QloApps through 1.7.0 contains an insecure direct object reference vulnerability in…5.4 Medium5.3 MediumN/AOct 22, 2026
CVE-2026-115325: gravitl netmaker: Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows…8.3 High8.7 HighN/AOct 22, 2026
CVE-2026-115324: mem0ai mem0: mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows…8.1 High9.2 CriticalN/AOct 22, 2026
CVE-2026-115323: evershopcommerce evershop: EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows…7.3 High6.9 MediumN/AOct 22, 2026
CVE-2026-115322: bytebase: Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and…4.3 Medium5.3 MediumN/AOct 22, 2026
CVE-2026-115321: bytebase: Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows…4.3 Medium5.3 MediumN/AOct 22, 2026
CVE-2026-115319: junegunn fzf: fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that…2.5 Low2.0 LowN/AOct 22, 2026
CVE-2026-115207: Red Hat: A flaw was found in GNU patch5.5 MediumN/AN/AOct 22, 2026
CVE-2026-114665: zhenorzz goploy: Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare…6.5 Medium7.1 HighN/AOct 22, 2026
CVE-2026-112842: Cozmoslabs Paid Member Subscriptions: Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting…6.5 MediumN/AN/AOct 22, 2026
CVE-2026-112832: CozyThemes Rootblox: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…9.8 CriticalN/AN/AOct 22, 2026
CVE-2026-112822: AmentoTech Workreap Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech…8.5 HighN/AN/AOct 22, 2026
CVE-2026-112820: Elated-Themes Academist Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.1 HighN/AN/AOct 22, 2026
CVE-2026-112313: ACF Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF…7.1 HighN/AN/AOct 22, 2026
CVE-2026-111079: Red Hat: A flaw was found in Goose7.4 HighN/AN/AOct 22, 2026
CVE-2025-71434: Weaver Network Co., Ltd. E-cology: Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the…8.2 High8.8 HighN/AOct 22, 2026
CVE-2024-58394: Retool: Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute…6.1 Medium5.1 MediumN/AOct 22, 2026
CVE-2024-58393: i-Netsolution Readymade Unilevel Ecommerce MLM: i-Netsolution Readymade Unilevel Ecommerce MLM (2024-03-15 build) contains an SQL injection vulnerability that allows…8.2 High8.8 HighN/AOct 22, 2026
CVE-2023-54413: OnTheGoSystems WPML Multilingual CMS: WPML Multilingual CMS plugin for WordPress before 4.6.1 contains a reflected cross-site scripting vulnerability that…6.1 Medium5.1 MediumN/AOct 22, 2026
CVE-2022-51024: Kareadita Kavita: Kavita 0.5.2 before 0.5.4.1 contains a path traversal vulnerability that allows unauthenticated attackers to read…7.5 High8.7 HighN/AOct 22, 2026
751-775 of 413321
‹›