The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113872: multer: multer is a middleware for Node.js that handles multipart/form-data file uploads7.5 HighN/A0%Oct 22, 2026
CVE-2026-111181: body-parser: body-parser is body parsing middleware for Node.js and Express7.5 HighN/A0%Oct 22, 2026
CVE-2026-94502: Silicon Labs EmberZNet: In EmberZNet 9.1.1 and earlier, a malformed Publish Price Matrix command can result in an out-of-bounds write…N/A7.5 High0%Oct 22, 2026
Amazon Linux AMI 2: CVE-2026-92709: Security patch for rsyslog (ALAS-2026-3967)8.1 HighN/A0%Oct 22, 2026
CVE-2026-89410: Silicon Labs Z-Wave SDK: In Z-Wave SDK 8.1.1 and earlier, a malformed NCP SPI command can trigger out-of-bounds reads that leak sensitive…N/A5.1 Medium0%Oct 22, 2026
CVE-2026-89409: Silicon Labs Z-Wave SDK: In Z-Wave SDK 8.1.1 and earlier (for 700/800 series devices) and 6.85.02 and earlier (for 500 series devices), missing…N/A5.3 Medium0%Oct 22, 2026
CVE-2026-85080: Silicon Labs EmberZNet: In EmberZNet 9.1.1 and earlier, a malformed GetGroupMembership message can result in an out-of-bounds write leading to…N/A6.0 Medium0%Oct 22, 2026
CVE-2026-85079: Silicon Labs EmberZNet: In EmberZNet 9.1.1 and earlier, a malformed Simple_Desc_req response can result in an out-of-bounds write potentially…N/A7.5 High0%Oct 22, 2026
CVE-2026-66282: Silicon Labs EmberZNet: In EmberZNet 9.1.1 and earlier, a malformed Publish Billing Period command can result in a recursive function call that…N/A6.0 Medium0%Oct 22, 2026
CVE-2026-66281: Silicon Labs EmberZNet: In EmberZNet 9.1.1 and earlier, a malformed Discover Attributes command can result in a loop with unreachable exit…N/A6.0 Medium0%Oct 22, 2026
CVE-2026-66279: Silicon Labs Connect SDK: In Connect SDK 4.3.1 and earlier and Flex SDK 3.7.7 and earlier, a message with invalid security settings may bypass…N/A7.2 High0%Oct 22, 2026
CVE-2026-115411: crawlseo: crawlseo before version 0.2.4 contains a server-side request forgery vulnerability in its crawler engine where…5.0 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-115400: crawlseo: crawlseo before version 0.2.5 contains a cleartext storage vulnerability that allows attackers with database read…4.4 Medium6.7 Medium0%Oct 22, 2026
CVE-2026-115249: subhajitkhan online-clinic-management-system: A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a5784.6 Medium2.0 Low0%Oct 22, 2026
CVE-2026-115248: subhajitkhan online-clinic-management-system: A vulnerability was detected in subhajitkhan online-clinic-management-system up to…5.4 Medium2.1 Low0%Oct 22, 2026
CVE-2026-115247: subhajitkhan online-clinic-management-system: A security vulnerability has been detected in subhajitkhan online-clinic-management-system up to…4.3 Medium2.1 Low0%Oct 22, 2026
CVE-2026-113582: Apache Software Foundation Apache Abdera: UNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to…7.5 High8.7 High0%Oct 22, 2026
CVE-2026-111497: Google Brotli: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on…N/A9.2 Critical0%Oct 22, 2026
CVE-2026-107079: n/a: An issue in Systrome Validation & Certification 1.0 allows an attacker to cause a denial of service via the t URL…N/AN/A0%Oct 22, 2026
CVE-2026-115246: subhajitkhan online-clinic-management-system: A weakness has been identified in subhajitkhan online-clinic-management-system up to…3.5 Low2.0 Low0%Oct 22, 2026
CVE-2026-102785: yootheme.com YOOtheme Pro extension for Joomla: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s…N/A10.0 Critical1%Oct 22, 2026
CVE-2026-13411: Mattermost: Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which…4.3 MediumN/A0%Oct 22, 2026
CVE-2026-115334: uselotus lotus: Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows…6.8 Medium7.6 High0%Oct 22, 2026
CVE-2026-115333: uselotus lotus: Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that…5.9 Medium8.2 High0%Oct 22, 2026
CVE-2026-115332: uselotus lotus: Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL…8.8 High8.7 High0%Oct 22, 2026
801-825 of 530113
‹›