The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-102785: yootheme.com YOOtheme Pro extension for Joomla: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s…N/A10.0 Critical1%Oct 22, 2026
CVE-2026-13411: Mattermost: Mattermost versions 11.7.x <= 11.7.11 fail to validate null elements when decoding playbook import conditions which…4.3 MediumN/A0%Oct 22, 2026
CVE-2026-115334: uselotus lotus: Lotus through 0.10.2 contains an authorization bypass vulnerability in ChangeUserOrganizationView.post that allows…6.8 Medium7.6 High0%Oct 22, 2026
CVE-2026-115333: uselotus lotus: Lotus through 0.10.2 contains an improper authentication vulnerability in the Go event ingestion middleware that…5.9 Medium8.2 High0%Oct 22, 2026
CVE-2026-115332: uselotus lotus: Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL…8.8 High8.7 High0%Oct 22, 2026
CVE-2026-115331: uselotus lotus: Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to inject SQL…8.8 High8.7 High0%Oct 22, 2026
CVE-2026-115330: uselotus lotus: Lotus through 0.10.2 contains an sql injection vulnerability that allows authenticated organization users to execute…8.8 High8.7 High0%Oct 22, 2026
CVE-2026-115329: uselotus lotus: Lotus through 0.10.2 contains an insecure direct object reference vulnerability in SubscriptionViewSet.get_object()…5.9 Medium6.0 Medium0%Oct 22, 2026
CVE-2026-115328: riclolsen json-scada: JSON-SCADA before 0.65-alpha contains an sql injection vulnerability in opcApi() in src/server_realtime_auth/index.js…8.8 High8.7 High0%Oct 22, 2026
CVE-2026-115327: CESNET libyang: libyang through 6.4.13 contains an uninitialized pointer free vulnerability in lydxml_env_netconf_rpc() in…5.3 Medium6.0 Medium0%Oct 22, 2026
CVE-2026-115326: Webkul QloApps: QloApps through 1.7.0 contains an insecure direct object reference vulnerability in…5.4 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-115325: gravitl netmaker: Netmaker through 1.7.0 contains an authorization bypass vulnerability in the updateExtClient handler that allows…8.3 High8.7 High0%Oct 22, 2026
CVE-2026-115324: mem0ai mem0: mem0 0.1.117 before 1.0.8 contains an sql injection vulnerability in mem0/vector_stores/databricks.py that allows…8.1 High9.2 Critical0%Oct 22, 2026
CVE-2026-115323: evershopcommerce evershop: EverShop 1.2.2 before 2.2.1 contains a missing authorization vulnerability in the customer address API that allows…7.3 High6.9 Medium0%Oct 22, 2026
CVE-2026-115322: bytebase: Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and…4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-115321: bytebase: Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows…4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-115319: junegunn fzf: fzf 0.36.0 through 0.74.5 contains an inefficient algorithmic complexity vulnerability in maskActionContents that…2.5 Low2.0 Low0%Oct 22, 2026
Red Hat: CVE-2026-115207: patch: Filename validation bypass in reversal fallback allows file creation outside the working directory5.5 MediumN/A0%Oct 22, 2026
CVE-2026-114665: zhenorzz goploy: Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare…6.5 Medium7.1 High0%Oct 22, 2026
CVE-2026-112842: Cozmoslabs Paid Member Subscriptions: Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-112832: CozyThemes Rootblox: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…9.8 CriticalN/A0%Oct 22, 2026
CVE-2026-112822: AmentoTech Workreap Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech…8.5 HighN/A0%Oct 22, 2026
CVE-2026-112820: Elated-Themes Academist Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.1 HighN/A0%Oct 22, 2026
CVE-2026-112313: ACF Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF…7.1 HighN/A0%Oct 22, 2026
Red Hat: CVE-2026-111079: goose: goose: Shell History and Environment Leak via Terminal Integration7.4 HighN/A0%Oct 22, 2026
826-850 of 530113
‹›