The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2021-48014: FanRuan FineReport: FineReport 9.0 contains a path traversal vulnerability in the /WebReport/ReportServer design_save_svg operation that…9.8 Critical9.3 Critical2%Oct 22, 2026
CVE-2021-48013: Weaver Network Co., Ltd. E-cology: Weaver E-cology 8.0 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary…7.5 High8.7 High1%Oct 22, 2026
CVE-2020-37284: midgetspy Sickbeard: Sickbeard through build-507 contains a reflected cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2019-25779: WooThemes Diarise: WooThemes Diarise through 1.5.9 contains a file read vulnerability that allows unauthenticated attackers to read…7.5 High8.7 High0%Oct 22, 2026
CVE-2019-25778: SeaCMS: SeaCMS through 8.7 contains an unauthenticated SQL injection vulnerability that allows remote attackers to manipulate…8.2 High8.8 High0%Oct 22, 2026
CVE-2018-25439: MetInfo: MetInfo CMS 6.0.0 before 6.1.1 contains a path traversal vulnerability in /include/thumb.php that allows…7.5 High8.7 High0%Oct 22, 2026
CVE-2018-25438: Intermesh Group-Office: Intermesh Group-Office 3.3.0 before 3.5.5 contains an unauthenticated path traversal vulnerability in compress.php that…7.5 High8.7 High1%Oct 22, 2026
CVE-2017-20290: Discourse: Discourse 1.9.0.beta2 before 1.9.0.beta13 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2017-20289: Broadstreet Ad Widget: Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that…7.5 High7.7 High1%Oct 22, 2026
CVE-2017-20288: QCubed: QCubed 2.2.0 through 3.1.1 contains a reflected cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2017-20287: Javo Themes Javo Spot: Javo Spot theme for WordPress before 3.0.0 contains a path traversal vulnerability that allows unauthenticated…7.5 High8.7 High0%Oct 22, 2026
CVE-2026-114348: webpack-dev-server: webpack-dev-server is a development server that provides live reloading for webpack projects5.3 MediumN/A0%Oct 22, 2026
CVE-2026-112085: webpack-dev-server: webpack-dev-server is a development server that provides live reloading for webpack projects8.2 HighN/A0%Oct 22, 2026
CVE-2026-106017: OpenVPN OpenVPN 3 Core Library: Improper certificate validation in the OpenVPN 3 Core library version 3.4 through 3.11.7 allows attackers to circumvent…N/A6.3 Medium0%Oct 22, 2026
CVE-2026-96293: WatchGuard WatchGuard Agent: A cleartext storage of sensitive information vulnerability in WatchGuard Endpoint Security's Full Disk Encryption…N/A6.9 Medium0%Oct 22, 2026
CVE-2026-93471: handnot2, arekinath, dropbox esaml: Improper Handling of Highly Compressed Data (Data Amplification) in esaml_binding in dropbox esaml allows an…N/A8.7 High0%Oct 22, 2026
CVE-2026-86696: handnot2, arekinath, dropbox esaml: Allocation of Resources Without Limits or Throttling vulnerability in esaml in dropbox esaml allows an unauthenticated…N/A8.2 High0%Oct 22, 2026
CVE-2026-21812: HCL Software AppScan Integration with Azure Boards for ASoC & A360: HCL AppScan Azure Boards Plugin is affected by a Cleartext Transmission of Sensitive Information vulnerability when…2.2 LowN/A0%Oct 22, 2026
CVE-2026-21811: HCL Software AppScan Integration with Azure Boards for ASoC & A360: HCL AppScan Azure Boards Plugin is potentially affected by an Information Disclosure vulnerability involving secrets…3.8 LowN/A0%Oct 22, 2026
CVE-2026-115253: WatchGuard WatchGuard Agent: An incorrect permission assignment vulnerability in the WatchGuard Agent's log directory allows a local, authenticated…N/A7.3 High0%Oct 22, 2026
CVE-2026-114703: hupe13 Extensions for Leaflet Map: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in hupe13 Extensions…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114702: nicdark ND Shortcodes For Visual Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114701: xootix Waitlist Woocommerce ( Back in stock notifier ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114700: Gloriafood Restaurant Menu – Food Ordering System – Table Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gloriafood…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114699: yoomoney ЮKassa для WooCommerce: Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly…5.3 MediumN/A0%Oct 22, 2026
851-875 of 413119
‹›