The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111929: coder: Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile…5.3 Medium6.0 Medium0%Oct 17, 2026
CVE-2026-111928: coder: Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of…5.4 Medium5.3 Medium0%Oct 17, 2026
CVE-2026-111923: fleetdm fleet: Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that…7.5 High8.7 High0%Oct 17, 2026
CVE-2026-111922: go-vikunja vikunja: Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port…6.3 Medium7.2 High0%Oct 17, 2026
CVE-2026-111918: go-vikunja vikunja: Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that…5.4 Medium5.3 Medium0%Oct 17, 2026
CVE-2026-111917: go-vikunja vikunja: Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep…6.5 Medium7.1 High0%Oct 17, 2026
CVE-2026-111912: admidio: Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in…6.5 Medium7.1 High0%Oct 17, 2026
CVE-2026-111911: thorsten phpMyFAQ: phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints…9.8 Critical9.3 Critical0%Oct 17, 2026
CVE-2026-111907: thorsten phpMyFAQ: phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database…7.1 High7.1 High0%Oct 17, 2026
CVE-2026-111906: thorsten phpMyFAQ: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the…6.5 Medium7.1 High0%Oct 17, 2026
CVE-2026-111902: thorsten phpMyFAQ: phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in isFaqAccessibleForUser() that…5.3 Medium6.9 Medium0%Oct 17, 2026
CVE-2026-111901: thorsten phpMyFAQ: phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an uncontrolled resource consumption vulnerability in the…7.5 High8.7 High0%Oct 17, 2026
CVE-2026-111896: thorsten phpMyFAQ: phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a stored cross-site scripting vulnerability in SvgSanitizer that…5.4 Medium5.1 Medium0%Oct 17, 2026
CVE-2026-111891: thorsten phpMyFAQ: phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in the group permission…5.5 Medium7.0 High0%Oct 17, 2026
CVE-2026-111880: FreeRDP: FreeRDP versions from 2.0.0 before 3.32.0 contain a heap out-of-bounds write in the server hash-callback NTLM path that…7.4 High8.3 High0%Oct 17, 2026
CVE-2026-109701: PAYCOMET PAYCOMET for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PAYCOMET PAYCOMET…7.1 HighN/A0%Oct 17, 2026
CVE-2026-110889: Gantry Gantry 5 Framework: Generation of Error Message Containing Sensitive Information vulnerability in Gantry Gantry 5 Framework gantry5 allows…7.5 HighN/A0%Oct 17, 2026
CVE-2026-111110: stiofansisland: The Payment forms, Buy now buttons, and Invoicing System | GetPaid plugin for WordPress is vulnerable to Stored…7.2 HighN/A0%Oct 17, 2026
CVE-2026-110253: boldgrid weForms – Easy Drag & Drop Contact Form Builder For WordPress: The weForms – Easy Drag & Drop Contact Form Builder For WordPress plugin for WordPress is vulnerable to limited media…5.4 MediumN/A0%Oct 17, 2026
CVE-2026-109983: wssoffice21 YMC Filter: The YMC Filter plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'post_title'…6.4 MediumN/A0%Oct 17, 2026
CVE-2026-100316: davidanderson European VAT Compliance Assistant for WooCommerce: The European VAT Compliance Assistant for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting…7.2 HighN/A0%Oct 17, 2026
CVE-2026-110384: Heateor Support Fancy Comments WordPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Heateor Support…7.1 HighN/A0%Oct 17, 2026
CVE-2026-97314: Unknown ThirstyAffiliates: The ThirstyAffiliates WordPress plugin before 3.12.1 does not check the status or type of the object requested by its…6.5 MediumN/A0%Oct 17, 2026
CVE-2026-92433: Unknown Patreon WordPress: The Patreon WordPress plugin before 1.10.0 does not verify a nonce when connecting the site to a Patreon account,…6.5 MediumN/A0%Oct 17, 2026
CVE-2026-92432: Unknown Patreon WordPress: The Patreon WordPress plugin before 1.10.0 does not validate a user-supplied redirect destination before redirecting,…4.3 MediumN/A0%Oct 17, 2026
901-925 of 409174
‹›