The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114719: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a CSRF validation bypass in the mark-as-junk…3.7 LowN/A0%Oct 22, 2026
CVE-2026-114718: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a cross-site scripting vulnerability in the…4.7 MediumN/A0%Oct 22, 2026
CVE-2026-114717: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability when a…4.0 MediumN/A0%Oct 22, 2026
CVE-2026-114716: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by a mail header injection vulnerability8.5 HighN/A0%Oct 22, 2026
CVE-2026-114715: Roundcube Webmail: Roundcube Webmail before 1.6.20 and 1.7.x before 1.7.5 is affected by an incorrect authorization vulnerability in the…6.8 MediumN/A0%Oct 22, 2026
CVE-2026-114664: frappe: Frappe Framework before 16.33.0 contains a blind SQL injection vulnerability in the…7.1 High7.1 High0%Oct 22, 2026
CVE-2026-114663: vyperlang vyper: Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported modules,…8.4 High8.6 High0%Oct 22, 2026
CVE-2026-114662: obot-platform obot: Obot before 0.26.0 contains an authentication bypass vulnerability in the CLI login flow that allows unauthenticated…8.1 High8.6 High0%Oct 22, 2026
CVE-2026-114661: openremote: OpenRemote 1.2.0 before 1.31.0 contains a missing authorization vulnerability in GatewayServiceResource that allows any…8.5 High9.0 Critical0%Oct 22, 2026
CVE-2026-114660: getgrav grav: Grav from 2.0.0 before 2.2.5 contains an improper access control vulnerability in FlexDirectory::dynamicFlexField()…6.3 Medium7.0 High0%Oct 22, 2026
CVE-2026-114659: getgrav grav-plugin-flex-objects: Grav Flex Objects plugin 1.4.0 before 1.4.17 contains an authorization bypass because its generic…6.5 Medium7.1 High0%Oct 22, 2026
CVE-2026-114658: getgrav grav-plugin-login: Grav Login plugin from 3.6.0 before 3.9.13 contains a missing authorization vulnerability in the login.invite task that…8.8 High8.7 High0%Oct 22, 2026
CVE-2026-114657: getgrav grav: Grav from 2.0.0 before 2.2.5 contains an information disclosure vulnerability that allows page authors to capture…5.7 Medium6.9 Medium0%Oct 22, 2026
CVE-2026-114656: traefik: Traefik before 2.11.58 and 3.7.13 contains an authentication bypass vulnerability that allows unauthenticated clients…7.5 High6.9 Medium0%Oct 22, 2026
CVE-2026-114642: traefik: Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 stores its NTLM/Kerberos backend round tripper in a…8.7 High7.0 High0%Oct 22, 2026
CVE-2026-114641: traefik: Traefik 2.11.x before 2.11.58 and 3.x before 3.7.14 contains a race condition in NTLM and Kerberos (Negotiate) backend…3.7 Low6.3 Medium0%Oct 22, 2026
CVE-2026-114640: traefik: Traefik from v3.7.0 before v3.7.14 contains an authentication bypass vulnerability in its Kubernetes Ingress-NGINX…8.7 High7.0 High0%Oct 22, 2026
CVE-2026-114639: traefik: Traefik 2.11.0 before 2.11.58 and 3.0.0 before 3.7.14 contains an authentication bypass because a first request…8.7 High7.0 High0%Oct 22, 2026
CVE-2026-114638: traefik: Traefik v3.7.0 before v3.7.14 contains an improper authentication vulnerability in the Kubernetes Ingress NGINX…8.7 High7.0 High0%Oct 22, 2026
CVE-2026-114637: traefik: Traefik from v3.2.0 before v3.7.14 contains an authentication bypass vulnerability in the experimental FastProxy…8.7 High7.0 High0%Oct 22, 2026
CVE-2026-114636: traefik: Traefik v3.7.13 before v3.7.14 contains an access-control bypass in the Kubernetes Ingress NGINX provider, where the…8.7 High7.0 High0%Oct 22, 2026
CVE-2026-114635: traefik: Traefik before v2.11.58 and v3.7.14 contains an authentication bypass vulnerability in its SNI check, which is skipped…8.7 High7.0 High0%Oct 22, 2026
CVE-2026-114634: WWBN AVideo: WWBN AVideo before 29.4.0 contains a blind server-side request forgery vulnerability in getHeaderContentTypeFromURL()…4.3 Medium5.3 Medium0%Oct 22, 2026
CVE-2026-114633: WWBN AVideo: WWBN AVideo before 29.4.0 contains an incorrect authorization vulnerability that allows delegated Users Admin accounts…6.5 Medium7.0 High0%Oct 22, 2026
CVE-2026-114577: oretnom23 php-travel-agency-system: A vulnerability was found in oretnom23 php-travel-agency-system7.3 High5.5 Medium0%Oct 22, 2026
901-925 of 545063
‹›