The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111852: WPdreams Ajax Search Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax…9.3 CriticalN/A0%Oct 21, 2026
CVE-2026-111848: Dylan Kuhn Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo…7.1 HighN/A0%Oct 21, 2026
CVE-2026-111840: VideoWhisper.com Paid Videochat Turnkey Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com…7.1 HighN/A0%Oct 21, 2026
CVE-2026-111838: ThemeHunk ThemeHunk Customizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk…7.1 HighN/A0%Oct 21, 2026
CVE-2026-111837: Wasiliy Strecker Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-111835: bjorntech BjornTech Swish for WooCommerce: Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-111834: Kitae Park Mang Board WP: Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web…9.9 CriticalN/A0%Oct 21, 2026
CVE-2026-111833: Bold Grid weForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms…7.5 HighN/A0%Oct 21, 2026
CVE-2026-111832: WP Mailster: Unrestricted Upload of File with Dangerous Type vulnerability in WP Mailster WP Mailster wp-mailster allows Upload a…10.0 CriticalN/A0%Oct 21, 2026
CVE-2025-60497: n/a: A segmentation violation in the GetESD function (/isomedia/track.c) of GPAC Project/MP4Box before 2.5 allows attackers…5.5 MediumN/A0%Oct 21, 2026
CVE-2025-60493: n/a: A segmentation violation in the check_media_profile function (/mp4box/mp4box.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2025-60492: n/a: A stack overflow in the gf_bifs_dec_node function (/bifs/field_decode.c) of GPAC Project/MP4Box before 2.5 allows…5.5 MediumN/A0%Oct 21, 2026
CVE-2025-60491: n/a: A heap use-after-free in the dasher_flush_segment function (/filters/dasher.c) of GPAC Project/MP4Box before 2.5 allows…N/AN/A0%Oct 21, 2026
CVE-2025-60490: n/a: A heap use-after-free in the gf_filter_pid_send_event_downstream function (/filter_core/filter_pid.c) of GPAC…N/AN/A0%Oct 21, 2026
CVE-2025-60487: n/a: A segmentation violation in the gf_isom_get_esd function (/isomedia/isom_read.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2023-7356: Linux: In the Linux kernel, the following vulnerability has been resolved: Bluetooth: ISO: Copy BASE if service data matches…N/AN/A0%Oct 21, 2026
CVE-2026-114437: go-chi chi: In the Golang Chi web framework, the ClientIPFromXFF middleware skips any X-Forwarded-For entry in a configured trusted…4.8 Medium6.3 Medium0%Oct 21, 2026
CVE-2026-114249: dhikshitha29 Insurance-Management-System: A vulnerability was detected in dhikshitha29 Insurance-Management-System…7.3 High5.5 Medium0%Oct 21, 2026
CVE-2026-104949: EnterpriseDB WarehousePG: WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability…N/A2.3 Low0%Oct 21, 2026
CVE-2026-104948: EnterpriseDB WarehousePG: WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability…N/A7.1 High0%Oct 21, 2026
CVE-2026-104947: EnterpriseDB WarehousePG: WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in…N/A5.3 Medium0%Oct 21, 2026
CVE-2025-60489: n/a: A NULL pointer dereference in the dasher_insert_timeline_entry function (/filters/dasher.c) of GPAC Project/MP4Box…N/AN/A0%Oct 21, 2026
CVE-2025-0326: WSO2: The system fails to invalidate existing access tokens associated with sub-organization users during sensitive account…N/AN/A0%Oct 21, 2026
CVE-2024-7478: WSO2: When a WSO2 product is configured to use an external user store, the system fails to adequately obscure the existence…5.8 MediumN/A0%Oct 21, 2026
CVE-2024-6423: WSO2: The product failed to enforce validation constraints on user-supplied input in URL parameters, allowing sensitive data…4.0 MediumN/A0%Oct 21, 2026
901-925 of 545063
‹›