The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111893: thorsten phpMyFAQ: phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a privilege escalation vulnerability in…6.5 Medium8.5 High0%Oct 17, 2026
CVE-2026-111892: thorsten phpMyFAQ: phpMyFAQ 4.2.0-alpha before 4.2.0-beta lacks effective rate limiting on the unauthenticated user/password/update and…6.5 Medium6.9 Medium0%Oct 17, 2026
CVE-2026-111890: thorsten phpMyFAQ: phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta contains a privilege escalation vulnerability in…5.5 Medium7.0 High0%Oct 17, 2026
CVE-2026-111889: thorsten phpMyFAQ: phpMyFAQ from 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in…4.3 Medium5.3 Medium0%Oct 17, 2026
CVE-2026-111888: thorsten phpMyFAQ: phpMyFAQ from 4.0.0 before 4.1.9 contains an incorrect authorization vulnerability that allows delegated admins lacking…2.7 Low5.1 Medium0%Oct 17, 2026
CVE-2026-111887: thorsten phpMyFAQ: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an account enumeration vulnerability that allows…5.3 Medium6.9 Medium0%Oct 17, 2026
CVE-2026-111886: thorsten phpMyFAQ: phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal…6.5 Medium7.1 High0%Oct 17, 2026
CVE-2026-111885: thorsten phpMyFAQ: phpMyFAQ from 4.2.0-alpha before 4.2.0-beta contains a missing authorization vulnerability in…5.5 Medium7.0 High0%Oct 17, 2026
CVE-2026-111884: thorsten phpMyFAQ: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta does not require the current password when changing an account…8.3 High8.7 High0%Oct 17, 2026
CVE-2026-111882: thorsten phpMyFAQ: phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability…8.1 High8.6 High0%Oct 17, 2026
CVE-2026-111881: FreeRDP: FreeRDP from 3.14.1 before 3.32.0 contains an integer underflow in the WinPR BMP writer, where a mismatched stride…7.6 High7.2 High0%Oct 17, 2026
CVE-2026-110882: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications: Missing Authorization vulnerability in Cozy Vision Technologies Pvt4.3 MediumN/A0%Oct 17, 2026
CVE-2025-71435: coder: Coder before 2.23.0 contains a session expiration bypass vulnerability that allows authenticated users to retain access…4.2 Medium2.3 Low0%Oct 17, 2026
CVE-2024-58398: coder: Coder 2.3.1 before 2.14.4, 2.15.x before 2.15.3, and 2.16.0 before 2.16.1 contains an open redirect vulnerability in…4.3 Medium5.3 Medium0%Oct 17, 2026
CVE-2026-111934: coder: Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the…3.7 Low6.3 Medium0%Oct 17, 2026
CVE-2026-111929: coder: Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile…5.3 Medium6.0 Medium0%Oct 17, 2026
CVE-2026-111928: coder: Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of…5.4 Medium5.3 Medium0%Oct 17, 2026
CVE-2026-111923: fleetdm fleet: Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that…7.5 High8.7 High0%Oct 17, 2026
CVE-2026-111922: go-vikunja vikunja: Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port…6.3 Medium7.2 High0%Oct 17, 2026
CVE-2026-111918: go-vikunja vikunja: Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that…5.4 Medium5.3 Medium0%Oct 17, 2026
CVE-2026-111917: go-vikunja vikunja: Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep…6.5 Medium7.1 High0%Oct 17, 2026
CVE-2026-111912: admidio: Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in…6.5 Medium7.1 High0%Oct 17, 2026
CVE-2026-111911: thorsten phpMyFAQ: phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints…9.8 Critical9.3 Critical0%Oct 17, 2026
CVE-2026-111907: thorsten phpMyFAQ: phpMyFAQ 4.0.0 before 4.1.9 contains a cross-site request forgery vulnerability in the POST /admin/api/update-database…7.1 High7.1 High0%Oct 17, 2026
CVE-2026-111906: thorsten phpMyFAQ: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains a cross-site request forgery vulnerability in the…6.5 Medium7.1 High0%Oct 17, 2026
901-925 of 409174
‹›