The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-93639: Zimbra Zimbra Collaboration Suite: A missing authorization vulnerability in Zimbra Collaboration Suite (ZCS) allows a delegated administrator with no…8.7 HighN/A0%Oct 23, 2026
CVE-2026-93638: Zimbra Zimbra Collaboration Suite: A reflected cross-site scripting vulnerability in the login page of Zimbra Collaboration Suite (ZCS) allows an…6.1 MediumN/A0%Oct 23, 2026
CVE-2026-55826: stape-io gtm-server-side-wordpress-plugin: The GTM Server Side plugin by stape.io implements server-side tracking on WordPress websitesN/A8.7 High0%Oct 23, 2026
CVE-2026-50053: Zimbra Zimbra Collaboration Suite: A request attribute override vulnerability in Zimbra Collaboration Suite (ZCS) allows unauthenticated requests to /h/*…8.7 HighN/A0%Oct 23, 2026
CVE-2026-115754: yahoo serialize-javascript: serialize-javascript from 7.0.1 before 7.1.3 contains a cross-site scripting vulnerability that allows attackers to…4.7 Medium2.3 Low0%Oct 23, 2026
CVE-2026-115457: baserproject basercms: baserCMS is a website development framework7.1 HighN/A0%Oct 23, 2026
CVE-2026-10632: Zimbra Zimbra Collaboration Suite: A reflected cross-site scripting vulnerability in the Classic Web Client of Zimbra Collaboration Suite (ZCS) allows an…8.7 HighN/A0%Oct 23, 2026
CVE-2026-56840: MervinPraison PraisonAI: PraisonAI is a multi-agent teams system8.8 HighN/A0%Oct 23, 2026
CVE-2025-58403: CGM CGM CLININET: CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied dataN/A5.1 Medium1%Oct 23, 2026
CVE-2026-4952: Cross-site Scripting (XSS)N/A5.1 Medium0%Oct 23, 2026
CVE-2026-4951: VertiGIS Ltd. WebOrderSystem (KundenManager): The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for…N/A5.1 Medium0%Oct 23, 2026
CVE-2026-4950: VertiGIS Ltd. WebOrderSystem (KundenManager): The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the…N/A4.8 Medium0%Oct 23, 2026
CVE-2026-113500: Unknown LiteSpeed Cache: The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet…7.5 HighN/A0%Oct 23, 2026
CVE-2026-113499: Unknown LiteSpeed Cache: The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet…7.5 HighN/A0%Oct 23, 2026
CVE-2026-59188: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic components5.4 MediumN/A0%Oct 23, 2026
CVE-2026-55600: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic componentsN/A5.7 Medium0%Oct 23, 2026
CVE-2026-54615: Part-DB Part-DB-server: Part-DB is an open source inventory management system for electronic componentsN/A6.0 Medium0%Oct 23, 2026
CVE-2025-69723: n/a: A reflected cross-site scripting (XSS) vulnerability in localstack v4.9.2 allows attackers to execute arbitrary…6.1 MediumN/A0%Oct 22, 2026
CVE-2026-97635: Agent Zero: The Agent Zero Web UI before 1.15 does not correctly sanitize user-provided input in chat messages or file uploads8.1 High8.6 High0%Oct 22, 2026
CVE-2026-115513: OpenCATS: OpenCATS before 0.12.0 contains a stored cross-site scripting vulnerability that allows a low-privileged authenticated…8.7 High6.3 Medium0%Oct 22, 2026
CVE-2026-61791: schorschii OCO-Server: OCO-Server is a self-hosted endpoint management application for computer inventory, software deployment, and mobile…7.4 HighN/A0%Oct 22, 2026
CVE-2024-58394: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2023-54413: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2020-37284: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2017-20290: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 22, 2026
76-100 of 10664