The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-116073: leon-ai leon: Leon before commit 50df142 contains a path traversal vulnerability in getModelFileNameFromURL() that allows attackers…6.5 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116072: Docile-Alligator Infinity for Reddit: Infinity for Reddit through 8.3.4 contains a login cross-site request forgery vulnerability that allows attackers to…5.4 Medium5.3 MediumN/AOct 25, 2026
CVE-2026-116071: rotki: rotki before 1.44.2 contains a weak key derivation vulnerability that allows attackers to brute-force backups because…5.9 Medium8.2 HighN/AOct 25, 2026
CVE-2026-116070: dqzboy Docker-Proxy: Docker-Proxy through 5.1.9 contains a missing authentication vulnerability in the hubcmdui routes/config.js that allows…6.5 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116069: Albert-Weasker niubigeo: NiubiGEO before 0.3.2 contains an unauthenticated server-side request forgery vulnerability that allows remote…6.5 Medium6.9 MediumN/AOct 25, 2026
CVE-2026-116068: dokploy: Dokploy through 0.30.10 contains an authorization bypass vulnerability that allows owners or admins of any organization…8.8 High8.7 HighN/AOct 25, 2026
CVE-2026-116067: ananthakumaran paisa: Paisa before 0.7.8 contains a path traversal vulnerability in the GetFile, GetSheet, DeleteBackups, and…8.2 High8.8 HighN/AOct 25, 2026
CVE-2026-116066: Firecrawl: Firecrawl before 2.11.586 contains a server-side request forgery vulnerability in the Playwright service SSRF proxy…6.8 Medium7.0 HighN/AOct 25, 2026
CVE-2026-116050: krupalshah Employee Recruitment System: A vulnerability has been found in krupalshah Employee Recruitment System up to 922ff6d208278282e7c8e36d70d9ae356adec9fe7.3 High5.5 MediumN/AOct 25, 2026
CVE-2026-116049: krupalshah EmployeeRecruitmentSystem: A flaw has been found in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe7.3 High5.5 MediumN/AOct 25, 2026
CVE-2026-116048: krupalshah EmployeeRecruitmentSystem: A vulnerability was detected in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe7.3 High5.5 MediumN/AOct 25, 2026
CVE-2026-116047: Privoce Vocechat: A vulnerability has been found in Privoce Vocechat up to 0.9.1214.3 Medium2.1 LowN/AOct 25, 2026
CVE-2026-116046: eventcatalog sdk: A flaw has been found in eventcatalog sdk up to 2.29.05.3 Medium4.8 MediumN/AOct 25, 2026
CVE-2026-116045: 1999AZZAR designer-mcp: A vulnerability was detected in 1999AZZAR designer-mcp up to 2.1.04.3 Medium2.1 LowN/AOct 25, 2026
CVE-2026-94295: Unknown Chikkili- Google Pay India for Woocommerce: The Chikkili- Google Pay India for Woocommerce WordPress plugin through 1.0.6 does not verify that a payment…N/AN/AN/AOct 25, 2026
CVE-2026-116044: prasathmani TinyFileManager: A security vulnerability has been detected in prasathmani TinyFileManager up to 2.66.3 Medium2.1 LowN/AOct 25, 2026
CVE-2026-115251: Unknown Duplicator: The Duplicator WordPress plugin before 5.0.0 does not restrict its one-click upgrade routine to users allowed to…N/AN/AN/AOct 25, 2026
CVE-2026-115214: Unknown Datawiza Proxy Auth Plugin: The Datawiza Proxy Auth Plugin WordPress plugin before 1.1.1 does not verify that the user-identity and role HTTP…N/AN/AN/AOct 25, 2026
CVE-2026-115183: Unknown Qi Addons For Elementor: The Qi Addons For Elementor WordPress plugin before 1.11.2 does not properly sanitise a widget's heading text after…N/AN/AN/AOct 25, 2026
CVE-2026-114743: Unknown InstaWP Connect: The InstaWP Connect WordPress plugin before 0.1.4.2 does not perform a capability check on its InstaWP Connect…N/AN/AN/AOct 25, 2026
CVE-2026-114742: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not perform object-level ownership checks when updating virtual tours,…N/AN/AN/AOct 25, 2026
CVE-2026-114741: Unknown WPVR: The WPVR WordPress plugin before 9.0.3 does not perform object-level authorization checks when reading and updating…N/AN/AN/AOct 25, 2026
CVE-2026-114740: Unknown WPVR: The WPVR WordPress plugin before 9.1.3 does not correctly check user capabilities when creating a tour through its…N/AN/AN/AOct 25, 2026
CVE-2026-111981: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not perform a capability check when handling donor address changes,…N/AN/AN/AOct 25, 2026
CVE-2026-111980: Unknown GiveWP: The GiveWP WordPress plugin before 4.19.0.1 does not correctly determine which page a page-capability request applies…N/AN/AN/AOct 25, 2026
76-100 of 537999
‹›