The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111609: PKP Open Journal Systems: PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal…3.8 Low5.1 Medium0%Oct 16, 2026
CVE-2026-111608: jeequan jeepay: Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant…4.2 Medium2.3 Low0%Oct 16, 2026
CVE-2026-111607: jeequan jeepay: Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant…7.1 High7.1 High0%Oct 16, 2026
CVE-2026-111606: hcengineering Huly Platform: Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to…8.1 High8.6 High0%Oct 16, 2026
CVE-2026-111605: dromara Jpom: Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated…8.1 High8.6 High0%Oct 16, 2026
CVE-2026-111604: elunez eladmin: eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to…3.8 Low5.1 Medium0%Oct 16, 2026
CVE-2026-111603: PlayEdu: PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated…4.3 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111392: sgl-project sglang: SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote…4.8 Medium6.3 Medium0%Oct 16, 2026
CVE-2026-109839: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing…3.1 LowN/A1%Oct 16, 2026
CVE-2026-109838: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of…5.1 MediumN/A0%Oct 16, 2026
CVE-2026-109588: FreeRTOS FreeRTOS-Kernel: Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on…8.8 High9.3 Critical0%Oct 16, 2026
CVE-2026-109587: FreeRTOS FreeRTOS-Kernel: Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might…8.8 High9.3 Critical0%Oct 16, 2026
CVE-2026-109461: Microsoft Microsoft Identity Client for NodeJS: Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to…5.9 MediumN/A0%Oct 16, 2026
CVE-2026-102552: FreeRTOS FreeRTOS-Plus-TCP: Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before…5.9 Medium8.2 High0%Oct 16, 2026
CVE-2026-102551: FreeRTOS FreeRTOS-Plus-TCP: Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon…7.7 High9.2 Critical0%Oct 16, 2026
CVE-2026-111700: WebVella WebVella-ERP: WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL…7.1 High7.1 High0%Oct 16, 2026
CVE-2026-111695: shaiwz data-platform-open: Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows…7.1 High7.1 High0%Oct 16, 2026
CVE-2026-111690: suyuan32 simple-admin-core: Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers…9.8 Critical9.3 Critical0%Oct 16, 2026
CVE-2026-111685: Thecosy IceCMS: IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL…7.5 High8.7 High0%Oct 16, 2026
CVE-2026-111680: APIParkLab APIPark: APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to…8.3 High7.2 High0%Oct 16, 2026
CVE-2026-111678: Adri van Os antiword: Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c…3.3 Low4.8 Medium0%Oct 16, 2026
CVE-2026-111677: Adri van Os antiword: Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted…5.5 Medium6.8 Medium0%Oct 16, 2026
CVE-2026-111675: xiaochong0302 course-tencent-cloud: Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that…7.4 High9.1 Critical0%Oct 16, 2026
CVE-2026-111670: clickvisual: ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows…4.3 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111665: PiranhaCMS Piranha CMS: Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController…5.4 Medium5.3 Medium0%Oct 16, 2026
1001-1025 of 409174
‹›