The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110233: NSPC911 rovr: Rovr through 0.10.3 on Windows contains an OS command injection vulnerability that allows attackers to execute commands…7.8 High8.4 High1%Oct 13, 2026
CVE-2026-110232: Fossify Fossify File Manager: Fossify File Manager through 1.6.2 contains a path traversal vulnerability that allows crafted ZIP archives to write…3.3 Low4.6 Medium0%Oct 13, 2026
CVE-2026-110231: muCommander: muCommander through 1.6.2 contains a path traversal vulnerability in UnpackJob that allows attackers to write files…4.7 Medium5.6 Medium0%Oct 13, 2026
CVE-2026-110230: sergix44 XBackBone: XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other…5.4 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-110229: Webkul QloApps: QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows…5.4 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-110228: wallabag: wallabag 2.6.13 through 2.6.14 contains a stored cross-site scripting vulnerability that allows authenticated users to…5.4 Medium5.1 Medium0%Oct 13, 2026
CVE-2026-110226: Webkul QloApps: QloApps through 1.7.0 contains a broken access control vulnerability that allows hotel-restricted back-office employees…5.4 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-110225: Shaarli: Shaarli through 0.16.9 contains a server-side request forgery vulnerability that allows authenticated users to make the…2.7 Low5.1 Medium0%Oct 13, 2026
CVE-2026-110224: Webkul QloApps: QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in…5.4 Medium5.1 Medium0%Oct 13, 2026
CVE-2026-110223: Kareadita Kavita: Kavita 0.9.0 through 0.9.1.4 contains a server-side request forgery vulnerability that allows authenticated users to…3.1 Low2.3 Low0%Oct 13, 2026
CVE-2026-110222: Razorpay IFSC: Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to…5.3 Medium6.9 Medium0%Oct 13, 2026
CVE-2026-110221: Webkul QloApps: QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability in the AdminHotelFeaturePricesSettings…5.4 Medium5.1 Medium0%Oct 13, 2026
CVE-2026-110220: Kubeflow Model Registry: Kubeflow Model Registry through 0.3.17 contains a server-side request forgery vulnerability that allows namespace users…7.1 High7.1 High0%Oct 13, 2026
CVE-2026-110219: Webkul QloApps: QloApps through 1.7.0 contains a reflected cross-site scripting vulnerability that allows remote attackers to inject…5.4 Medium5.1 Medium0%Oct 13, 2026
CVE-2026-110218: Webkul Aureus ERP: Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read…3.7 Low6.3 Medium0%Oct 13, 2026
CVE-2026-110217: lenve vhr: Lenve vhr through commit 03abbd3 contains an information disclosure vulnerability that allows any authenticated user to…6.5 Medium7.1 High1%Oct 13, 2026
CVE-2026-110216: youlaitech youlai-boot: youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable…7.1 High7.1 High0%Oct 13, 2026
CVE-2026-110215: youlaitech youlai-boot: youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign…8.8 High8.7 High0%Oct 13, 2026
CVE-2026-110214: xiaonuobase Snowy: Snowy 3.6.5 contains a hard-coded HMAC key vulnerability that allows unauthenticated attackers to forge download…3.7 Low6.3 Medium0%Oct 13, 2026
CVE-2026-110213: Stonewuu ai-fusion-video: Stonewuu ai-fusion-video through 1.2.0 contains an insecure direct object reference vulnerability that allows…4.3 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-110212: Stonewuu ai-fusion-video: Stonewuu ai-fusion-video through 1.2.0 contains a path traversal vulnerability that allows authenticated users to write…4.3 Medium5.3 Medium0%Oct 13, 2026
CVE-2026-110211: iflytek skillhub: iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to…8.1 High7.2 High0%Oct 13, 2026
CVE-2026-110210: Phase Phase Console: Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without…5.3 Medium6.0 Medium0%Oct 13, 2026
CVE-2026-110209: Stonewuu ai-fusion-video: Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated…6.5 Medium7.1 High0%Oct 13, 2026
CVE-2026-110208: WuKongOpenSource Wukong AICRM: Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that…7.1 High7.1 High0%Oct 13, 2026
1026-1050 of 404453
‹›