The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111604: elunez eladmin: eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to…3.8 Low5.1 Medium0%Oct 16, 2026
CVE-2026-111603: PlayEdu: PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated…4.3 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111392: sgl-project sglang: SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote…4.8 Medium6.3 Medium0%Oct 16, 2026
CVE-2026-109839: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing…3.1 LowN/A1%Oct 16, 2026
CVE-2026-109838: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of…5.1 MediumN/A0%Oct 16, 2026
CVE-2026-109588: FreeRTOS FreeRTOS-Kernel: Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on…8.8 High9.3 Critical0%Oct 16, 2026
CVE-2026-109587: FreeRTOS FreeRTOS-Kernel: Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might…8.8 High9.3 Critical0%Oct 16, 2026
CVE-2026-109461: Microsoft Microsoft Identity Client for NodeJS: Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to…5.9 MediumN/A0%Oct 16, 2026
CVE-2026-102552: FreeRTOS FreeRTOS-Plus-TCP: Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before…5.9 Medium8.2 High0%Oct 16, 2026
CVE-2026-102551: FreeRTOS FreeRTOS-Plus-TCP: Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon…7.7 High9.2 Critical0%Oct 16, 2026
CVE-2026-111705: fushengqian fuint: Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated…4.3 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111700: WebVella WebVella-ERP: WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL…7.1 High7.1 High0%Oct 16, 2026
CVE-2026-111695: shaiwz data-platform-open: Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows…7.1 High7.1 High0%Oct 16, 2026
CVE-2026-111690: suyuan32 simple-admin-core: Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers…9.8 Critical9.3 Critical0%Oct 16, 2026
CVE-2026-111685: Thecosy IceCMS: IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL…7.5 High8.7 High0%Oct 16, 2026
CVE-2026-111680: APIParkLab APIPark: APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to…8.3 High7.2 High0%Oct 16, 2026
CVE-2026-111678: Adri van Os antiword: Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c…3.3 Low4.8 Medium0%Oct 16, 2026
CVE-2026-111677: Adri van Os antiword: Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted…5.5 Medium6.8 Medium0%Oct 16, 2026
CVE-2026-111675: xiaochong0302 course-tencent-cloud: Course-tencent-cloud through 2.0.1 contains an improper restriction of authentication attempts vulnerability that…7.4 High9.1 Critical0%Oct 16, 2026
CVE-2026-111670: clickvisual: ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows…4.3 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111665: PiranhaCMS Piranha CMS: Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController…5.4 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111660: wayn111 waynboot-mall: waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to…6.5 Medium6.9 Medium0%Oct 16, 2026
CVE-2026-111655: zoujingli think-plugs-admin: ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows…3.8 Low5.1 Medium0%Oct 16, 2026
CVE-2026-111650: HoshinoSuzumi chronoframe: ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that…8.6 High8.8 High0%Oct 16, 2026
CVE-2026-111645: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing object-level authorization vulnerability in the ImportLocalDoc API that allows…5.4 Medium5.3 Medium0%Oct 16, 2026
1051-1075 of 409174
‹›