The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114268: Tenda BE3L Pro: A flaw has been found in Tenda BE3L Pro 16.03.60.629.9 Critical8.6 High1%Oct 21, 2026
CVE-2026-114267: SourceCodester Food Order Management System: A vulnerability was detected in SourceCodester Food Order Management System 1.07.3 High5.5 Medium0%Oct 21, 2026
CVE-2026-114266: ProjectWorlds Advanced Library Management System: A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.06.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-113870: MongoDB Compass: MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into…8.8 High8.6 High0%Oct 21, 2026
CVE-2026-113461: Checkmk GmbH Checkmk: Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library…N/A5.2 Medium0%Oct 21, 2026
CVE-2026-111816: Apache Software Foundation Apache Traffic Server: Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the…9.3 Critical9.2 Critical0%Oct 21, 2026
CVE-2026-111813: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments…10.0 Critical10.0 Critical0%Oct 21, 2026
CVE-2026-111804: Apache Software Foundation Apache Traffic Server: Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards…8.2 High8.8 High0%Oct 21, 2026
CVE-2026-111401: Tailored Media Tailored Tools: Cross-Site Request Forgery (CSRF) vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-110803: vaadin framework: VaadinService.requestEnd() in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside…N/A8.7 High0%Oct 21, 2026
CVE-2026-107588: vaadin: Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and…N/A8.4 High1%Oct 21, 2026
CVE-2026-105945: Apache Software Foundation Apache Pulsar: The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by…N/A7.7 High0%Oct 21, 2026
CVE-2026-105944: Apache Software Foundation Apache Pulsar Manager: Apache Pulsar Manager is a web console for administering Apache Pulsar clustersN/A10.0 Critical1%Oct 21, 2026
CVE-2026-105942: Apache Software Foundation Apache Pulsar: When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the…N/A7.7 High0%Oct 21, 2026
CVE-2026-105938: Apache Software Foundation Apache Pulsar: Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription…N/A2.3 Low1%Oct 21, 2026
CVE-2026-105937: Apache Software Foundation Apache Pulsar: Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's…N/A8.7 High0%Oct 21, 2026
CVE-2026-105936: Apache Software Foundation Apache Pulsar: The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed…N/A5.3 Medium0%Oct 21, 2026
CVE-2026-105935: Apache Software Foundation Apache Pulsar: The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied…N/A4.9 Medium0%Oct 21, 2026
CVE-2026-105934: Apache Software Foundation Apache Pulsar: The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE…N/A7.2 High0%Oct 21, 2026
CVE-2026-105933: Apache Software Foundation Apache Pulsar: Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting…N/A2.3 Low0%Oct 21, 2026
CVE-2026-105932: Apache Software Foundation Apache Pulsar: The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy…N/A2.3 Low1%Oct 21, 2026
CVE-2026-105931: Apache Software Foundation Apache Pulsar: The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactionsN/A2.3 Low1%Oct 21, 2026
CVE-2025-55702: Apache Software Foundation Apache Traffic Server: When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic…8.7 High7.0 High0%Oct 21, 2026
CVE-2025-31699: Apache Software Foundation Apache Traffic Server: Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request…8.9 High9.1 Critical0%Oct 21, 2026
CVE-2026-92210: NoMachine: NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability7.2 HighN/A0%Oct 21, 2026
1076-1100 of 413321
‹›