The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-116339: iFlytek astron-agent: A vulnerability was determined in iFlytek astron-agent up to 1.1.27.3 High5.5 MediumN/AOct 26, 2026
CVE-2026-93848: Mattermost: Mattermost versions 11.7.x <= 11.7.10 fail to apply outbound internal-connection filtering to the OpenID discovery…2.7 LowN/AN/AOct 26, 2026
CVE-2026-93850: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to bind the volume…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-93849: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 Mattermost fail to apply…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-93328: Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox): Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases…N/A9.3 CriticalN/AOct 26, 2026
CVE-2026-97200: benoitc hackney: Allocation of Resources Without Limits or Throttling vulnerability in hackney_conn in benoitc hackney allows a…N/A8.2 HighN/AOct 26, 2026
CVE-2026-59107: WolfVision: A security vulnerability has been identified in the vSolution Matrix file sharing feature9.8 Critical9.2 CriticalN/AOct 26, 2026
CVE-2026-59106: WolfVision: A security vulnerability has been identified in the WolfProt interface implementation9.8 Critical9.3 CriticalN/AOct 26, 2026
CVE-2026-116516: Mattermost: Mattermost versions <=11.9 11.1.9 11.5.8 11.10.7.0 fail to validate Zoom chat line length before slicing which allows…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-116492: frappe crm: Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged…6.5 Medium7.1 HighN/AOct 26, 2026
CVE-2026-116488: NXP mcuxsdk-middleware-usb: NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio,…6.8 Medium7.0 HighN/AOct 26, 2026
CVE-2026-116487: NXP mcuxsdk-middleware-usb: NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability…4.6 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-116485: huangxd- danmu_api: danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify…9.8 Critical9.3 CriticalN/AOct 26, 2026
CVE-2026-116283: n/a Kameleo: A weakness has been identified in Kameleo up to 5.0.1.264.3 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-116281: n/a Kameleo: A vulnerability was identified in Kameleo up to 5.0.1.263.3 Low4.8 MediumN/AOct 26, 2026
CVE-2026-116280: n/a Kameleo: A vulnerability was determined in Kameleo up to 5.0.1.265.5 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-116274: n/a JIZHICMS: A vulnerability has been found in JIZHICMS up to 2.5.64.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116219: dolibarr: Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that…7.2 High8.6 HighN/AOct 26, 2026
CVE-2026-116218: dolibarr: Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to…7.6 High7.2 HighN/AOct 26, 2026
CVE-2026-116216: maccmspro, magicblack maccms10: MacCMS v10 through 2026.1000.4056 contains a mass assignment vulnerability in index/Comment::saveData() that allows…5.3 Medium6.9 MediumN/AOct 26, 2026
CVE-2026-116215: maccmspro, magicblack maccms10: MacCMS v10 through 2026.1000.4056 contains a race condition vulnerability in Card::useData() that allows authenticated…3.1 Low2.3 LowN/AOct 26, 2026
CVE-2026-116214: maccmspro, magicblack maccms10: MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers…9.1 Critical9.3 CriticalN/AOct 26, 2026
CVE-2026-116212: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows…5.4 Medium5.1 MediumN/AOct 26, 2026
CVE-2026-116210: Webasyst Webasyst Framework: Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows…6.5 Medium7.1 HighN/AOct 26, 2026
CVE-2026-115700: benoitc hackney: Interpretation Conflict vulnerability in hackney_url in benoitc hackney allows Server Side Request Forgery via a…N/A6.9 MediumN/AOct 26, 2026
101-125 of 546512
‹›