The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-108766: Apache Software Foundation Apache Kylin: Missing authorization on jdbc source config update in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108764: Apache Software Foundation Apache Kylin: Server-Side request forgery (SSRF) vulnerability in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-108762: Apache Software Foundation Apache Kylin: Path-confinement bypass during metadata backup deletion in Apache KylinN/AN/AN/AOct 19, 2026
CVE-2026-13695: Integratec: SQL injection (SQLi) vulnerability—specifically a UNION-based vulnerability—in the Integratec application that affects…N/A8.8 HighN/AOct 19, 2026
CVE-2026-112180: MISP: MISP contains a data integrity flaw in its event deletion logicN/A5.1 MediumN/AOct 19, 2026
CVE-2026-112179: MISP: In MISP, the event synchronization process contained a logic error in the preparation of event reports for remote pushN/A5.3 MediumN/AOct 19, 2026
CVE-2026-112178: MISP: MISP contains an access control flaw in the proposal (shadow attribute) visibility logicN/A7.1 HighN/AOct 19, 2026
CVE-2026-112161: Mobatek MobaXterm: MobaXterm Personal Edition (Portable) 26.4 GA extracts the CygUtils64.plugin file without first verifying its integrityN/A8.5 HighN/AOct 19, 2026
CVE-2026-112098: n/a DeepPavlov: A security flaw has been discovered in DeepPavlov up to 1.7.06.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-112097: SourceCodester Inventory System: A vulnerability was found in SourceCodester Inventory System 1.03.5 Low5.1 MediumN/AOct 19, 2026
CVE-2026-112096: SourceCodester Inventory System: A vulnerability has been found in SourceCodester Inventory System 1.03.5 Low2.0 LowN/AOct 19, 2026
CVE-2026-112095: SourceCodester Inventory System: A flaw has been found in SourceCodester Inventory System 1.03.5 Low2.0 LowN/AOct 19, 2026
CVE-2026-111438: openGauss-server: 在 openGauss-server 的 src/common/backend/libpq/hba.cpp 中，复制连接认证存在访问控制绕过。hba_getauthmethod() 在处理 HADR/SW 复制发送方时，不要求…6.5 MediumN/AN/AOct 19, 2026
CVE-2026-104679: Yamaha Corporation VOCALOID6 Editor: VOCALOID6 Editor provided by Yamaha Corporation improperly restricts XML external entity references7.1 High6.9 MediumN/AOct 19, 2026
CVE-2026-112094: michaelrsweet mxml: A security vulnerability has been detected in michaelrsweet mxml 4.0.5/4.0.65.5 Medium2.0 LowN/AOct 19, 2026
CVE-2026-112093: subhajitkhan online-clinic-management-system: A vulnerability has been found in subhajitkhan online-clinic-management-system up to…4.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-112092: subhajitkhan online-clinic-management-system: A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a5784.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-112091: Dav-ee dairy-management-system: A flaw has been found in Dav-ee dairy-management-system…5.3 Medium5.5 MediumN/AOct 19, 2026
CVE-2026-112090: Dav-ee dairy-management-system: A vulnerability was detected in Dav-ee dairy-management-system…6.3 Medium2.1 LowN/AOct 19, 2026
CVE-2026-111439: openGauss-server: 在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pg_read_binary_file_blocks()…4.3 MediumN/AN/AOct 19, 2026
CVE-2026-94294: Unknown App Builder: The App Builder WordPress plugin before 5.7.1 does not require authentication or authorisation before writing…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94272: Unknown Snap Finance: The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94231: Unknown TrueBooker: The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in place in some of its functionality,…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94230: Unknown TrueBooker: The TrueBooker WordPress plugin before 1.3.0 does not have authorisation checks in some of its AJAX actions, and does…5.3 MediumN/AN/AOct 19, 2026
CVE-2026-94229: Unknown TrueBooker: The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its…5.3 MediumN/AN/AOct 19, 2026
101-125 of 409174
‹›