The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-120430: owen2345 Camaleon CMS: Camaleon CMS before 2.9.2 contains an insecure direct object reference vulnerability in Admin::CategoriesController…5.4 Medium5.3 Medium0%Nov 2, 2026
CVE-2026-120428: Chaitin PandaWiki: PandaWiki 3.65.0 through 3.87.5 contains a stored cross-site scripting vulnerability that allows unauthenticated…6.1 Medium5.1 Medium0%Nov 2, 2026
CVE-2026-120427: zmister2016 MrDoc: MrDoc through 1.1.1 contains a missing authorization vulnerability in the get_doctemp view that allows authenticated…4.3 Medium5.3 Medium0%Nov 2, 2026
CVE-2026-120426: OpenCSG CSGHub: OpenCSG CSGHub through v2.6.0-ce contains an authorization bypass vulnerability in the unauthenticated file resolve…7.5 High8.7 High0%Nov 2, 2026
CVE-2026-120425: munafio Chatify: Chatify before 1.6.4 contains an authorization bypass vulnerability in the Pusher channel authorization endpoint that…6.5 Medium7.1 High1%Nov 2, 2026
CVE-2026-120318: Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce: Product Gallery Slider & Additional Variation Images for WooCommerce 2.3.23 before 2.3.26 contains a missing…7.2 High8.6 High0%Nov 2, 2026
CVE-2026-118052: Eclipse Foundation Eclipse ThreadX: In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager loaders return an overflow error without…N/A6.8 Medium0%Nov 2, 2026
CVE-2025-71450: Buffer Under-read3.3 Low4.8 Medium0%Nov 2, 2026
CVE-2025-62819: Undefined Security WeaknessN/AN/A0%Nov 2, 2026
CVE-2026-73697: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains an arbitrary file write and OS command injection…8.8 High8.7 High2%Nov 2, 2026
CVE-2026-73695: Control Web Panel: Control Web Panel (CWP) before webpanel_version 1.16 contains a path traversal vulnerability in…8.8 High8.7 High1%Nov 2, 2026
CVE-2026-120461: dromara Jpom: Jpom through 2.11.12 contains a cross-workspace authorization bypass in POST /node/ssh_command/batch that resolves…8.8 High8.7 High0%Nov 2, 2026
CVE-2026-120429: owen2345 Camaleon CMS: Camaleon CMS before 2.9.2 contains a missing authorization vulnerability in Admin::MediaController that allows…7.1 High7.1 High0%Nov 2, 2026
CVE-2026-74993: Starnet Computer and Network Systems Inventory Tracking Application: Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Starnet Computer…7.5 HighN/A0%Nov 2, 2026
CVE-2026-120463: sassanix Warracker: Warracker before 1.0.4 contains a missing authorization vulnerability in its Paperless-ngx integration that allows an…6.5 Medium6.0 Medium0%Nov 2, 2026
CVE-2026-114364: Improper Neutralization of Special Elements used in an SQL CommandN/AN/A0%Nov 2, 2026
CVE-2026-111959: Out-of-bounds ReadN/AN/A0%Nov 2, 2026
CVE-2026-102802: Improper Control of Generation of CodeN/A8.9 High0%Nov 2, 2026
CVE-2026-103419: Improper Neutralization of Input During Web Page GenerationN/A8.6 High0%Nov 2, 2026
CVE-2026-103420: Cross-Site Request Forgery (CSRF)N/A7.2 High0%Nov 2, 2026
CVE-2026-105600: Improper Control of Generation of CodeN/A8.6 High0%Nov 2, 2026
CVE-2026-105601: Improper Neutralization of Input During Web Page GenerationN/A5.3 Medium0%Nov 2, 2026
CVE-2026-105602: Improper Neutralization of Input During Web Page GenerationN/A8.6 High0%Nov 2, 2026
CVE-2026-102801: Exposure of Sensitive Information to an Unauthorized ActorN/A5.1 Medium0%Nov 2, 2026
CVE-2026-92886: TÜBİTAK BİLGEM Software Technologies Research Institute eta-register: Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows…7.8 HighN/A0%Nov 2, 2026
1226-1250 of 557831
‹

Refine your search or filters to see more results.