The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113788: uselagoon lagoon: Lagoon is an application delivery platform for KubernetesN/A9.4 Critical0%Oct 21, 2026
CVE-2026-113787: GitHubNewbie0 odf-kit: odf-kit allows users to generate, fill, read, and convert OpenDocument Format files (.odt, .ods) in TypeScript and…6.1 MediumN/A0%Oct 21, 2026
CVE-2026-102536: Rejected reason: This CVE has been rejected because it was issued to a development-only issue with no affected…N/AN/AN/AOct 21, 2026
CVE-2026-102486: ntpsec: Out-of-bounds read in NTS extension field parsing in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to crash…7.5 HighN/A1%Oct 21, 2026
CVE-2026-102485: ntpsec: Out-of-bounds read in the Motorola Oncore refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls…5.2 MediumN/A0%Oct 21, 2026
CVE-2026-102484: ntpsec: Heap-based buffer overflow in the JJY refclock driver in NTPsec ntpd before 1.2.6 allows an attacker who controls the…6.4 MediumN/A0%Oct 21, 2026
CVE-2026-102483: ntpsec: Reachable exit in NTPsec ntpd 1.1.4 through 1.2.5 allows a remote attacker to terminate the daemon via an NTS request…7.5 HighN/A1%Oct 21, 2026
CVE-2025-60476: n/a: A heap use-after-free in the gf_odf_ac4_cfg_clean_list function (/odf/descriptors.c) of GPAC Project/MP4Box before 2.5…N/AN/A0%Oct 21, 2026
CVE-2025-60469: n/a: A NULL pointer dereference in the gf_ac4_presentation_ch_mode function (/media_tools/av_parsers.c) of GPAC…N/AN/A0%Oct 21, 2026
CVE-2026-114257: oretnom23 file-management-system-php: A security vulnerability has been detected in oretnom23 file-management-system-php up to…7.3 High5.5 Medium0%Oct 21, 2026
CVE-2026-98869: Linux: In the Linux kernel, the following vulnerability has been resolved: bpf: Infer zext_dst based on static register…N/AN/A0%Oct 21, 2026
CVE-2026-114252: itsourcecode Sales-and-Inventory-System: A vulnerability was found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac6.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-114251: itsourcecode Sales-and-Inventory-System: A vulnerability has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac6.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-114250: itsourcecode Sales-and-Inventory-System: A flaw has been found in itsourcecode Sales-and-Inventory-System up to 0a3c45a78aaff3601b8cf9ce8ba82ff5c345caac6.3 Medium2.1 Low0%Oct 21, 2026
CVE-2026-113786: py-pdf pypdf: pypdf is a free and open-source pure-python PDF libraryN/A2.3 Low0%Oct 21, 2026
CVE-2026-113779: pfrest pfSense-pkg-RESTAPI: The pfSense REST API package is an unofficial, open-source REST and GraphQL API for pfSense CE and pfSense Plus…8.8 HighN/A0%Oct 21, 2026
CVE-2026-112221: Brainstorm Force SureCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…7.1 HighN/A0%Oct 21, 2026
CVE-2026-111852: WPdreams Ajax Search Lite: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPdreams Ajax…9.3 CriticalN/A0%Oct 21, 2026
CVE-2026-111848: Dylan Kuhn Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo…7.1 HighN/A0%Oct 21, 2026
CVE-2026-111840: VideoWhisper.com Paid Videochat Turnkey Site: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in VideoWhisper.com…7.1 HighN/A0%Oct 21, 2026
CVE-2026-111838: ThemeHunk ThemeHunk Customizer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ThemeHunk…7.1 HighN/A0%Oct 21, 2026
CVE-2026-111837: Wasiliy Strecker Contest Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Wasiliy Strecker…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-111835: bjorntech BjornTech Swish for WooCommerce: Missing Authorization vulnerability in bjorntech BjornTech Swish for WooCommerce woo-swish-e-commerce allows Exploiting…6.5 MediumN/A0%Oct 21, 2026
CVE-2026-111834: Kitae Park Mang Board WP: Unrestricted Upload of File with Dangerous Type vulnerability in Kitae Park Mang Board WP mangboard allows Upload a Web…9.9 CriticalN/A0%Oct 21, 2026
CVE-2026-111833: Bold Grid weForms: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Bold Grid weForms…7.5 HighN/A0%Oct 21, 2026
1226-1250 of 413321
‹›