The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-10135: Totolink: A OS command injection vulnerability exists in the batchupg functionality of X2000R (version(s):…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-10133: Totolink: A stack-based buffer overflow vulnerability exists in the batchupg functionality of X2000R (version(s):…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-10132: Totolink: A stack-based buffer overflow vulnerability exists in the boa formIpQos mac functionality of X2000R (version(s):…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-10131: Totolink: An OS command injection vulnerability exists in the boa formPasswordSetup functionality of X2000R (version(s):…9.1 CriticalN/AN/AOct 20, 2026
CVE-2026-109576: HMS Networks: The parser in PEAK-System PCAN driver correctly detected the malformed record, but the loop iterating the record list…5.5 Medium6.8 MediumN/AOct 20, 2026
CVE-2026-107929: curl: When `CURLOPT_INTERFACE` (or the command line tool's `--interface` option) is set with one of the documented prefixes…N/AN/AN/AOct 20, 2026
CVE-2026-107928: curl: When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send bufferN/AN/AN/AOct 20, 2026
CVE-2026-105960: HMS Networks: PEAK-System PCAN contains a vulnerable operation involving a variable-length receive-record copy5.5 Medium6.8 MediumN/AOct 20, 2026
CVE-2026-103672: HMS Networks: The PEAK-System PCAN parser indexes a length table using attacker-controlled DLC without enforcing DLC <= 0x0f, then…7.1 High6.9 MediumN/AOct 20, 2026
CVE-2026-101103: HMS Networks: The PEAK-System PCAN diagnostic call did not validate that the caller-supplied output buffer was large enough to hold…5.5 Medium6.8 MediumN/AOct 20, 2026
CVE-2016-20104: EyeLock nano NXT: EyeLock nano NXT 3.05.1193, 3.04.1108, 3.03.944, and 3.01.646 contain a path traversal vulnerability that allows…7.5 High8.7 HighN/AOct 20, 2026
CVE-2016-20103: Cherry Team Cherry Plugin: Cherry Plugin for WordPress before 1.2.7 contains a path traversal vulnerability that allows unauthenticated attackers…7.5 High8.7 HighN/AOct 20, 2026
CVE-2016-20102: JavaMelody: JavaMelody before 1.60.0 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers…6.1 Medium5.1 MediumN/AOct 20, 2026
CVE-2016-20101: Pedro Marcelo Issuu Panel: Issuu Panel plugin for WordPress before 1.6.6 contains a PHP file inclusion vulnerability that allows unauthenticated…8.1 High9.2 CriticalN/AOct 20, 2026
CVE-2016-20100: Ian Howatson Memphis Documents Library: Memphis Documents Library plugin for WordPress before 3.1.6 contains a path traversal vulnerability that allows…7.5 High8.7 HighN/AOct 20, 2026
CVE-2015-20128: FooSun DotNetCMS: FooSun DotNetCMS 1.0 and 2.0 contains an SQL injection vulnerability that allows unauthenticated attackers to…8.2 High8.8 HighN/AOct 20, 2026
CVE-2015-20125: Aspose Aspose PDF Exporter: Aspose PDF Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 20, 2026
CVE-2015-20124: Aspose Aspose Importer & Exporter: Aspose Importer & Exporter plugin for WordPress before 3.0 contains a path traversal vulnerability that allows…7.5 High8.7 HighN/AOct 20, 2026
CVE-2015-20123: Aspose Aspose Doc Exporter: Aspose Doc Exporter plugin for WordPress before 2.0 contains a path traversal vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 20, 2026
CVE-2014-125134: ChurcHope: ChurcHope theme for WordPress before 2.2 contains a path traversal vulnerability that allows unauthenticated attackers…7.5 High8.7 HighN/AOct 20, 2026
CVE-2014-125133: imithemes NativeChurch: NativeChurch theme for WordPress before 1.6.2 contains a path traversal vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 20, 2026
CVE-2014-125132: Jason Newman Blogroll Fun: Blogroll Fun plugin for WordPress before 0.8.5 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.1 MediumN/AOct 20, 2026
CVE-2014-125131: DedeCMS: DedeCMS 5.6 and 5.7 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to…6.1 Medium5.1 MediumN/AOct 20, 2026
CVE-2012-20005: Łukasz Więcek SocialFit: SocialFit plugin for WordPress through 1.2.2 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.1 MediumN/AOct 20, 2026
CVE-2012-20004: Carles Reverter K-news: K-news plugin for WordPress before 1.1.1 contains a reflected cross-site scripting vulnerability that allows…6.1 Medium5.1 MediumN/AOct 20, 2026
1301-1325 of 407346
‹›