The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111614: devlive-community DataCap: DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath…6.5 Medium7.1 High0%Oct 16, 2026
CVE-2026-111613: alldatacenter alldata: AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open…7.5 High8.7 High0%Oct 16, 2026
CVE-2026-111612: qaiu netdisk-fast-download: netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated…7.5 High8.7 High0%Oct 16, 2026
CVE-2026-111611: roncoo roncoo-education: roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows…5.4 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111610: b3log Solo: B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated…5.4 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111609: PKP Open Journal Systems: PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal…3.8 Low5.1 Medium0%Oct 16, 2026
CVE-2026-111608: jeequan jeepay: Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant…4.2 Medium2.3 Low0%Oct 16, 2026
CVE-2026-111607: jeequan jeepay: Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant…7.1 High7.1 High0%Oct 16, 2026
CVE-2026-111606: hcengineering Huly Platform: Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to…8.1 High8.6 High0%Oct 16, 2026
CVE-2026-111605: dromara Jpom: Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated…8.1 High8.6 High0%Oct 16, 2026
CVE-2026-111604: elunez eladmin: eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to…3.8 Low5.1 Medium0%Oct 16, 2026
CVE-2026-111603: PlayEdu: PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated…4.3 Medium5.3 Medium0%Oct 16, 2026
CVE-2026-111392: sgl-project sglang: SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote…4.8 Medium6.3 Medium0%Oct 16, 2026
CVE-2026-109839: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing…3.1 LowN/A1%Oct 16, 2026
CVE-2026-109838: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of…5.1 MediumN/A0%Oct 16, 2026
CVE-2026-109588: FreeRTOS FreeRTOS-Kernel: Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on…8.8 High9.3 Critical0%Oct 16, 2026
CVE-2026-109587: FreeRTOS FreeRTOS-Kernel: Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might…8.8 High9.3 Critical0%Oct 16, 2026
CVE-2026-102552: FreeRTOS FreeRTOS-Plus-TCP: Improper verification of the source of a communication channel in the DNS resolver in Amazon FreeRTOS-Plus-TCP before…5.9 Medium8.2 High0%Oct 16, 2026
CVE-2026-102551: FreeRTOS FreeRTOS-Plus-TCP: Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon…7.7 High9.2 Critical0%Oct 16, 2026
CVE-2026-107674: IBM i: IBM i 7.3, 7.4, 7.5, and 7.6 is vulnerable to a denial of service to Digital Certificate Manager (DCM) for System TLS…5.1 MediumN/A0%Oct 16, 2026
CVE-2026-111678: Adri van Os antiword: Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c…3.3 Low4.8 Medium0%Oct 16, 2026
CVE-2026-111677: Adri van Os antiword: Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted…5.5 Medium6.8 Medium0%Oct 16, 2026
CVE-2026-97380: MariaDB server: MariaDB server is a community developed fork of MySQL server8.8 HighN/A1%Oct 16, 2026
CVE-2026-92262: MariaDB server: MariaDB server is a community developed fork of MySQL server9.9 CriticalN/A1%Oct 16, 2026
CVE-2026-86047: MariaDB server: MariaDB server is a community developed fork of MySQL server7.7 HighN/A0%Oct 16, 2026
1351-1375 of 409174
‹›