The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111965: Unknown Profile Builder: The Profile Builder WordPress plugin from 4.0.0 to 4.0.4 does not enforce its reCAPTCHA verification on all comment…4.3 MediumN/AN/AOct 23, 2026
CVE-2026-105963: elixir-plug: Externally-Generated Error Message Containing Sensitive Information vulnerability in plug_crypto in elixir-plug…N/A5.1 MediumN/AOct 23, 2026
CVE-2026-16762: qt: An attacker able to supply a crafted XML document to an application using QXmlStreamReader can cause disproportionate…N/A8.7 HighN/AOct 23, 2026
CVE-2026-89320: Eclipse Foundation Eclipse KeyPont - GOSE: `HmacShaCryptor.Hash` never hashed its inputN/A8.8 HighN/AOct 23, 2026
CVE-2026-25784: Hallo Welt! GmbH BlueSpice: Initialization of a Resource with an Insecure Default vulnerability in Hallo Welt! GmbH BlueSpice (container image…9.8 Critical9.3 CriticalN/AOct 23, 2026
CVE-2026-89319: Eclipse Foundation Eclipse KeyPont - GOSE: `JweDirectDecryptorBlock.Decrypt` read a 64-bit plaintext length from the `_thales_aad` protected-header field and used…N/A6.3 MediumN/AOct 23, 2026
CVE-2026-25716: Hallo Welt! GmbH BlueSpice: Missing Authorization vulnerability in Hallo Welt! GmbH BlueSpice (Extension:BlueSpiceUserManager) allows any…7.1 High7.1 HighN/AOct 23, 2026
CVE-2026-89318: Eclipse Foundation Eclipse KeyPont - GOSE: `JweRsaKeyEncryptionDecryptorImpl.Decrypt` passed the JWE's initialization vector to `cipher.AEAD.Open` without…N/A6.9 MediumN/AOct 23, 2026
CVE-2026-89317: Eclipse Foundation Eclipse KeyPont - GOSE: gose parsed the JWS `crit` header into `JwsHeader.Crit` and then never read itN/A6.3 MediumN/AOct 23, 2026
CVE-2026-89316: Eclipse Foundation Eclipse KeyPont - GOSE: `LoadPublicKey` resolved an EC key's curve with an unchecked type assertion, `algToOptsMap[alg].(*ECDSAOptions)`N/A6.3 MediumN/AOct 23, 2026
CVE-2026-89315: Eclipse Foundation Eclipse KeyPont - GOSE: `JwtClaims.MarshalJSON` built a Go struct at runtime with `reflect.StructOf`, synthesising a field named `"A" +…N/A6.9 MediumN/AOct 23, 2026
CVE-2026-89314: Eclipse Foundation Eclipse KeyPont - GOSE: `jwkFields.CheckConsistency` detected duplicate `key_ops` entries with a pairwise nested loop, making validation cost…N/A6.9 MediumN/AOct 23, 2026
CVE-2026-89313: Eclipse Foundation Eclipse KeyPont - GOSE: `JwksTrustStore.Get` assigned each parsed key to the function's **named return value** while refreshing the JWKS cacheN/A6.3 MediumN/AOct 23, 2026
CVE-2026-89312: Eclipse Foundation Eclipse KeyPont - GOSE: `AesGcmCryptor.Open` passed a caller-supplied nonce straight to `cipher.AEAD.Open` without checking its lengthN/A6.9 MediumN/AOct 23, 2026
CVE-2025-58403: CGM CGM CLININET: CGM CLININET is vulnerable to Reflected Cross-Site Scripting (XSS) due to improper neutralization of user-supplied dataN/A5.1 MediumN/AOct 23, 2026
CVE-2025-30054: CGM CGM CLININET: CGM CLININET is vulnerable to local privilege escalationN/A9.3 CriticalN/AOct 23, 2026
CVE-2025-30053: CGM CGM CLININET: The CGM CLININET application runs the cgm-updater process listening on an open network port without any authenticationN/A6.9 MediumN/AOct 23, 2026
CVE-2025-30052: CGM CGM CLININET: The rsyncd service of the CGM CLININET is vulnerable to Authentication Bypass via IP spoofingN/A8.8 HighN/AOct 23, 2026
CVE-2025-30051: CGM CGM CLININET: The CGM CLININET application stores the production database login and password, as well as RabbitMQ broker credentials,…N/A6.8 MediumN/AOct 23, 2026
CVE-2025-30050: CGM CGM CLININET: CGM CLININET is vulnerable to Code Injection in the RunCGI.pm component, which dynamically imports the module specified…N/A9.4 CriticalN/AOct 23, 2026
CVE-2025-30049: CGM CGM CLININET: The CGM CLININET application stores user passwords as unsalted MD5 hashesN/A8.2 HighN/AOct 23, 2026
CVE-2025-30047: CGM CGM CLININET: CGM CLININET is vulnerable to Remote Code Execution caused by deserialization of untrusted dataN/A9.4 CriticalN/AOct 23, 2026
CVE-2025-30046: CGM CGM CLININET: In the CGM CLININET application server, multiple processes responsible for HL7 communication with external systems run…N/A9.0 CriticalN/AOct 23, 2026
CVE-2025-30045: CGM CGM CLININET: CGM CLININET is vulnerable to Code Injection in the ConvExpr function, which processes Perl expressions into RTF…N/A8.6 HighN/AOct 23, 2026
CVE-2025-30043: CGM CGM CLININET: CGM CLININET is vulnerable to Missing Authentication for Critical Function in the /DocManagment pathN/A7.1 HighN/AOct 23, 2026
126-150 of 545063
‹›