The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111702: sugarforever chat-ollama: ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111701: OtterMind Nubase: OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to…7.0 High8.3 HighN/AOct 16, 2026
CVE-2026-111700: WebVella WebVella-ERP: WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL…7.1 High7.1 HighN/AOct 16, 2026
CVE-2026-111699: niefy wx-api: Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to…4.8 Medium6.3 MediumN/AOct 16, 2026
CVE-2026-111698: roinli HUIZHI-ChargeOS-cloud: HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111697: roinli HUIZHI-ChargeOS-cloud: HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111696: shaiwz data-platform-open: data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111695: shaiwz data-platform-open: Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows…7.1 High7.1 HighN/AOct 16, 2026
CVE-2026-111694: qiantongtech qKnow: qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111693: databufflabs databuff: DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111692: databufflabs databuff: DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111691: wimoor-erp wimoor: WIMOOR through commit ec86736 contains an authentication bypass vulnerability that allows attackers to impersonate any…7.4 High9.1 CriticalN/AOct 16, 2026
CVE-2026-111690: suyuan32 simple-admin-core: Simple Admin Core through 1.8.7 contains an authentication bypass vulnerability that allows unauthenticated attackers…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111689: Exrick xboot: Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to read user…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111688: Exrick xboot: Exrick XBoot through 3.3.4 contains an authorization bypass vulnerability that allows authenticated users to evade role…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111687: rachelos we-mp-rss: WeRSS (we-mp-rss) through 1.5.3 contains a remote code execution vulnerability that allows unauthenticated attackers to…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111686: Thecosy IceCMS: IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111685: Thecosy IceCMS: IceCMS through 4.1.5 contains an unauthenticated sql injection vulnerability that allows remote attackers to inject SQL…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111684: absmach magistrala: Magistrala through 1.0.0 contains an authorization bypass vulnerability that allows authenticated workspace members to…8.3 High7.2 HighN/AOct 16, 2026
CVE-2026-111683: allegro ralph: Allegro Ralph through 20260902.1 contains a missing authorization vulnerability that allows authenticated staff users…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111682: smartloli EFAK: EFAK 5.0.0 through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111681: smartloli EFAK: EFAK through 5.1.0 contains a missing authorization vulnerability that allows authenticated low-privilege users to…8.8 High8.7 HighN/AOct 16, 2026
CVE-2026-111680: APIParkLab APIPark: APIPark through 1.9.7-beta contains an authorization bypass vulnerability that allows authenticated team managers to…8.3 High7.2 HighN/AOct 16, 2026
CVE-2026-111679: EKKOLearnAI ekko-studio: Ekko Studio through 0.7.36 contains a missing authorization vulnerability that allows any authenticated non-super_admin…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111678: Adri van Os antiword: Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c…3.3 Low4.8 MediumN/AOct 16, 2026
126-150 of 412906
‹›