The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-91057: Eclipse Foundation Eclipse ThreadX - GUIX: `_gx_multi_line_text_view_display_info_get()` reads one byte past the end of the application's text buffer when the…N/A4.6 MediumN/AOct 20, 2026
CVE-2026-90800: Apache Software Foundation Apache CouchDB: Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read…N/A8.1 HighN/AOct 20, 2026
CVE-2026-90799: Apache Software Foundation Apache CouchDB: Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user…N/A1.3 LowN/AOct 20, 2026
CVE-2026-90798: Apache Software Foundation Apache CouchDB: A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a…N/A0.6 LowN/AOct 20, 2026
CVE-2026-90797: Apache Software Foundation Apache CouchDB: An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote…N/A7.7 HighN/AOct 20, 2026
CVE-2026-86471: Apache Software Foundation Apache CouchDB: An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server…N/A9.3 CriticalN/AOct 20, 2026
CVE-2026-113703: giuseppe99barchetta SuggestArr: SuggestArr before 3.0.0 contains an authentication bypass vulnerability in its local_bypass authentication mode where…9.3 Critical9.1 CriticalN/AOct 20, 2026
CVE-2026-113683: jcrodriguez-dis moodle-mod_vpl: VPL (Virtual Programming Lab) for Moodle before 5.0.0 contains a reflected cross-site scripting vulnerability that…6.1 Medium5.1 MediumN/AOct 20, 2026
CVE-2026-113682: networknt light-4j: Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that…7.4 High9.1 CriticalN/AOct 20, 2026
CVE-2026-113681: AcademySoftwareFoundation OpenImageIO: OpenImageIO before 3.0.20.0, 3.1.x before 3.1.15.0, and 3.2.x before 3.2.0.3-beta1 contains an integer overflow in…5.5 Medium6.8 MediumN/AOct 20, 2026
CVE-2026-113680: harfbuzz: HarfBuzz from 8.0.0 through 14.6.0 contains a NULL pointer dereference vulnerability in the experimental WebAssembly…5.5 Medium6.8 MediumN/AOct 20, 2026
CVE-2026-113679: harfbuzz: HarfBuzz 8.0.0 through 14.6.0 contains an out-of-bounds write vulnerability in the experimental WebAssembly shaper…7.0 High7.3 HighN/AOct 20, 2026
CVE-2026-113678: froxlor: Froxlor before 2.3.15 contains a symlink following vulnerability in Statistics::makeChownWithNewStats that allows…9.9 Critical9.4 CriticalN/AOct 20, 2026
CVE-2026-113677: froxlor: Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113676: froxlor: Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113613: FlexGet: FlexGet before 3.20.7 contains a path traversal vulnerability in the decompress plugin that allows remote attackers to…8.1 High9.2 CriticalN/AOct 20, 2026
CVE-2026-113612: CodeWithCJ SparkyFitness: SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113611: outline: Outline before 1.8.0 contains an improper access revocation vulnerability that allows deleted administrators to keep…4.9 Medium6.9 MediumN/AOct 20, 2026
CVE-2026-113610: vatesfr xen-orchestra: Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113609: Bandisoft Bandizip: Bandisoft Bandizip before 7.47 fails to propagate Mark-of-the-Web to extracted .ps1 and .psm1 files, allowing attackers…3.3 Low4.8 MediumN/AOct 20, 2026
CVE-2026-113608: jleyva moodle-block_configurablereports: Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection…5.3 Medium6.0 MediumN/AOct 20, 2026
CVE-2026-113607: jleyva moodle-block_configurablereports: Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows…6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-113606: Stirling-Tools Stirling-PDF: Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to…7.1 High7.1 HighN/AOct 20, 2026
CVE-2026-113605: Stirling-Tools Stirling-PDF: Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that…7.2 High8.6 HighN/AOct 20, 2026
CVE-2026-113604: NationalSecurityAgency ghidra: Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that…5.5 Medium6.8 MediumN/AOct 20, 2026
1626-1650 of 407346
‹›