The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113608: jleyva moodle-block_configurablereports: Configurable Reports block for Moodle (moodle-block_configurablereports) before 5.3.1 contains an sql injection…5.3 Medium6.0 MediumN/AOct 20, 2026
CVE-2026-113607: jleyva moodle-block_configurablereports: Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows…6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-113606: Stirling-Tools Stirling-PDF: Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to…7.1 High7.1 HighN/AOct 20, 2026
CVE-2026-113605: Stirling-Tools Stirling-PDF: Stirling-PDF from 2.13.2 through 3.2.0 contains an incomplete denylist in DatabaseService.validateSqlContent() that…7.2 High8.6 HighN/AOct 20, 2026
CVE-2026-113604: NationalSecurityAgency ghidra: Ghidra 10.2 through 12.1.4 contains a denial of service vulnerability in the ELF loader's ElfHeader class that…5.5 Medium6.8 MediumN/AOct 20, 2026
CVE-2026-113603: x402-foundation: The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module…6.5 Medium6.9 MediumN/AOct 20, 2026
CVE-2026-113602: json-smart: json-smart through 2.6.0 contains an input validation bypass vulnerability that allows attackers to evade strict-mode…5.3 Medium6.9 MediumN/AOct 20, 2026
CVE-2026-113601: usememos memos: Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113600: fatfreecrm fat_free_crm: Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113599: modoboa: Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113598: modoboa: Modoboa before 2.8.0 contains an insecure direct object reference vulnerability that allows authenticated users to…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113597: blinkospace blinko: Blinko through 1.8.8 contains an insecure direct object reference vulnerability in the tag tRPC router that allows…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113596: webstudio-is webstudio: Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other…3.1 Low2.3 LowN/AOct 20, 2026
CVE-2026-113595: sharkord: Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113594: sharkord: Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113359: Baserow: Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field…4.3 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-112956: apostrophecms, @apostrophecms: ApostropheCMS is an open-source Node.js content management system6.5 MediumN/AN/AOct 20, 2026
CVE-2026-112955: apostrophecms, @apostrophecms: ApostropheCMS is an open-source Node.js content management system6.5 MediumN/AN/AOct 20, 2026
CVE-2026-112954: apostrophecms apostrophe: ApostropheCMS is an open-source Node.js content management system5.3 MediumN/AN/AOct 20, 2026
CVE-2026-112953: apostrophecms, @apostrophecms: ApostropheCMS is an open-source Node.js content management systemN/A6.0 MediumN/AOct 20, 2026
CVE-2026-112952: apostrophecms apostrophe: ApostropheCMS is an open-source Node.js content management system4.3 MediumN/AN/AOct 20, 2026
CVE-2026-112951: apostrophecms apostrophe: ApostropheCMS is an open-source Node.js content management system5.4 MediumN/AN/AOct 20, 2026
CVE-2026-112950: vitest-dev, @vitest: Vitest is a Vite-native testing framework for JavaScript and TypeScript projects5.9 MediumN/AN/AOct 20, 2026
CVE-2026-112949: vitest-dev, @vitest: Vitest is a Vite-native testing framework for JavaScript and TypeScript projects4.7 MediumN/AN/AOct 20, 2026
CVE-2026-112948: vitest-dev, @vitest, vitejs: Vitest is a testing framework powered by Vite6.5 MediumN/AN/AOct 20, 2026
1651-1675 of 407346
‹›