The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-92999: Unknown Click n Chat (Chat Widget Integration): The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105999: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not perform authorization checks before returning…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-105998: Unknown Booking Package: The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before…5.3 MediumN/A0%Oct 21, 2026
CVE-2026-114089: triggerdotdev trigger.dev: Trigger.dev before 4.5.2 contains a cross-site request forgery vulnerability in the CLI authorization-code flow because…8.8 High8.7 High0%Oct 21, 2026
CVE-2026-114082: triggerdotdev trigger.dev: Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write…8.1 High7.2 High0%Oct 21, 2026
CVE-2026-114079: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an improper authorization vulnerability that allows holders of lower-trust…5.4 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-114078: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in DeleteTaskScheduleService and…8.1 High7.2 High0%Oct 21, 2026
CVE-2026-114077: triggerdotdev trigger.dev: Trigger.dev before 4.5.6 contains an authorization bypass vulnerability in createDeploymentBackgroundWorkerV4 that…7.1 High6.1 Medium0%Oct 21, 2026
CVE-2026-114075: triggerdotdev trigger.dev: Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows holders of capability-restricted…5.4 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-114071: triggerdotdev trigger.dev: Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to…3.1 Low2.3 Low0%Oct 21, 2026
CVE-2026-114069: triggerdotdev trigger.dev: Trigger.dev before 4.6.0 contains an improper authorization vulnerability in the GET…8.1 High8.6 High0%Oct 21, 2026
CVE-2026-114068: triggerdotdev trigger.dev: Trigger.dev before 4.6.0 contains a missing authorization vulnerability in the waitpoint token wait endpoint that…8.3 High7.2 High0%Oct 21, 2026
CVE-2026-114067: triggerdotdev trigger.dev: Trigger.dev 4.5.0 before 4.6.2 contains an improper authorization vulnerability in the PUT snapshot-url session…6.5 Medium7.1 High0%Oct 21, 2026
CVE-2026-114066: triggerdotdev trigger.dev: Trigger.dev before 4.7.0 contains a missing authorization vulnerability that allows holders of unrestricted environment…8.1 High7.2 High0%Oct 21, 2026
CVE-2026-114059: ArcadeData arcadedb: ArcadeDB before 26.10.1 contains a remote code execution vulnerability that allows authenticated users, including…7.5 High7.7 High0%Oct 21, 2026
CVE-2026-114058: ArcadeData arcadedb: ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that…4.3 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-114057: ArcadeData arcadedb: ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that…4.3 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-114056: ArcadeData arcadedb: ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to…4.3 Medium5.3 Medium0%Oct 21, 2026
CVE-2026-113727: openchoreo: OpenChoreo is a developer platform for Kubernetes7.4 HighN/A0%Oct 20, 2026
Google Chrome Vulnerability: CVE-2026-1131288.8 HighN/A0%Oct 20, 2026
CVE-2026-112712: @fastify/middie: @fastify/middie is the Express-style middleware engine for Fastify9.1 CriticalN/A0%Oct 20, 2026
Red Hat: CVE-2026-86409: curl: curl: stale SigV4 headers sent unintendedN/AN/A0%Oct 20, 2026
CVE-2026-112380: Amazon Kiro Crew: Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an…9.9 Critical9.0 Critical0%Oct 20, 2026
CVE-2026-113643: n/a EspoCRM: A vulnerability was found in EspoCRM up to 9.3.10/10.0.104.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113660: apostrophecms apostrophe: ApostropheCMS is an open-source Node.js content management system4.3 MediumN/A0%Oct 20, 2026
151-175 of 12118
‹›