The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-115657: KNIME KNIME Analytics Platform: When used as an executor in either KNIME Server or KNIME Business Hub, KNIME Analytics Platform LTS versions before…N/A4.8 MediumN/AOct 23, 2026
CVE-2026-112860: xnau webdesign Participants Database: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in xnau webdesign…9.3 CriticalN/AN/AOct 23, 2026
CVE-2026-112862: xnau webdesign Participants Database: Deserialization of Untrusted Data vulnerability in xnau webdesign Participants Database participants-database allows…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-112835: e4jvikwp VikRentCar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp…7.1 HighN/AN/AOct 23, 2026
CVE-2026-112837: Ruben Garcia GamiPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Ruben Garcia…8.5 HighN/AN/AOct 23, 2026
CVE-2026-112359: Amauri.IO WPMobile.App: Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Exploiting Incorrectly Configured…7.5 HighN/AN/AOct 23, 2026
CVE-2026-112838: e4jvikwp VikRentCar: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in e4jvikwp…7.1 HighN/AN/AOct 23, 2026
CVE-2026-112821: Knit Pay: Missing Authorization vulnerability in Knit Pay Knit Pay knit-pay allows Exploiting Incorrectly Configured Access…6.5 MediumN/AN/AOct 23, 2026
CVE-2026-112825: Magepeople inc. Car Rental Manager: Missing Authorization vulnerability in Magepeople inc6.5 MediumN/AN/AOct 23, 2026
CVE-2026-4951: VertiGIS Ltd. WebOrderSystem (KundenManager): The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to search for…N/A5.1 MediumN/AOct 23, 2026
CVE-2026-4950: VertiGIS Ltd. WebOrderSystem (KundenManager): The CustomerAdministration portal (KundenManager) of VertiGIS WebOrderSystem allows privileged users to manage the…N/A4.8 MediumN/AOct 23, 2026
CVE-2026-63244: WizLearn Technologies Pte. Ltd. Learning Management System: An authentication bypass vulnerability in WizLearn Technologies' Learning Management System (LMS) could allow an…9.8 CriticalN/AN/AOct 23, 2026
CVE-2026-75775: ASUS Router: Improper Neutralization of Special Elements used in an OS Command in certain ASUS routers allows remote user to execute…N/A7.7 HighN/AOct 23, 2026
CVE-2026-93489: ASUS Router: Improper Authentication in ASUS router modules allows an unauthenticated nearby user to send an HTTP request and forge…N/A8.7 HighN/AOct 23, 2026
CVE-2026-75779: ASUS Router: Improper Neutralization of Special Elements used in an OS Command (“OS Command Injection”) and Cross-Site Request…N/A8.6 HighN/AOct 23, 2026
CVE-2026-63243: Creative Labs: An authentication vulnerability in the Bluetooth Low Energy (BLE) implementation of Creative Sound Blaster Katana could…4.3 MediumN/AN/AOct 23, 2026
CVE-2026-55981: Creative Labs: A firmware verification vulnerability in Creative Sound Blaster Katana could allow an attacker to modify a legitimate…9.6 CriticalN/AN/AOct 23, 2026
CVE-2026-94268: Unknown: The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress…N/AN/AN/AOct 23, 2026
CVE-2026-94267: Unknown: The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress…N/AN/AN/AOct 23, 2026
CVE-2026-94264: Unknown: The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress…N/AN/AN/AOct 23, 2026
CVE-2026-94262: Unknown: The Advanced Custom Fields: Extended WordPress plugin before 0.9.2.8, Advanced Custom Fields: Extended PRO WordPress…N/AN/AN/AOct 23, 2026
CVE-2026-113501: Unknown LiteSpeed Cache: The LiteSpeed Cache WordPress plugin before 7.9.2 does not perform a capability check on its admin-notice dismissal…N/AN/AN/AOct 23, 2026
CVE-2026-113500: Unknown LiteSpeed Cache: The LiteSpeed Cache WordPress plugin before 7.9.2 does not limit one of its HTML optimization routines to stylesheet…N/AN/AN/AOct 23, 2026
CVE-2026-113499: Unknown LiteSpeed Cache: The LiteSpeed Cache WordPress plugin before 7.9.2 does not restrict one of its HTML rewriting routines to stylesheet…N/AN/AN/AOct 23, 2026
CVE-2026-113472: Unknown Depicter — Popup & Slider Builder: The Depicter — Popup & Slider Builder WordPress plugin before 4.8.2 does not properly validate uploaded files in its…N/AN/AN/AOct 23, 2026
151-175 of 545063
‹›