The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-116018: ONEARMY community-platform: ONEARMY community-platform before 2.165.2 contains an insecure direct object reference vulnerability that allows…4.3 Medium5.3 MediumN/AOct 24, 2026
CVE-2026-116017: xinnan-tech xiaozhi-esp32-server: Xiaozhi-esp32-server before 0.9.8 contains an insecure direct object reference vulnerability in the manager-api…4.3 Medium5.3 MediumN/AOct 24, 2026
CVE-2026-116016: YunaiV yudao-cloud: yudao-cloud through 2026.09 contains an authorization bypass vulnerability that allows authenticated users to evade…7.1 High7.1 HighN/AOct 24, 2026
CVE-2026-116015: YunaiV yudao-cloud: yudao-cloud through 2026.09 contains an insecure direct object reference vulnerability in the mall trade module that…4.3 Medium5.3 MediumN/AOct 24, 2026
CVE-2026-116014: open62541: open62541 1.5.0 before 1.5.7 contains an integer overflow in UA_DataType_fromStructureDescription() that wraps the…8.1 High9.2 CriticalN/AOct 24, 2026
CVE-2026-116013: openresty lua-resty-dns: OpenResty lua-resty-dns before 0.24 contains an improper input validation vulnerability in parse_section() and…3.7 Low6.3 MediumN/AOct 24, 2026
CVE-2026-116012: NationalSecurityAgency ghidra: Ghidra before 12.2 contains a numeric truncation vulnerability in PackedDecode::skipAttribute and…3.6 Low2.0 LowN/AOct 24, 2026
CVE-2026-116011: CrowCpp Crow: Crow before 1.3.4 contains an uncontrolled recursion vulnerability in crow::json::load() that allows remote…7.5 High8.7 HighN/AOct 24, 2026
CVE-2026-116010: francoisjacquet RosarioSIS: RosarioSIS before 12.9.1 contains a missing authorization vulnerability that allows authenticated teachers to write…4.3 Medium5.3 MediumN/AOct 24, 2026
CVE-2026-116009: owen2345 camaleon-cms: Camaleon CMS before 2.9.3 contains a path traversal vulnerability that allows users with only the media permission to…8.8 High8.7 HighN/AOct 24, 2026
CVE-2026-116008: Bottelet DaybydayCRM: DaybydayCRM through 2.2.1 contains a missing authorization vulnerability in ProjectsController::updateAssign() that…4.3 Medium5.3 MediumN/AOct 24, 2026
CVE-2026-110018: kodezen: The aBlocks – Gutenberg Blocks, User Dashboard Builder, Popup Builder, Form Builder & Animation Builder plugin for…8.8 HighN/AN/AOct 24, 2026
CVE-2026-115998: CervantesSec cervantes: IDOR in Cervantes version v1.3-beta could allow an authenticated attacker ca access sensitive findings,…4.3 MediumN/A0%Oct 24, 2026
CVE-2026-115994: CervantesSec cervantes: BOLA Allows Cross-Project Target Tampering in Cervantes version v1.3-beta could allow an attacker modify or delete…5.4 MediumN/A0%Oct 24, 2026
CVE-2026-114705: quadlayers WP Social Feed Gallery: Missing Authorization vulnerability in quadlayers WP Social Feed Gallery insta-gallery allows Exploiting Incorrectly…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-114194: Igor Funa Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-115993: CervantesSec cervantes: Stored XSS vulnerability in the “Notes” field of the Checklists in Cervantes version v1.3-beta could allow an attacker…6.8 MediumN/A0%Oct 24, 2026
CVE-2026-94075: Tribulant Software Newsletters: Deserialization of Untrusted Data vulnerability in Tribulant Software Newsletters newsletters-lite allows Object…9.8 CriticalN/A1%Oct 24, 2026
CVE-2026-114697: QuarkA QA Analytics: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in QuarkA QA…7.1 HighN/A0%Oct 24, 2026
CVE-2026-114695: Infomaniak Network VOD Infomaniak: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Infomaniak…7.1 HighN/A0%Oct 24, 2026
CVE-2026-114694: Pixelite Events Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Pixelite Events…7.1 HighN/A0%Oct 24, 2026
CVE-2026-114693: Plugins360 Labs All-in-One Video Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs…6.5 MediumN/A0%Oct 24, 2026
CVE-2026-114196: paytiumsupport Paytium: Deserialization of Untrusted Data vulnerability in paytiumsupport Paytium paytium allows Object Injection.This issue…9.8 CriticalN/A1%Oct 24, 2026
CVE-2026-114190: Hai Zheng / Lite Speed Cache LiteSpeed Cache: Insertion of Sensitive Information Into Sent Data vulnerability in Hai Zheng / Lite Speed Cache LiteSpeed Cache…5.9 MediumN/A0%Oct 24, 2026
CVE-2026-114179: wordplus BP Better Messages: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wordplus BP…7.1 HighN/A0%Oct 24, 2026
151-175 of 537999
‹›