The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111672: data-infra cube-studio: Cube-studio through 2026.09.01 contains a missing authorization vulnerability in myapp/views/view_pipeline.py that…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111671: data-infra cube-studio: Cube-studio through 2026.09.01 contains an insecure direct object reference vulnerability that allows authenticated…7.1 High7.1 HighN/AOct 16, 2026
CVE-2026-111670: clickvisual: ClickVisual through 1.1.2 contains a missing authorization vulnerability in the /api/v2/reports handlers that allows…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111669: izhaorui Zr.Admin.NET: ZR.Admin.NET through 3.8.2 contains an sql injection vulnerability that allows authenticated attackers to manipulate…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111668: beizhu-1209 AIHelms: AIHelms through 0.1.25 contains a missing authorization vulnerability in apps/api/v1/efficiency.py that allows…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111667: getrebuild rebuild: REBUILD through 4.5.0 contains a missing authorization vulnerability in TaskCommentController.commentList that allows…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111666: steedos steedos-platform: Steedos Platform through 3.0.15-beta.51 contains an authorization bypass vulnerability that allows authenticated users…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111665: PiranhaCMS Piranha CMS: Piranha CMS through 12.2 contains a missing authorization vulnerability in the Piranha.Manager LanguageApiController…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111664: safing portmaster: Safing Portmaster before 2.2.5 contains a missing authorization vulnerability that allows unprivileged local processes…4.4 Medium4.8 MediumN/AOct 16, 2026
CVE-2026-111663: chaskiq: Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…8.6 High9.2 CriticalN/AOct 16, 2026
CVE-2026-111662: chaskiq: Chaskiq through 2.0.3 contains a server-side request forgery vulnerability that allows unauthenticated attackers to…5.8 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111661: wayn111 waynboot-mall: waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111660: wayn111 waynboot-mall: waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to…6.5 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111659: wayn111 waynboot-mall: Waynboot-mall through 2.0.0 contains a missing authentication vulnerability that allows unauthenticated attackers to…6.5 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111658: SiteServer SSCMS: SiteServer SSCMS through 7.4.0 contains an authorization bypass vulnerability in ChannelsController that allows…3.8 Low5.1 MediumN/AOct 16, 2026
CVE-2026-111657: beikeshop: BeikeShop through 2.0.0.31 contains an insecure direct object reference vulnerability in the markAsShipped handler of…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111656: zhimaAi chatwiki: ChatWiki through 2.9.6 contains an insecure direct object reference vulnerability that allows authenticated users to…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111655: zoujingli think-plugs-admin: ThinkAdmin think-plugs-admin through 1.0.81 contains an insecure direct object reference vulnerability that allows…3.8 Low5.1 MediumN/AOct 16, 2026
CVE-2026-111654: kerwincui FastBee: FastBee through 2.1.0 contains an insecure direct object reference vulnerability that allows authenticated…6.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111653: 53AI 53AIHub: 53AIHub through 0.5.3 contains a missing authentication vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111652: 3xxx engineercms: Engineercms through 2.0.5 contains a missing authorization vulnerability in AttachController.Attachment that allows…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111651: risesoft-y9 Digital-Infrastructure: Risesoft Digital-Infrastructure through 9.6.11 contains a missing authorization vulnerability in the log module…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111650: HoshinoSuzumi chronoframe: ChronoFrame through 1.0.0 contains a missing authentication vulnerability in the server/api/wizard/ handlers that…8.6 High8.8 HighN/AOct 16, 2026
CVE-2026-111649: rocboss paopao-ce: Rocboss paopao-ce through 0.6.0-alpha.3 contains an insecure direct object reference vulnerability in…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111648: build-admin buildadmin: BuildAdmin through 2.3.9 contains an insecure direct object reference vulnerability that allows authenticated backend…2.7 Low5.1 MediumN/AOct 16, 2026
151-175 of 412906
‹›