The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-105941: Red Hat streams for Apache Kafka 3: The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes…8.1 HighN/AN/AOct 20, 2026
CVE-2026-18205: Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform: Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ticimax…6.1 MediumN/AN/AOct 20, 2026
CVE-2026-14933: Unblu inc. Unblu Spark: Cross-site scripting in the embedded co-browsing feature in Unblu incN/A8.6 HighN/AOct 20, 2026
CVE-2026-113583: cypht-org cypht: Cypht webmail 2.0.0 through 2.12.2 contains a DOM-based cross-site scripting vulnerability that allows remote attackers…6.1 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113496: Red Hat: A flaw was found in cockpit-machines5.0 MediumN/AN/AOct 20, 2026
CVE-2026-113495: Red Hat: A flaw was found in cockpit-machines5.0 MediumN/AN/AOct 20, 2026
CVE-2026-113389: DrayTek Vigor2960: A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 82189.9 Critical8.6 HighN/AOct 20, 2026
CVE-2026-113388: n/a opensource-socialnetwork: A security flaw has been discovered in opensource-socialnetwork up to 9.11/10.14.3 Medium1.9 LowN/AOct 20, 2026
CVE-2026-113385: LeeDrOiD Labs Shortcutter 2 App: A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android5.3 Medium1.9 LowN/AOct 20, 2026
CVE-2026-105949: Red Hat: Cruise Control's Jetty ConstraintSecurityHandler registers security constraints on exact path specs without a catch-all…8.8 HighN/AN/AOct 20, 2026
CVE-2026-105312: Red Hat: A Kubernetes tenant with create permission on Console custom resources can set spec.containers.api.spec.image to an…9.9 CriticalN/AN/AOct 20, 2026
CVE-2026-105311: Red Hat: The StreamsHub Console operator acts as a confused deputy: a Kubernetes tenant with permission to create a Console…7.7 HighN/AN/AOct 20, 2026
CVE-2026-9589: Unblu inc. Unblu Spark: Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu incN/A9.3 CriticalN/AOct 20, 2026
CVE-2026-113384: Optimal IdM OptimalCloud: A flaw has been found in Optimal IdM OptimalCloud 5.04.3 Medium2.1 LowN/AOct 20, 2026
CVE-2026-113383: Optimal IdM OptimalCloud: A vulnerability was detected in Optimal IdM OptimalCloud 5.04.3 Medium2.1 LowN/AOct 20, 2026
CVE-2026-113382: arizu-id fast-tunnel: A security vulnerability has been detected in arizu-id fast-tunnel 1.0.06.3 Medium2.1 LowN/AOct 20, 2026
CVE-2026-113358: lavalite cms: LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows…7.5 High8.7 HighN/AOct 20, 2026
CVE-2026-113357: tester-army @e2e-dev/github: @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to…3.5 Low5.1 MediumN/AOct 20, 2026
CVE-2026-113356: DokuWiki: DokuWiki before 2026-07-14c contains a PHP object injection vulnerability in Draft::getDraftText() that passes draft…7.5 High7.7 HighN/AOct 20, 2026
CVE-2026-113355: chatwoot: Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to…4.8 Medium4.8 MediumN/AOct 20, 2026
CVE-2026-113354: Finsys dockhand: Dockhand before 1.0.46 contains an arbitrary file read vulnerability that allows non-admin users with stacks:edit…6.5 Medium7.1 HighN/AOct 20, 2026
CVE-2026-113353: ThimPress LearnPress: LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor…5.4 Medium5.3 MediumN/AOct 20, 2026
CVE-2026-113352: uTox: uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending…7.5 High7.7 HighN/AOct 20, 2026
CVE-2026-113351: libexpat: libexpat 2.7.2 through 2.9.0 contains a denial of service vulnerability because XML_ParserReset zeroes the direct byte…5.9 Medium8.2 HighN/AOct 20, 2026
CVE-2026-113350: marmelab react-admin: react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts…5.4 Medium5.1 MediumN/AOct 20, 2026
1751-1775 of 407346
‹›