The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-112861: xnau webdesign Participants Database: Authorization Bypass Through User-Controlled Key vulnerability in xnau webdesign Participants Database…6.3 MediumN/A0%Oct 20, 2026
CVE-2026-111756: follow-redirects: follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirectsN/A8.2 High0%Oct 20, 2026
CVE-2026-28328: SolarWinds SolarWinds Observability Self-Hosted: SolarWinds Observability Self-Hosted was found to be affected by a broken authorization schema that can allow…8.8 HighN/A0%Oct 20, 2026
CVE-2026-113655: apostrophecms apostrophe: ApostropheCMS is an open-source Node.js content management system4.3 MediumN/A0%Oct 20, 2026
CVE-2026-113648: apostrophecms, @apostrophecms: ApostropheCMS is an open-source Node.js content management system3.1 LowN/A0%Oct 20, 2026
CVE-2026-113682: networknt light-4j: Networknt light-4j from 2.1.5 before 2.4.0 contains an authentication bypass vulnerability in BasicAuthHandler that…7.4 High9.1 Critical0%Oct 20, 2026
CVE-2026-113677: froxlor: Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command…5.4 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113676: froxlor: Froxlor from 0.10.0 before 2.3.15 contains an authorization bypass vulnerability in the Admins.get API command that…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113612: CodeWithCJ SparkyFitness: SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete…5.4 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113610: vatesfr xen-orchestra: Xen Orchestra before 6.9.0 contains an authorization bypass vulnerability in the xo-server user.set API method that…5.4 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113607: jleyva moodle-block_configurablereports: Configurable Reports block for Moodle before 5.3.0 contains an authorization bypass vulnerability that allows…6.5 Medium7.1 High0%Oct 20, 2026
CVE-2026-113606: Stirling-Tools Stirling-PDF: Stirling-PDF 3.0.0 through 3.2.0 contains an authorization bypass vulnerability that allows authenticated users to…7.1 High7.1 High0%Oct 20, 2026
CVE-2026-113603: x402-foundation: The x402 SIWX server extension in @x402/extensions 2.3.1 through 2.28.0, x402 PyPI 2.11.0 through 2.25.0, and Go module…6.5 Medium6.9 Medium0%Oct 20, 2026
CVE-2026-113601: usememos memos: Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113600: fatfreecrm fat_free_crm: Fat Free CRM before 0.26.0 contains an insecure direct object reference vulnerability that allows authenticated users…5.4 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113596: webstudio-is webstudio: Webstudio before 0.256.0 contains a missing authorization vulnerability that allows authenticated users to read other…3.1 Low2.3 Low0%Oct 20, 2026
CVE-2026-113595: sharkord: Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113594: sharkord: Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change…5.4 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113359: Baserow: Baserow before 2.3.0 contains a missing authorization vulnerability that allows any authenticated user to read field…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-112955: apostrophecms, @apostrophecms: ApostropheCMS is an open-source Node.js content management system6.5 MediumN/A0%Oct 20, 2026
CVE-2026-112829: Arraytics Booktics: Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access…5.3 MediumN/A0%Oct 20, 2026
CVE-2026-112824: Magepeople inc. Bus Ticket Booking with Seat Reservation: Missing Authorization vulnerability in Magepeople inc5.3 MediumN/A0%Oct 20, 2026
CVE-2026-112823: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User…4.3 MediumN/A0%Oct 20, 2026
CVE-2026-111765: a2aproject a2a-java: A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol7.5 HighN/A1%Oct 20, 2026
CVE-2026-111764: a2aproject a2a-java: A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol7.5 HighN/A1%Oct 20, 2026
176-200 of 12118
‹›