The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111717: nduckmink arkon: Arkon through 0.9.2 contains a missing authorization vulnerability in list_skill_versions that allows authenticated…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111716: nduckmink arkon: Arkon through 0.9.2 contains a broken access control vulnerability that allows authenticated employees to read and…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111715: nduckmink arkon: Arkon through 0.9.2 contains a missing authorization vulnerability in GET /api/wiki/graph that lets authenticated…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111714: AmauriC tarteaucitron.js: tarteaucitron.js before 1.37.0 contains a regular expression denial of service vulnerability that allows attackers to…3.1 Low2.3 LowN/AOct 16, 2026
CVE-2026-111713: AmauriC tarteaucitron.js: tarteaucitron.js before 1.37.0 contains a cross-site scripting vulnerability because getElemAttr resolves 'data-'…5.4 Medium5.1 MediumN/AOct 16, 2026
CVE-2026-111712: Netcore NR256CN: Netcore NR256CN through 1.5.140116 contains an authentication bypass vulnerability that allows unauthenticated…6.5 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111711: Netcore NR256CN: Netcore NR256CN through 1.5.140116 contains a pre-authentication stack overflow vulnerability in the Boa web server's…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111710: Netcore NR256CN: Netcore NR256CN through 1.5.140116 contains a NULL pointer dereference vulnerability in the Boa web server's…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111709: canove whaticket-community: WhaTicket Community through commit cf04795 contains an insecure direct object reference vulnerability that allows…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111708: canove whaticket-community: WhaTicket Community through commit cf04795 contains an authentication bypass vulnerability that allows unauthenticated…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111707: vastxie 99AI: 99AI through 4.3.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111706: vastxie 99AI: 99AI through 4.3.0 contains a missing authentication vulnerability in the POST /api/chatLog/exportExcel route that…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111705: fushengqian fuint: Fuint through commit 57ec018 contains an insecure direct object reference vulnerability that allows authenticated…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111704: langchat: LangChat through commit 2a6285a contains a missing authentication vulnerability that allows unauthenticated remote…9.8 Critical9.3 CriticalN/AOct 16, 2026
CVE-2026-111703: guchengwuyue yshop-crm: yshop-crm through 2.1.3 contains an insecure direct object reference vulnerability that allows authenticated sales…6.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111702: sugarforever chat-ollama: ChatOllama through commit 96c3ce5 contains an insecure direct object reference vulnerability that allows remote…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111701: OtterMind Nubase: OtterMind Nubase through 0.1.4 contains a missing authentication vulnerability that allows unauthenticated attackers to…7.0 High8.3 HighN/AOct 16, 2026
CVE-2026-111700: WebVella WebVella-ERP: WebVella ERP through 1.8.8 contains an sql injection vulnerability that allows any authenticated user to inject SQL…7.1 High7.1 HighN/AOct 16, 2026
CVE-2026-111699: niefy wx-api: Niefy wx-api through 0.8.2 contains an authentication bypass vulnerability that allows unauthenticated attackers to…4.8 Medium6.3 MediumN/AOct 16, 2026
CVE-2026-111698: roinli HUIZHI-ChargeOS-cloud: HUIZHI ChargeOS cloud through 3.0.9 contains a missing authorization vulnerability in the hcp-mp…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111697: roinli HUIZHI-ChargeOS-cloud: HUIZHI ChargeOS cloud through 3.0.9 contains an insecure direct object reference vulnerability in the hcp-mp…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111696: shaiwz data-platform-open: data-platform-open through commit efeacd3 uses a hardcoded, publicly known default AES key in…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111695: shaiwz data-platform-open: Shaiwz data-platform-open through commit efeacd3 contains an insecure direct object reference vulnerability that allows…7.1 High7.1 HighN/AOct 16, 2026
CVE-2026-111694: qiantongtech qKnow: qKnow through 2.4.3 contains a missing authentication vulnerability that allows unauthenticated remote attackers to…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111693: databufflabs databuff: DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated…9.8 Critical9.3 CriticalN/AOct 16, 2026
176-200 of 400147
‹›