The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-109700: eLightUp Meta Box – WordPress Custom Fields Framework: Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting…6.5 MediumN/A0%Oct 20, 2026
CVE-2026-113411: Nerimity Desktop: A vulnerability was found in Nerimity Desktop up to 2.2.26.3 Medium2.1 Low0%Oct 20, 2026
CVE-2026-112834: Castos Seriously Simple Podcasting: Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting…5.3 MediumN/A0%Oct 20, 2026
CVE-2026-9589: Unblu inc. Unblu Spark: Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu incN/A9.3 Critical0%Oct 20, 2026
CVE-2026-113357: tester-army @e2e-dev/github: @e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to…3.5 Low5.1 Medium0%Oct 20, 2026
CVE-2026-113353: ThimPress LearnPress: LearnPress before 4.4.10 contains a missing authorization vulnerability in the admin_course_editor, admin_quiz_editor…5.4 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-113349: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in CalendarUI::onEditEvent() and onDeleteEvent()…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-112787: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-112786: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows…5.4 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-112785: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename,…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-112784: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-112783: OpenCATS: OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and…4.3 Medium5.3 Medium0%Oct 20, 2026
CVE-2026-112237: TYPO3 Extension "Kitodo.Presentation": The extension provides a public proxy endpoint that fetches a URL on behalf of the visitorN/A6.9 Medium0%Oct 20, 2026
Red Hat: CVE-2026-110095: fast-uri: fast-uri: Path traversal via improper relative URI normalization3.7 LowN/A0%Oct 20, 2026
CVE-2026-12489: Zyxel EX3501-T0 firmware: An incorrect authorization vulnerability in the Data Access Layer (DAL) of Zyxel EX3501-T0 firmware versions through…6.5 MediumN/A0%Oct 20, 2026
CVE-2026-105299: Cloudflare https://github.com/cloudflare/pingora: Summary Before version 0.9.0, the HTTP/1 upstream path in pingora-proxy passed the downstream request through…8.7 HighN/A0%Oct 20, 2026
CVE-2026-86977: Apple iOS and iPadOS: An authorization issue was addressed with improved network restrictionsN/AN/A0%Oct 20, 2026
CVE-2026-86976: Apple: An authorization issue was addressed with improved state management5.5 MediumN/A0%Oct 20, 2026
CVE-2026-86955: Apple iOS and iPadOS: An authorization issue was addressed with improved state management5.5 MediumN/A0%Oct 20, 2026
CVE-2026-86932: Apple macOS: An authorization issue was addressed with improved state management5.5 MediumN/A0%Oct 20, 2026
CVE-2026-86907: Apple macOS: An authorization issue was addressed with improved entitlement checks4.4 MediumN/A0%Oct 20, 2026
CVE-2026-28850: Apple visionOS: An authorization issue was addressed with improved state management5.5 MediumN/A0%Oct 20, 2026
CVE-2026-105814: TP-Link Systems Inc. Tapo C210 v3.6: TP-Link Tapo C210 V3.60 contains an authentication bypass vulnerability in the DS JSON APIN/A5.3 Medium0%Oct 19, 2026
CVE-2026-112776: Incorrect Authorization9.8 Critical9.3 Critical0%Oct 19, 2026
CVE-2025-10149: WSO2: The SCIM endpoint does not sufficiently validate authorization for federated users when performing operations against…8.2 HighN/A0%Oct 19, 2026
201-225 of 12117
‹›