The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111622: a466350665 smart-sso: smart-sso through 2.1.1 contains an open redirect vulnerability in the /login handler that allows unauthenticated…6.8 Medium7.6 HighN/AOct 16, 2026
CVE-2026-111621: TDuckCloud tduck-survey-form: TDuck Survey Form through 5.3 contains a missing authorization vulnerability that allows any authenticated user to read…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111620: O2OA: O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x_processplatform_assemble_surface that allows…5.3 Medium6.0 MediumN/AOct 16, 2026
CVE-2026-111619: zyx0814 FilePress: FilePress through 3.0.1 contains an sql injection vulnerability that allows authenticated low-privilege users to inject…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111618: coaidev CoAI: CoAI (Chat Nio) through 4.0.0 contains an unauthenticated path traversal vulnerability in the generation and article…5.3 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111617: MGdaasLab WHartTest: WHartTest through 2.8.1 contains a missing authentication vulnerability that allows unauthenticated attackers to…6.5 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111616: Oqtane Oqtane Framework: Oqtane Framework through 10.2.6 contains an authorization bypass vulnerability in SettingController that allows a site…4.9 Medium6.9 MediumN/AOct 16, 2026
CVE-2026-111615: gz-yami mall4cloud: Mall4cloud through 4.0 contains an insecure direct object reference vulnerability that allows authenticated merchants…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111614: devlive-community DataCap: DataCap through 2025.1.1 contains an insecure direct object reference vulnerability in BaseController.getInfoForPath…6.5 Medium7.1 HighN/AOct 16, 2026
CVE-2026-111613: alldatacenter alldata: AllData through 0.7.1 contains an unauthenticated JDBC injection vulnerability that allows remote attackers to open…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111612: qaiu netdisk-fast-download: netdisk-fast-download through 0.4.8 contains an information disclosure vulnerability that allows unauthenticated…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-111611: roncoo roncoo-education: roncoo-education through 25.0.0-RELEASE contains an insecure direct object reference vulnerability that allows…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111610: b3log Solo: B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated…5.4 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111609: PKP Open Journal Systems: PKP Open Journal Systems through 3.5.0-5 contains an insecure direct object reference vulnerability that allows journal…3.8 Low5.1 MediumN/AOct 16, 2026
CVE-2026-111608: jeequan jeepay: Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant…4.2 Medium2.3 LowN/AOct 16, 2026
CVE-2026-111607: jeequan jeepay: Jeepay through 3.2.9 contains an insecure direct object reference vulnerability that allows authenticated merchant…7.1 High7.1 HighN/AOct 16, 2026
CVE-2026-111606: hcengineering Huly Platform: Huly Platform through 0.7.432 contains a missing authorization vulnerability that allows any authenticated user to…8.1 High8.6 HighN/AOct 16, 2026
CVE-2026-111605: dromara Jpom: Jpom through 2.11.12 contains an authorization bypass vulnerability in SshFileController that allows authenticated…8.1 High8.6 HighN/AOct 16, 2026
CVE-2026-111604: elunez eladmin: eladmin through 2.7 contains an authorization bypass vulnerability that allows department-scoped user managers to…3.8 Low5.1 MediumN/AOct 16, 2026
CVE-2026-111603: PlayEdu: PlayEdu through 2.3 contains a missing authorization vulnerability in the CourseController that allows authenticated…4.3 Medium5.3 MediumN/AOct 16, 2026
CVE-2026-111392: sgl-project sglang: SGLang through 0.5.21 trusts caller-supplied mm_hashes values as the multimodal prefix-cache key, allowing remote…4.8 Medium6.3 MediumN/AOct 16, 2026
CVE-2026-109839: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.0 could allow a remote authenticated attacker to bypass security restrictions due to a missing…3.1 LowN/AN/AOct 16, 2026
CVE-2026-109838: IBM Db2 Genius Hub: IBM Db2 Genius Hub 1.0 could allow a local attacker to obtain sensitive information due to improper verification of…5.1 MediumN/AN/AOct 16, 2026
CVE-2026-109588: FreeRTOS FreeRTOS-Kernel: Numeric truncation of the buffer length in the MPU buffer authorization check in FreeRTOS-Kernel V11.3.0 and V11.3.1 on…8.8 High9.3 CriticalN/AOct 16, 2026
CVE-2026-109587: FreeRTOS FreeRTOS-Kernel: Incorrect authorization in the Arm Cortex-R82 (Armv8-R AArch64) MPU port in FreeRTOS-Kernel V11.3.0 and V11.3.1 might…8.8 High9.3 CriticalN/AOct 16, 2026
201-225 of 412906
‹›