The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-113469: Stormshield Stormshield Network Security: A failure has been identified in the SNS during dynamic data files signature check7.5 HighN/A0%Oct 20, 2026
CVE-2026-113465: Stormshield Stormshield Network Security: It is possible to execute a DOM-based Cross-Site Scripting attack against Stormshield’s web administration panel6.6 MediumN/A0%Oct 20, 2026
CVE-2026-101201: qt: A malformed header in the binary file fed to QBinaryJson::fromBinaryData() can cause undefined behaviour because of…N/A4.3 Medium0%Oct 20, 2026
CVE-2026-43835: Advantech ADAM-3600: A vulnerability in the firmware upgrade functionality could allow an authenticated attacker to upload a forged firmware…N/A8.6 High0%Oct 20, 2026
CVE-2026-43834: Advantech ADAM-3600: A stack-based buffer overflow vulnerability in the logs settings functionality could allow an authenticated attacker to…N/A7.5 High0%Oct 20, 2026
CVE-2026-113407: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 High0%Oct 20, 2026
CVE-2026-113406: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 High0%Oct 20, 2026
CVE-2026-113405: YS-infoware BA-Workflow: BA-Workflow developed by YS-infoware has a SQL Injection vulnerability8.8 High8.7 High0%Oct 20, 2026
CVE-2026-111090: Stormshield Stormshield Network Security: A logic error exists in the signature verification routine resulting in acceptance of unauthenticated update and…7.8 HighN/A0%Oct 20, 2026
CVE-2024-2323: WSO2: The RemoteUserStoreManagerService does not sufficiently validate password change attempts when the password history…4.8 MediumN/A0%Oct 20, 2026
CVE-2026-112177: Red Hat: A flaw was found in Ghostscript as shipped with Red Hat Enterprise Linux 87.3 HighN/A0%Oct 20, 2026
CVE-2026-93878: Divigear DiviGear Carousel: The DiviGear Carousel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via update_license AJAX Action…6.4 MediumN/A0%Oct 20, 2026
CVE-2026-113404: Uniong WebITR: WebITR developed by Uniong has a Insecure Deserialization vulnerability8.8 High8.7 High0%Oct 20, 2026
CVE-2026-113403: ArmorX Global Technology ArmorX Spam: ArmorX Spam developed by ArmorX Global Technology has a Command Injection vulnerability6.5 Medium7.1 High1%Oct 20, 2026
CVE-2026-113402: ArmorX Global Technology ArmorX Spam: ArmorX Spam developed by ArmorX Global Technology has a Local File Inclusion vulnerability6.5 Medium7.1 High0%Oct 20, 2026
CVE-2026-112148: LY Corporation LIFF SDK: A vulnerability has been identified in LIFF SDK versions 2.20.0 through 2.31.0, where a DOM-based cross-site scripting…N/A5.1 Medium0%Oct 20, 2026
CVE-2026-110725: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js3.7 LowN/A0%Oct 20, 2026
CVE-2026-110306: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js6.1 MediumN/A0%Oct 20, 2026
CVE-2026-110180: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js4.8 MediumN/A0%Oct 20, 2026
CVE-2026-110095: fast-uri: fast-uri is a dependency-free RFC 3986 URI parser and serializer for Node.js3.7 LowN/A0%Oct 20, 2026
CVE-2026-97627: Atsumi Electric Co., Ltd.: Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd7.2 High8.6 High0%Oct 20, 2026
CVE-2026-96903: Unknown Easy Property Listings: The Easy Property Listings WordPress plugin before 3.5.27 does not perform authorisation checks on several of its…4.3 MediumN/A0%Oct 20, 2026
CVE-2026-96902: Unknown Easy Property Listings: The Easy Property Listings WordPress plugin before 3.5.28 does not restrict which listing fields it adds to the public…5.3 MediumN/A0%Oct 20, 2026
CVE-2026-93300: EventOn EventON - Subscriber: The EventON - Subscriber plugin for WordPress is vulnerable to generic SQL Injection via the 'email' parameter in all…7.5 HighN/A0%Oct 20, 2026
CVE-2026-100737: Atsumi Electric Co., Ltd.: Hidden functionality issue exists in Multiple DVRs (Digital Video Recorders) provided by Atsumi Electric Co., Ltd4.9 Medium6.9 Medium0%Oct 20, 2026
2276-2300 of 417319
‹›