The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-114665: zhenorzz goploy: Goploy 1.18.0 before 1.18.1 contains a link following vulnerability in the /deploy/fileDiff and /deploy/fileCompare…6.5 Medium7.1 High0%Oct 22, 2026
CVE-2026-112842: Cozmoslabs Paid Member Subscriptions: Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-112832: CozyThemes Rootblox: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…9.8 CriticalN/A0%Oct 22, 2026
CVE-2026-112822: AmentoTech Workreap Core: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in AmentoTech…8.5 HighN/A0%Oct 22, 2026
CVE-2026-112820: Elated-Themes Academist Core: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.1 HighN/A0%Oct 22, 2026
CVE-2026-112313: ACF Extended: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ACF Extended ACF…7.1 HighN/A0%Oct 22, 2026
Red Hat: CVE-2026-111079: goose: goose: Shell History and Environment Leak via Terminal Integration7.4 HighN/A0%Oct 22, 2026
CVE-2025-71434: Weaver Network Co., Ltd. E-cology: Weaver E-cology 8.0, 9.0, and 10.0 prior to 10.76 contains an unauthenticated SQL injection vulnerability in the…8.2 High8.8 High0%Oct 22, 2026
CVE-2024-58396: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High0%Oct 22, 2026
CVE-2024-58394: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2024-58393: Improper Neutralization of Special Elements used in an SQL Command8.2 High8.8 High0%Oct 22, 2026
CVE-2023-54413: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2022-51025: Improper Limitation of a Pathname to a Restricted Directory6.5 Medium7.1 High0%Oct 22, 2026
CVE-2022-51024: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High0%Oct 22, 2026
CVE-2022-51023: Improper Neutralization of Special Elements used in an SQL Command8.2 High8.8 High0%Oct 22, 2026
CVE-2022-51022: Improper Limitation of a Pathname to a Restricted Directory9.1 Critical8.8 High1%Oct 22, 2026
CVE-2022-51021: Improper Neutralization of Special Elements used in an SQL Command8.2 High8.8 High0%Oct 22, 2026
CVE-2021-48017: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High0%Oct 22, 2026
CVE-2021-48016: Improper Control of Generation of Code9.8 Critical9.3 Critical0%Oct 22, 2026
CVE-2021-48015: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High1%Oct 22, 2026
CVE-2021-48014: Improper Limitation of a Pathname to a Restricted Directory9.8 Critical9.3 Critical2%Oct 22, 2026
CVE-2021-48013: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High1%Oct 22, 2026
CVE-2020-37284: Improper Neutralization of Input During Web Page Generation6.1 Medium5.1 Medium0%Oct 22, 2026
CVE-2019-25779: Improper Limitation of a Pathname to a Restricted Directory7.5 High8.7 High0%Oct 22, 2026
CVE-2019-25778: Improper Neutralization of Special Elements used in an SQL Command8.2 High8.8 High0%Oct 22, 2026
2301-2325 of 522616