The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-111865: THU-MIG yoloe: A security flaw has been discovered in THU-MIG yoloe up to 40cd606cabdbe2b566d6f14a6b162c89206e9a1b5.3 Medium1.9 LowN/AOct 17, 2026
CVE-2026-111934: coder: Coder before 2.34.7 contains an IP spoofing vulnerability in the ExtractRealIPAddress middleware that trusts the…3.7 Low6.3 MediumN/AOct 17, 2026
CVE-2026-111933: coder: Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a user enumeration…3.7 Low6.3 MediumN/AOct 17, 2026
CVE-2026-111932: coder: Coder before 2.29.17, 2.30.0 before 2.32.7, 2.33.0 before 2.33.8, and 2.34.0 before 2.34.2 contains a stored HTML…3.4 Low4.8 MediumN/AOct 17, 2026
CVE-2026-111931: coder: Coder from 2.0.0 before 2.34.8 contains an open redirect vulnerability in handleAPIKeySmuggling that allows attackers…4.3 Medium5.3 MediumN/AOct 17, 2026
CVE-2026-111930: coder: Coder from 2.26.0 before 2.34.8 contains an incorrect authorization flaw in the GET /api/v2/workspaces/{id}/acl…4.3 Medium5.3 MediumN/AOct 17, 2026
CVE-2026-111929: coder: Coder from 2.30.0 before 2.34.8 contains an authorization bypass vulnerability in the provisioner daemon DownloadFile…5.3 Medium6.0 MediumN/AOct 17, 2026
CVE-2026-111928: coder: Coder from 2.0.0 before 2.34.8 contains an incorrect authorization vulnerability in the acl_allow rule of…5.4 Medium5.3 MediumN/AOct 17, 2026
CVE-2026-111927: coder: Coder before 2.29.20, 2.33.0 before 2.33.12, 2.34.0 before 2.34.8, and 2.35.0 before 2.35.4 contains an improper…7.7 High8.7 HighN/AOct 17, 2026
CVE-2026-111926: coder: Coder from 2.10.0 before 2.34.8 has an unauthenticated agent debug HTTP server on 127.0.0.1:2113 whose /debug/manifest…3.3 Low4.8 MediumN/AOct 17, 2026
CVE-2026-111924: fleetdm fleet: Fleet before 4.83.0 contains a denial of service vulnerability that allows unauthenticated attackers to exhaust server…7.5 High8.7 HighN/AOct 17, 2026
CVE-2026-111923: fleetdm fleet: Fleet before 4.89.0 contains an unbounded recursion vulnerability in Apple MDM enrollment property list parsing that…7.5 High8.7 HighN/AOct 17, 2026
CVE-2026-111922: go-vikunja vikunja: Vikunja from 2.2.0 before 2.7.0 contains a permissive CORS configuration that trusts every localhost and 127.0.0.1 port…6.3 Medium7.2 HighN/AOct 17, 2026
CVE-2026-111921: go-vikunja vikunja: Vikunja 0.13.0 before 2.7.0 contains an incorrect authorization vulnerability that allows project members with Write…5.4 Medium5.3 MediumN/AOct 17, 2026
CVE-2026-111920: go-vikunja vikunja: Vikunja 2.6.0 contains a broken access control flaw in getProjectAccessForUser (pkg/models/project_access.go), which…4.3 Medium5.3 MediumN/AOct 17, 2026
CVE-2026-111919: go-vikunja vikunja: Vikunja 0.22.0 before 2.7.0 contains an improper access revocation vulnerability that allows removed collaborators to…6.5 Medium7.1 HighN/AOct 17, 2026
CVE-2026-111918: go-vikunja vikunja: Vikunja from 1.0.0-rc0 before 2.7.0 contains an improper authorization vulnerability in RecalculateTaskPositions that…5.4 Medium5.3 MediumN/AOct 17, 2026
CVE-2026-111917: go-vikunja vikunja: Vikunja 2.3.0 before 2.7.0 contains an improper session validation vulnerability that allows attackers to keep…6.5 Medium7.1 HighN/AOct 17, 2026
CVE-2026-111916: admidio: Admidio before 5.0.16 contains an information disclosure vulnerability that allows unauthenticated attackers to view…5.3 Medium6.9 MediumN/AOct 17, 2026
CVE-2026-111914: admidio: Admidio from 5.0.11 before 5.0.16 contains a broken access control vulnerability in…6.5 Medium7.1 HighN/AOct 17, 2026
CVE-2026-111913: admidio: Admidio from 5.0.0 before 5.0.16 contains an authorization bypass vulnerability that allows authenticated users to…4.3 Medium5.3 MediumN/AOct 17, 2026
CVE-2026-111912: admidio: Admidio from 5.0.0 before 5.0.16 contains an insecure direct object reference vulnerability in…6.5 Medium7.1 HighN/AOct 17, 2026
CVE-2026-111911: thorsten phpMyFAQ: phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints…9.8 Critical9.3 CriticalN/AOct 17, 2026
CVE-2026-111910: thorsten phpMyFAQ: phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authorization bypass vulnerability in…6.5 Medium7.1 HighN/AOct 17, 2026
CVE-2026-111909: thorsten phpMyFAQ: phpMyFAQ before 4.1.9 contains a missing authorization vulnerability in the deleteUser() API that allows authenticated…8.1 High7.2 HighN/AOct 17, 2026
1-25 of 408260
›