The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-114702: nicdark ND Shortcodes For Visual Composer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in nicdark ND…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114701: xootix Waitlist Woocommerce ( Back in stock notifier ): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xootix Waitlist…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114700: Gloriafood Restaurant Menu – Food Ordering System – Table Reservation: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gloriafood…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-114699: yoomoney ЮKassa для WooCommerce: Missing Authorization vulnerability in yoomoney ЮKassa для WooCommerce yookassa allows Exploiting Incorrectly…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114698: myCred: Authorization Bypass Through User-Controlled Key vulnerability in myCred myCred mycred allows Exploiting Incorrectly…5.4 MediumN/A0%Oct 22, 2026
CVE-2026-114696: miniOrange Page Restriction WordPress (WP): Missing Authorization vulnerability in miniOrange Page Restriction WordPress (WP) page-and-post-restriction allows…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114195: WP Desk ShopMagic: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in WP Desk ShopMagic…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-112845: Jory Hogeveen Off-Canvas Sidebars & Menus (Slidebars): Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jory Hogeveen…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-112379: Codepeople Contact Form Email: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Codepeople…7.1 HighN/A0%Oct 22, 2026
CVE-2026-112327: TMS Amelia: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in TMS Amelia…9.3 CriticalN/A0%Oct 22, 2026
CVE-2026-112312: ACF Extended: Missing Authorization vulnerability in ACF Extended ACF Extended acf-extended allows Exploiting Incorrectly Configured…7.5 HighN/A0%Oct 22, 2026
CVE-2026-112311: ACF Extended: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in ACF Extended ACF…6.5 MediumN/A0%Oct 22, 2026
CVE-2026-112242: Cozmoslabs Profile Builder: Incorrect Privilege Assignment vulnerability in Cozmoslabs Profile Builder profile-builder allows Privilege…8.8 HighN/A0%Oct 22, 2026
CVE-2026-112241: Brainstorm Force SureCart: Authentication Bypass by Spoofing vulnerability in Brainstorm Force SureCart surecart allows Authentication Abuse.This…9.8 CriticalN/A0%Oct 22, 2026
CVE-2026-112218: Ahmad Majestic Support: Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-111851: WProyal Royal Elementor Addons: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in WProyal Royal…7.6 HighN/A0%Oct 22, 2026
CVE-2026-111842: WP Sunshine Sunshine Photo Cart: Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-111830: WP Mailster: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Mailster WP…7.1 HighN/A0%Oct 22, 2026
CVE-2026-110974: vaadin android-json: The org.json parser in com.vaadin.external.google:android-json recurses once per nesting level with no depth limit:…N/A6.3 Medium0%Oct 22, 2026
CVE-2026-110894: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-110893: Brainstorm Force SureDash: Missing Authorization vulnerability in Brainstorm Force SureDash suredash allows Exploiting Incorrectly Configured…5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114460: pbuchbinder mod_qos: A flaw was found in mod_qos5.3 MediumN/A0%Oct 22, 2026
CVE-2026-114459: pbuchbinder mod_qos: A flaw was found in mod_qos3.7 LowN/A0%Oct 22, 2026
CVE-2026-114458: pbuchbinder mod_qos: A flaw was found in mod_qos5.9 MediumN/A0%Oct 22, 2026
CVE-2026-114457: pbuchbinder mod_qos: A flaw was found in mod_qos3.7 LowN/A0%Oct 22, 2026
126-150 of 416054
‹›