The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-110022: Phoenix Contact PLCnext Engineer: The PFI plugin framework deploys executable assemblies (DLLs) from a signed plugin package into the local plugin…8.4 High8.6 High0%Nov 4, 2026
CVE-2026-110021: Phoenix Contact PLCnext Engineer: PLCnext Engineer checks GSDX manifest reference digests but does not cryptographically verify the XML `SignatureValue`…6.2 Medium6.9 Medium0%Nov 4, 2026
CVE-2026-108949: Apache Software Foundation: Denial of Service via OOM vulnerability in Apache ActiveMQ, ActiveMQ BrokerN/AN/AN/ANov 4, 2026
CVE-2026-19731: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in TÜBİTAK BİLGEM Software…3.3 LowN/A0%Nov 4, 2026
CVE-2026-19721: TÜBİTAK BİLGEM Software Technologies Research Institute İmzager: Improper restriction of XML external entity reference vulnerability in TÜBİTAK BİLGEM Software Technologies Research…3.3 LowN/A0%Nov 4, 2026
CVE-2026-114426: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 processes and writes v1 file-interface upload data before authenticating…N/A8.7 High0%Nov 4, 2026
CVE-2026-114425: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 trusts a file path supplied in externally provided Large File Transfer…N/A9.2 Critical0%Nov 4, 2026
CVE-2026-114424: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 can evaluate attacker-influenced replacement text as Perl code in sender or…N/A9.2 Critical0%Nov 4, 2026
CVE-2026-114421: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 permits password recovery for a created but unregistered GINA account whose…N/A8.3 High0%Nov 4, 2026
CVE-2026-114420: SEPPmail AG SEPPmail Secure Email Gateway (SEG): SEPPmail Secure Email Gateway before 15.1.1 does not neutralize LDAP metacharacters in an unauthenticated…N/A6.9 Medium0%Nov 4, 2026
CVE-2026-62126: miniOrange SAML SP Single Sign On: Allocation of Resources Without Limits or Throttling vulnerability in miniOrange SAML SP Single Sign On…7.5 HighN/A0%Nov 4, 2026
CVE-2026-62007: Unlimited Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited…7.1 HighN/A0%Nov 4, 2026
CVE-2026-57775: RelyWP Simple Cloudflare Turnstile: Authentication Bypass Using an Alternate Path or Channel vulnerability in RelyWP Simple Cloudflare Turnstile…5.3 MediumN/A0%Nov 4, 2026
CVE-2026-57666: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…7.1 HighN/A0%Nov 4, 2026
CVE-2026-57639: Roland Murg WP Booking System: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Roland Murg WP…7.1 HighN/A0%Nov 4, 2026
CVE-2026-56065: Doofinder Doofinder for WooCommerce: Insertion of Sensitive Information into Externally-Accessible File or Directory vulnerability in Doofinder Doofinder…7.5 HighN/A0%Nov 4, 2026
CVE-2026-54861: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…7.1 HighN/A0%Nov 4, 2026
CVE-2026-119477: Jacob N. Breetvelt WP Photo Album Plus: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Jacob N7.1 HighN/A0%Nov 4, 2026
CVE-2026-119366: AdvancedCoding wpDiscuz: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in AdvancedCoding…7.1 HighN/A0%Nov 4, 2026
CVE-2026-110944: qt Qt Framework: Resource exhaustion vulnerability in the HTTP request handling of the QHttpServer component of Qt HTTP Server.N/A2.7 Low0%Nov 4, 2026
CVE-2026-62000: WC Lovers WCFM Marketplace: Missing Authorization vulnerability in WC Lovers WCFM Marketplace wc-multivendor-marketplace allows Exploiting…7.5 HighN/A0%Nov 4, 2026
CVE-2026-54851: Awesomemotive Contact Form by WPForms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Awesomemotive…7.1 HighN/A0%Nov 4, 2026
CVE-2026-121818: About Time Technologies Herowatch Go: Herowatch Mini developed by About Time Technologies has a system signing vulnerability7.8 High8.5 High0%Nov 4, 2026
CVE-2026-121817: About Time Technologies Herowatch Go Server: Herowatch Go Server developed by About Time Technologies has a Insecure Direct Object Reference vulnerability7.5 High8.7 High0%Nov 4, 2026
CVE-2026-121816: About Time Technologies Herowatch Mini: Herowatch Mini developed by About Time Technologies has a Missing Authentication vulnerability8.8 High8.7 High0%Nov 4, 2026
226-250 of 418286
‹›