The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-102905: spacetime Ad Inserter – Ad Manager & AdSense Ads: The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in…6.5 MediumN/AN/AOct 30, 2026
CVE-2025-8574: tigroumeow: The Database Cleaner plugin for WordPress is vulnerable to arbitrary table deletion in all versions up to, and…8.7 HighN/AN/AOct 30, 2026
CVE-2026-84243: The GNU C Library glibc: The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries…7.0 HighN/AN/AOct 30, 2026
CVE-2026-118697: JetBrains: In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon…9.0 CriticalN/AN/AOct 30, 2026
CVE-2026-118696: JetBrains: In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and…8.0 HighN/AN/AOct 30, 2026
CVE-2026-69446: Microsoft Microsoft Edge (Chromium-based): Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.4.4 MediumN/AN/AOct 30, 2026
CVE-2026-65566: Meow Apps AI Engine: Cross-Site Request Forgery (CSRF) vulnerability in Meow Apps AI Engine ai-engine allows Cross Site Request Forgery.This…8.8 HighN/AN/AOct 30, 2026
CVE-2026-62055: Liquid Web / StellarWP Event Tickets: Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-61826: morpheus65535 bazarr: Bazarr is a companion application to Sonarr and Radarr10.0 CriticalN/AN/AOct 30, 2026
CVE-2026-61806: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their contentN/A5.3 MediumN/AOct 30, 2026
CVE-2026-61805: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their contentN/A5.3 MediumN/AOct 30, 2026
CVE-2026-61804: myTinyWMS: myTinyWMS is a free, open-source warehouse management system8.1 HighN/AN/AOct 30, 2026
CVE-2026-61803: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their contentN/A5.3 MediumN/AOct 30, 2026
CVE-2026-61789: bytebase dbhub: DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLiteN/A6.1 MediumN/AOct 30, 2026
CVE-2026-55551: infonl dimpact-zaakafhandelcomponent: ZAC is an open-source, workflow-based Common Ground component for Dutch municipal case management6.5 MediumN/AN/AOct 30, 2026
CVE-2026-50000: freedomofpress securedrop: SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept…5.0 MediumN/AN/AOct 30, 2026
CVE-2026-39375: frappe lms: Frappe Learning Management System (LMS) is a learning system that helps users structure their contentN/A5.1 MediumN/AOct 30, 2026
CVE-2026-37468: n/a: Cross Site Scripting vulnerability in BeeHome MyBeeHome before 2025-11-01 allows a remote attacker to execute arbitrary…N/AN/AN/AOct 30, 2026
CVE-2026-119466: WPExperts APIExperts Square for WooCommerce: Cross-Site Request Forgery (CSRF) vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Cross…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-119367: Liquid Web / StellarWP The Events Calendar: Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-119365: bPlugins Media Player Addons for Elementor – Media Player widget for WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Media…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119300: wekan: Wekan is open source kanban built with Meteor6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119299: gopacket: gopacket provides packet processing capabilities for Go5.9 MediumN/AN/AOct 30, 2026
CVE-2026-119298: schollz croc: croc is a tool that allows any two computers to simply and securely transfer files and folders4.2 MediumN/AN/AOct 30, 2026
CVE-2026-119148: AWS aws-nitro-enclaves-sdk-c: Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the…6.5 Medium8.2 HighN/AOct 30, 2026
226-250 of 418318