The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119054: Themeisle Multiple Pages Generator by Themeisle: Multiple Pages Generator by Themeisle before 4.2.5 contains a stored cross-site scripting vulnerability that allows…5.4 Medium5.1 MediumN/AOct 29, 2026
CVE-2026-119053: lwIP: lwIP 2.0.0 through 2.2.1 built with the SNMP agent contains an out-of-bounds read vulnerability in…5.3 Medium6.9 MediumN/AOct 29, 2026
CVE-2026-119052: ggml-org llama.cpp: llama.cpp b2877 before b11935 contains an uncaught exception vulnerability in the ggml-rpc server that allows…7.5 High8.7 HighN/AOct 29, 2026
CVE-2026-119051: hughsk flat: flat through 6.0.1 contains an uncontrolled resource allocation vulnerability in unflatten() that allows attackers to…5.9 Medium8.2 HighN/AOct 29, 2026
CVE-2026-119050: agno-agi agno: Agno through 3.1.11 contains an unsafe reflection vulnerability in PandasTools that allows attackers to invoke…8.1 High9.2 CriticalN/AOct 29, 2026
CVE-2026-119049: idinging FreeMail: FreeMail before 5.3.2 contains an authorization bypass vulnerability that allows authenticated users to claim another…7.6 High7.2 HighN/AOct 29, 2026
CVE-2026-119048: thinkgem JeeSite: JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that…4.2 Medium2.3 LowN/AOct 29, 2026
CVE-2026-118425: Red Hat: A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management…6.8 MediumN/AN/AOct 29, 2026
CVE-2026-113697: BMC BMC Helix Operations Management: Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-113696: BMC BMC IT Service Management Suite: Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01,…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-113695: BMC BMC IT Service Management Suite: Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-113694: BMC BMC IT Service Management Suite: Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01,…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-113693: BMC BMC IT Service Management Suite: Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-113692: BMC BMC IT Service Management Suite: Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and…N/A6.9 MediumN/AOct 29, 2026
CVE-2026-113691: BMC BMC IT Service Management Suite: Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions…N/A5.1 MediumN/AOct 29, 2026
CVE-2019-25781: Python-Markdown Markdown: Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows…7.5 High8.7 HighN/AOct 29, 2026
CVE-2026-116406: Webba Plugins Webba Booking: Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-52708: weDevs WP User Frontend: Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-116846: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-48884: weDevs WP User Frontend: Missing Authorization vulnerability in weDevs WP User Frontend wp-user-frontend allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-80069: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a missing authorization vulnerability that allows any…4.3 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-80067: Stylemix MasterStudy LMS WordPress Plugin: MasterStudy LMS plugin for WordPress before 3.7.50 contains a path traversal vulnerability that allows authenticated…5.4 Medium5.3 MediumN/AOct 29, 2026
CVE-2026-115713: Elastic Elastic Cloud Enterprise: Improper Link Resolution Before File Access ('Link Following') (CWE-59) in Elastic Cloud Enterprise (ECE) can lead to…7.5 HighN/AN/AOct 29, 2026
CVE-2026-115712: Elastic Elastic Cloud Enterprise: Incorrect Authorization (CWE-863) in Elastic Cloud Enterprise (ECE) can lead to unauthorized modification of…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-39736: Crocoblock JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock…8.5 HighN/AN/AOct 29, 2026
251-275 of 538495