The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2012-20006: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.N/AN/AN/AOct 26, 2026
CVE-2026-115720: frappe builder: Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the…5.0 Medium5.3 MediumN/AOct 26, 2026
CVE-2026-89209: Authentication Bypass by Capture-replay6.8 Medium7.6 HighN/AOct 26, 2026
CVE-2026-116469: MISP misp-guard: MISP Guard, a proxy-based security filter for MISP (Malware Information Sharing Platform) feed distribution, contains a…N/A7.1 HighN/AOct 26, 2026
CVE-2026-116259: n/a libimobiledevice: A security flaw has been discovered in libimobiledevice up to 1.4.05.3 Medium1.9 LowN/AOct 26, 2026
CVE-2026-116258: A vulnerability was identified in libimobiledevice up to 1.4.06.3 Medium2.1 LowN/AOct 26, 2026
CVE-2026-116257: A vulnerability was determined in BillaBear up to 2025.01.037.3 High5.5 MediumN/AOct 26, 2026
CVE-2026-116256: geesondog RhaPHP: A vulnerability was found in geesondog RhaPHP up to 7ae639ccf8dcb627faace096d030bd4cb4cfb9057.3 High5.5 MediumN/AOct 26, 2026
CVE-2026-115961: bPlugins B Slider: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Slider…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115960: WPExperts APIExperts Square for WooCommerce: Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting…4.3 MediumN/AN/AOct 26, 2026
CVE-2026-115959: WPExperts APIExperts Square for WooCommerce: Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-115956: bPlugins Panorama Viewer – 360 Degree Image + Video Viewer: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Panorama…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115955: bPlugins Advanced Post Block - Post Grid for WordPress block editor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Advanced…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115954: Dylan Kuhn Geo Mashup: Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access…5.4 MediumN/AN/AOct 26, 2026
CVE-2026-115953: Dylan Kuhn Geo Mashup: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Dylan Kuhn Geo…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115951: Kevin Weber Lazy Load for Videos: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Weber Lazy…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115950: WP Smart Widgets Better Post & Filter Widgets for Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Smart Widgets…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-115948: David Lingren Media LIbrary Assistant: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in David Lingren…8.5 HighN/AN/AOct 26, 2026
CVE-2026-115608: Crocoblock JetEngine: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Crocoblock…8.5 HighN/AN/AOct 26, 2026
CVE-2026-115595: Supsystic Contact Form by Supsystic: Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting…5.3 MediumN/AN/AOct 26, 2026
CVE-2026-115594: David Lingren Media LIbrary Assistant: Insertion of Sensitive Information Into Sent Data vulnerability in David Lingren Media LIbrary Assistant…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-114708: Crocoblock JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-114707: Crocoblock JetElements For Elementor: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/AOct 26, 2026
CVE-2026-97295: Cross-Site Request Forgery (CSRF)4.3 MediumN/AN/AOct 26, 2026
CVE-2026-97255: Authorization Bypass Through User-Controlled Key5.3 MediumN/AN/AOct 26, 2026
251-275 of 416032