The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-125836: Nicu Micle Simple JWT Login: Cross-Site Request Forgery (CSRF) vulnerability in Nicu Micle Simple JWT Login simple-jwt-login allows Cross Site…8.8 HighN/AN/ANov 12, 2026
CVE-2026-123133: Rejected reason: This CVE ID is a duplicate of CVE-2026-116518 and was never publishedN/AN/AN/ANov 12, 2026
CVE-2026-118855: Akaunting: Akaunting 3.3.0 contains a stored cross-site scripting vulnerability through invoice importN/A7.0 HighN/ANov 12, 2026
CVE-2026-8333: Microchip TimePictra: A stored cross-site scripting vulnerability in Microchip the TimePictra platform could allow an authenticated,…N/A9.4 CriticalN/ANov 12, 2026
CVE-2026-8332: Microchip TimePictra: A hard-coded root password in Microchip TimePictra platform installation files could allow an attacker with access to…N/A8.8 HighN/ANov 12, 2026
CVE-2026-8331: Microchip TimePictra: An unrestricted upload of files with dangerous type vulnerability in the Microchip TimePictra platform allows…N/A8.8 HighN/ANov 12, 2026
CVE-2026-87772: TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About: Incorrect Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute Pardus About allows…7.8 HighN/AN/ANov 12, 2026
CVE-2026-12591: Zohocorp M365 Manager Plus: Zohocorp ManageEngine M365 Manager Plus versions below 4818 is affected by an authenticated technician may exploit…9.9 CriticalN/AN/ANov 12, 2026
CVE-2026-12507: Zohocorp: Zohocorp ManageEngine AssetExplorer versions below 7860, ServiceDesk Plus versions below 15290, ServiceDesk Plus MSP…9.1 CriticalN/AN/ANov 12, 2026
CVE-2026-113408: Git: Path traversal in Git allows writing to arbitrary file via cloning and committing to bad repository3.3 LowN/AN/ANov 12, 2026
CVE-2026-76792: Unknown User Verification by PickPlugins: The User Verification by PickPlugins WordPress plugin before 2.0.49 does not rate limit the verification step of its…8.1 HighN/AN/ANov 12, 2026
CVE-2026-124817: Unknown Clockinator Lite: The Clockinator Lite WordPress plugin before 1.1.0 does not check authorisation or ownership when updating leave…5.3 MediumN/AN/ANov 12, 2026
CVE-2026-124815: Unknown Clockinator Lite: The Clockinator Lite WordPress plugin before 1.1.0 does not restrict access to several of its record deletion actions,…10.0 CriticalN/AN/ANov 12, 2026
CVE-2026-124814: Unknown Ultimate Addons for Elementor Forms: The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of…9.8 CriticalN/AN/ANov 12, 2026
CVE-2026-124665: Unknown Order Tracking: The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales…5.3 MediumN/AN/ANov 12, 2026
CVE-2026-124653: Unknown Mine CloudVod: The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from…6.5 MediumN/AN/ANov 12, 2026
CVE-2026-124652: Unknown Mine CloudVod: The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before…4.3 MediumN/AN/ANov 12, 2026
CVE-2026-124648: Unknown TI WooCommerce Wishlist: The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a…5.3 MediumN/AN/ANov 12, 2026
CVE-2026-124647: Unknown TI WooCommerce Wishlist: The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a…8.6 HighN/AN/ANov 12, 2026
CVE-2026-123092: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written…7.5 HighN/AN/ANov 12, 2026
CVE-2026-123044: Unknown ContentPen: The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it…7.5 HighN/AN/ANov 12, 2026
CVE-2026-122003: Unknown Abilities Bridge: The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API…8.8 HighN/AN/ANov 12, 2026
CVE-2026-121498: Unknown AskAny: The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning…4.8 MediumN/AN/ANov 12, 2026
CVE-2026-119040: Unknown Defender Security: The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication…7.5 HighN/AN/ANov 12, 2026
CVE-2026-119039: Unknown Defender Security: The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its…5.3 MediumN/AN/ANov 12, 2026
276-300 of 433023