The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-18769: Exposed IOCTL with Insufficient Access Control7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-18768: Exposed IOCTL with Insufficient Access Control7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-18767: Exposed IOCTL with Insufficient Access Control7.8 High8.5 HighN/ANov 11, 2026
CVE-2026-126626: Overly Restrictive Account Lockout Mechanism5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126625: Incorrect Default Permissions6.7 MediumN/AN/ANov 11, 2026
CVE-2026-126624: Unverified Ownership7.3 HighN/AN/ANov 11, 2026
CVE-2026-126623: Inefficient Algorithmic Complexity7.5 HighN/AN/ANov 11, 2026
CVE-2026-126622: Incorrect Default Permissions7.3 HighN/AN/ANov 11, 2026
CVE-2026-126621: Improper Certificate Validation7.5 HighN/AN/ANov 11, 2026
CVE-2026-126619: Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7…4.8 MediumN/AN/ANov 11, 2026
CVE-2026-126618: Improper Restriction of Excessive Authentication Attempts5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126617: SQL Injection8.8 HighN/AN/ANov 11, 2026
CVE-2026-126616: Improper Restriction of Excessive Authentication Attempts5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126615: Authentication Bypass by Alternate Name5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126614: Improper Restriction of Excessive Authentication Attempts5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126613: Allocation of Resources Without Limits or Throttling7.5 HighN/AN/ANov 11, 2026
CVE-2026-126612: Improper Link Resolution Before File Access7.8 HighN/AN/ANov 11, 2026
CVE-2026-126611: Improper Certificate Validation7.0 HighN/AN/ANov 11, 2026
CVE-2026-126610: Improper Certificate Validation7.4 HighN/AN/ANov 11, 2026
CVE-2026-126609: Improper Certificate Validation7.5 HighN/AN/ANov 11, 2026
CVE-2026-126607: Uncontrolled Search Path Element7.8 HighN/AN/ANov 11, 2026
CVE-2026-93487: Octopus Deploy Octopus Server: In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow…N/A7.1 HighN/ANov 11, 2026
CVE-2026-92408: Unknown WPS Bookings for WooCommerce: The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-76981: Zohocorp ADAudit Plus: Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL…8.8 HighN/AN/ANov 11, 2026
CVE-2026-15785: creapuntome Joinchat – Enhanced “click to chat”: The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via…6.1 MediumN/AN/ANov 11, 2026
301-325 of 511254