The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-60036: MB connect line, Helmholz: A high privileged remote attacker can perform a code injection in the backends patch activate function leading to code…7.2 High8.6 High0%Nov 10, 2026
CVE-2026-125652: Red Hat: A flaw was found in the keycloak-services component of Keycloak, which provides the core authentication and…6.8 MediumN/A0%Nov 10, 2026
WordPress Plugin: armember: CVE-2026-93427: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.2 HighN/A0%Nov 10, 2026
CVE-2026-76877: WPML WPML Multilingual CMS: The WPML Multilingual CMS plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in versions up…8.1 HighN/A0%Nov 10, 2026
WordPress Plugin: everest-forms: CVE-2026-120513: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')8.2 HighN/A0%Nov 10, 2026
CVE-2026-100386: themefic Ultra Addons for Contact Form 7: The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Directory Traversal in all versions up to,…7.5 HighN/A1%Nov 10, 2026
WordPress Plugin: fusion-builder: CVE-2026-84938: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')7.2 HighN/A0%Nov 10, 2026
CVE-2026-9063: Axis Communications AB AXIS OS: A locally authenticated user can achieve privilege escalation via an insecure configuration that leads to unauthorized…6.7 MediumN/A0%Nov 10, 2026
CVE-2026-8372: Axis Communications AB AXIS Camera Station Pro: A vulnerability that could allow an attacker to gain unauthorized access.8.8 HighN/A0%Nov 10, 2026
CVE-2026-63288: Axis Communications AB: A WebSocket request sent to a specific API endpoint allows unauthorized access to a separate API endpoint8.3 HighN/A0%Nov 10, 2026
CVE-2026-63282: Axis Communications AB AXIS OS: Improper shell quote escaping when processing user-controlled input, potentially allowing command injection, which…6.5 MediumN/A1%Nov 10, 2026
CVE-2026-4762: Axis Communications AB AXIS Camera Station Pro: A vulnerability to perform a privilege escalation attack on the server as a non-admin user.8.8 HighN/A0%Nov 10, 2026
CVE-2026-14918: Axis Communications AB: The Signed Video Framework contained a out-of-bounds read issue in the Signed Video Framework which could lead the…5.3 MediumN/A0%Nov 10, 2026
CVE-2026-14543: Axis Communications AB AXIS OS: The VAPIX Edge storage API, enabling the escalation of user privileges by circumventing filesystem isolation, granting…3.9 LowN/A0%Nov 10, 2026
CVE-2026-14542: Axis Communications AB AXIS OS: The VAPIX SIP configuration API lacked sufficient input validation, which could potentially lead to privilege escalation6.7 MediumN/A0%Nov 10, 2026
CVE-2026-13409: Axis Communications AB AXIS OS: The VAPIX API dynamicoverlay.cgi which results in a Denial-of-Service of the overlay functionality4.3 MediumN/A0%Nov 10, 2026
CVE-2026-12964: Axis Communications AB AXIS Camera Station Pro: A vulnerability allowing for privileged escalation of the viewer account to gain administrator privileges.8.0 HighN/A0%Nov 10, 2026
CVE-2026-12963: Axis Communications AB: A vulnerability that could allow a viewer account to gain unauthorized access to network attached storage devices on…7.4 HighN/A0%Nov 10, 2026
CVE-2026-12389: Axis Communications AB AXIS Camera Station Pro: A vulnerability that could lead to a high privileged authenticated user performing a remote code execution attack.8.4 HighN/A0%Nov 10, 2026
CVE-2026-119273: Unknown BulletProof Security: The BulletProof Security WordPress plugin through 7.2 does not sufficiently protect its security log files or prevent…N/AN/A0%Nov 10, 2026
CVE-2026-110516: Unknown All in One Addons For WPBakery Page Builder (formerly Visual Composer): The All in One Addons For WPBakery Page Builder (formerly Visual Composer) WordPress plugin through 1.2 does not…N/AN/A0%Nov 10, 2026
CVE-2026-104676: Unknown Zion Builder: The Zion Builder WordPress plugin through 3.6.17 does not sanitize uploaded SVG files or validate their contents before…N/AN/A0%Nov 10, 2026
CVE-2026-63287: Axis Communications AB: It was possible for an authenticated non-admin user to modify certain data objects without having the appropriate…6.5 MediumN/A0%Nov 10, 2026
CVE-2026-13387: Axis Communications AB AXIS Camera Station Pro: A vulnerability related to URL redirection handling during the sign-out flow that could allow a user to be redirected…3.5 LowN/A0%Nov 10, 2026
CVE-2026-13312: Axis Communications AB: A vulnerability that could allow an attacker to compromise a system.9.9 CriticalN/A0%Nov 10, 2026
301-325 of 424804