The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123460: Nickboss WordPress File Upload: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nickboss…7.1 HighN/AN/ANov 9, 2026
CVE-2026-122661: wpWax Directorist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-121722: WP E-Signature Formidable Forms Signature Online Contract Automation: Missing Authorization vulnerability in WP E-Signature Formidable Forms Signature Online Contract Automation…7.5 HighN/AN/ANov 9, 2026
CVE-2026-119515: Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services: Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-122665: Kitae Park Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-122666: Kitae Park Mang Board WP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kitae Park Mang…7.1 HighN/AN/ANov 9, 2026
CVE-2026-119524: Aguila Technologies WP Customer Area: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Aguila…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-123476: fifu.app Featured Image from URL: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in fifu.app Featured…7.1 HighN/AN/ANov 9, 2026
CVE-2026-120855: TemplateInvaders TI WooCommerce Wishlist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in TemplateInvaders…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-121570: WP Chill RSVP and Event Management: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill RSVP and…7.1 HighN/AN/ANov 9, 2026
CVE-2026-123475: PT Norther Lights Production MapSVG: Missing Authorization vulnerability in PT Norther Lights Production MapSVG mapsvg-lite-interactive-vector-maps allows…7.5 HighN/AN/ANov 9, 2026
CVE-2026-121782: If-So Dynamic Content If-So Dynamic Content Personalization: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in If-So Dynamic…7.1 HighN/AN/ANov 9, 2026
CVE-2026-120838: Plugins360 Labs All-in-One Video Gallery: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Plugins360 Labs…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-120367: Apache Software Foundation Apache Axis2/Java: Allocation of Resources Without Limits or Throttling vulnerability in Apache Axis2/JavaN/AN/AN/ANov 9, 2026
CVE-2026-96285: Apache Software Foundation Apache Airflow: Apache Airflow 3.3.1 shipped a fix for CVE-2026-67260 that checks the scheduler's decoded `next_kwargs` value is a…N/AN/AN/ANov 9, 2026
CVE-2026-92683: Neo4j @neo4j/graphql: Incorrect authorization in the @authentication directive JWT where filter evaluation in Neo4j @neo4j/graphql versions…N/A8.6 HighN/ANov 9, 2026
CVE-2026-86829: Apache Software Foundation Apache Airflow: Apache Airflow's scheduler fully deserializes XCom values written by task code while evaluating task dependenciesN/AN/AN/ANov 9, 2026
CVE-2026-86468: Apache Software Foundation Apache Airflow: Apache Airflow's CLI records its arguments in the audit log but masks secrets by argument position, so some supported…N/AN/AN/ANov 9, 2026
CVE-2026-82440: Apache Software Foundation Apache Storm Nimbus: Description Nimbus instantiates the class named by a topology's `topology.scheduler.strategy` when scheduling itN/AN/AN/ANov 9, 2026
CVE-2026-82436: Apache Software Foundation Apache Storm Client: Description `DefaultStateSerializer`, used to persist and restore stateful bolt checkpoints, configured Kryo with class…N/AN/AN/ANov 9, 2026
CVE-2026-82337: Apache Software Foundation Apache Airflow: Apache Airflow rebuilt deadline alert fields through generic deserialization, which imports and instantiates the class…N/AN/AN/ANov 9, 2026
CVE-2026-76185: Apache Software Foundation Apache Airflow Task SDK: Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters,…N/AN/AN/ANov 9, 2026
CVE-2026-68982: Apache Software Foundation Apache Airflow: Apache Airflow's CeleryExecutor ran callback workloads (`ExecuteCallback`, used for deadline-alert callbacks) without…N/AN/AN/ANov 9, 2026
CVE-2026-50204: Apache Software Foundation Apache Airflow: Apache Airflow's audit log stored Connection and Variable secret values in cleartext in the `Log.extra` column because…N/AN/AN/ANov 9, 2026
CVE-2026-40913: Apache Software Foundation Apache Airflow: Apache Airflow's public Import Errors API returns the raw parse-failure stack trace to any user with the…N/AN/AN/ANov 9, 2026
301-325 of 427771
‹›