The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-12062: Zohocorp ADAudit Plus: Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection…8.8 HighN/AN/ANov 11, 2026
CVE-2026-123668: Unknown GetPaid: The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123659: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119302: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-119171: Unknown Advanced Product Fields (Product Addons) for WooCommerce: The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-116468: Red Hat: A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component6.6 MediumN/AN/ANov 11, 2026
CVE-2026-111190: n/a ARforms: The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via…8.1 HighN/AN/ANov 11, 2026
CVE-2026-105948: Octopus Deploy Octopus Server: In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to…N/A7.7 HighN/ANov 11, 2026
CVE-2025-59848: HCL Software HCL Leap: HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an…6.8 MediumN/AN/ANov 11, 2026
CVE-2025-59847: HCL Software HCL Domino Leap: HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-96414: Octopus Deploy Octopus Server: In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with…N/A8.7 HighN/ANov 11, 2026
CVE-2026-88813: Unknown YITH WooCommerce Gift Cards: The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123705: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123704: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123703: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123702: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-123701: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not have proper authorization checks when resetting…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123700: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…7.5 HighN/AN/ANov 11, 2026
CVE-2026-123699: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…4.8 MediumN/AN/ANov 11, 2026
CVE-2026-123698: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123697: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict who can request a user's current…7.5 HighN/AN/ANov 11, 2026
CVE-2026-123696: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…7.5 HighN/AN/ANov 11, 2026
CVE-2026-123695: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to several of its REST API…9.8 CriticalN/AN/ANov 11, 2026
CVE-2026-123667: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not sanitise and escape keyword names…6.4 MediumN/AN/ANov 11, 2026
CVE-2026-123666: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.2 does not check that a user may delete the…4.9 MediumN/AN/ANov 11, 2026
301-325 of 511254