The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-121819: LY Corporation Armeria: A vulnerability has been identified in armeria-xds versions 1.40.0 through 1.42.0, where DataSourcePolicy checks…N/A5.9 Medium0%Nov 6, 2026
CVE-2026-121636: Unknown Quick Event Manager: The Quick Event Manager WordPress plugin before 9.19 does not verify the authenticity of PayPal payment notifications…5.3 MediumN/A0%Nov 6, 2026
CVE-2026-121633: Unknown Order Tracking: The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the…5.3 MediumN/A0%Nov 6, 2026
CVE-2026-121006: HTTP::Body versions before 1.24_02 for Perl parse the trailer in quadratic timeN/AN/A0%Nov 6, 2026
CVE-2026-119516: Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services: Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments…9.8 CriticalN/A0%Nov 6, 2026
CVE-2026-119499: BAKKBONE Australia FloristPress: Insertion of Sensitive Information Into Sent Data vulnerability in BAKKBONE Australia FloristPress…7.5 HighN/A0%Nov 6, 2026
CVE-2026-119488: Shamim Rajani Pie Register: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Shamim Rajani Pie…7.1 HighN/A0%Nov 6, 2026
CVE-2026-119472: David Anderson Redux Framework: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in David Anderson…6.5 MediumN/A0%Nov 6, 2026
CVE-2026-118423: Unknown WP Libre Form: The WP Libre Form WordPress plugin 1.5.0.1 does not validate the type of files uploaded through its form submissions,…10.0 CriticalN/A1%Nov 6, 2026
CVE-2026-118166: Unknown MC4WP: Mailchimp for WordPress: The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its…4.8 MediumN/A0%Nov 6, 2026
CVE-2026-120844: miniOrange OAuth Single Sign On – SSO (OAuth Client): Incorrect Privilege Assignment vulnerability in miniOrange OAuth Single Sign On – SSO (OAuth Client)…9.8 CriticalN/A0%Nov 6, 2026
CVE-2026-83494: Red Hat Red Hat OpenShift AI (RHOAI): A flaw was found in the training-operatorN/AN/A0%Nov 6, 2026
CVE-2026-83493: Red Hat Red Hat OpenShift AI (RHOAI): A flaw was found in distributed-workloads9.1 CriticalN/A0%Nov 6, 2026
CVE-2026-73473: GStreamer gst-plugins-good: A flaw was found in GStreamer gst-plugins-good (avidemux)5.5 MediumN/A0%Nov 6, 2026
CVE-2026-73472: GStreamer gst-plugins-good: A flaw was found in GStreamer gst-plugins-good (avidemux)6.1 MediumN/A0%Nov 6, 2026
CVE-2026-120749: Red Hat: A flaw was found in D-Bus6.2 MediumN/A0%Nov 6, 2026
CVE-2026-9797: Red Hat Red Hat Build of Keycloak: A flaw was found in Keycloak's administrative services (org.keycloak.services.resources.admin)6.5 MediumN/A0%Nov 6, 2026
CVE-2026-73471: GStreamer gst-plugins-good: A flaw was found in GStreamer gst-plugins-good (avidemux)6.1 MediumN/A0%Nov 6, 2026
CVE-2026-92396: Unknown ShopEngine Gutenberg WooCommerce Builder Blocks Addon: The ShopEngine Gutenberg WooCommerce Builder Blocks Addon WordPress plugin before 2.4.4 does not validate the user's…6.8 MediumN/A0%Nov 6, 2026
CVE-2026-87784: Unknown Cool Media Filter: The Cool Media Filter WordPress plugin through 1.0.1 does not perform any capability or nonce check when updating the…8.8 HighN/A0%Nov 6, 2026
CVE-2026-86606: Unknown iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more: The iubenda | All-in-one Compliance for GDPR / CCPA Cookie Consent + more WordPress plugin before 3.13.7 does not…7.5 HighN/A0%Nov 6, 2026
CVE-2026-12967: Unknown WCFM Membership: The WCFM Membership WordPress plugin before 2.12.1 does not verify that payment was made before completing a paid…6.5 MediumN/A0%Nov 6, 2026
CVE-2026-121837: Red Hat: A flaw was found in the REST Data Panache component of Quarkus4.3 MediumN/A0%Nov 6, 2026
CVE-2026-120408: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.1.0 does not escape a video's stored thumbnail URL before…8.0 HighN/A0%Nov 6, 2026
CVE-2026-119259: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.1.0 does not check the type, status or ownership of the target…5.3 MediumN/A0%Nov 6, 2026
301-325 of 423305
‹›