The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123036: Red Hat ansible-core: A flaw was found in ansible-core5.5 MediumN/AN/ANov 5, 2026
CVE-2026-118869: SHIRASAGI Project SHIRASAGI: An OS command injection vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute…8.8 High8.7 High1%Nov 5, 2026
CVE-2026-117679: SHIRASAGI Project SHIRASAGI: A cross-site scripting vulnerability exists in SHIRASAGI, which may allow an authenticated attacker to execute…5.4 Medium5.1 Medium0%Nov 5, 2026
CVE-2026-112072: jopenlibs vault-java-driver: vault-java-driver, a Java client for HashiCorp Vault, parses Vault's JSON responses with a vendored minimal-json parser…6.5 MediumN/A0%Nov 5, 2026
CVE-2026-109408: jopenlibs vault-java-driver: vault-java-driver, a Java client for HashiCorp Vault, silently disables TLS certificate and hostname verification in…7.4 HighN/A0%Nov 5, 2026
CVE-2026-107776: Unknown Dokan: The Dokan WordPress plugin before 5.3.3 does not reconcile the amount credited to a vendor's reverse-withdrawal ledger…2.2 LowN/A0%Nov 5, 2026
CVE-2026-100109: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin from 1.0.10 to 1.0.16 does not perform capability checks when creating…9.8 CriticalN/A0%Nov 5, 2026
CVE-2026-123033: iXsystems TrueNAS SCALE: Authentication bypass in the HA heartbeat origin check in middlewared in TrueNAS SCALE before 25.10.8 (and in release…8.3 HighN/A0%Nov 5, 2026
CVE-2026-123029: Wowza Streaming Engine: Wowza Streaming Engine before 4.12.2 processes XML external entities, which allows remote attackers to read local files…7.5 HighN/A0%Nov 5, 2026
CVE-2026-123025: OPNsense os-acme-client: An OS Command Injection vulnerability was discovered in the Google Cloud DNS validation module of the OPNsense…N/A9.4 Critical1%Nov 5, 2026
CVE-2026-91049: Unknown EWWW Image Optimizer: The EWWW Image Optimizer WordPress plugin before 8.9.1 does not properly sanitize and restrict a value in post content…N/AN/A0%Nov 5, 2026
CVE-2026-90967: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not verify ownership of an invoice before rendering it in…N/AN/A0%Nov 5, 2026
CVE-2026-90966: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not verify, in one of its AJAX actions, that a listing…N/AN/A0%Nov 5, 2026
CVE-2026-90965: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not perform a publication-status or authorization check in…N/AN/A0%Nov 5, 2026
CVE-2026-90964: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not restrict the recipient of one of its contact email…N/AN/A0%Nov 5, 2026
CVE-2026-90963: Unknown Essential Real Estate: The Essential Real Estate WordPress plugin before 5.3.5 does not perform any authorization or publication-status check…N/AN/A0%Nov 5, 2026
CVE-2026-88814: Unknown YITH WooCommerce Gift Cards: The YITH WooCommerce Gift Cards WordPress plugin before 4.38.1 does not lock or atomically update a gift card's balance…N/AN/A0%Nov 5, 2026
CVE-2026-87856: Unknown Subscriptions for WooCommerce: The Subscriptions for WooCommerce WordPress plugin before 2.1.1 only enforces its membership content restrictions on…N/AN/A0%Nov 5, 2026
CVE-2026-86795: Unknown Community Events: The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks in one of its AJAX…N/AN/A0%Nov 5, 2026
CVE-2026-86442: Unknown WP Event Manager: The WP Event Manager WordPress plugin before 3.4.2 does not verify the ownership or the post type of a user supplied…N/AN/A0%Nov 5, 2026
CVE-2026-85570: Unknown Tutor LMS: The Tutor LMS WordPress plugin before 4.2.0 does not prevent the correct answers to quiz questions from being included…N/AN/A0%Nov 5, 2026
CVE-2026-85351: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not validate a user-supplied URL before…N/AN/A0%Nov 5, 2026
CVE-2026-85347: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not sanitize and escape a user-supplied value…N/AN/A0%Nov 5, 2026
CVE-2026-85346: Unknown FV Flowplayer Video Player: The FV Flowplayer Video Player WordPress plugin before 7.5.56.7212 does not perform authorization or CSRF checks on…N/AN/A0%Nov 5, 2026
CVE-2026-19256: Unknown All In One Login: The All In One Login WordPress plugin before 2.5.0 does not adequately restrict the number of attempts that can be made…N/AN/A0%Nov 5, 2026
326-350 of 423114
‹›