The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119048: thinkgem JeeSite: JeeSite 5.11.0 through 5.19.1 contains an insecure direct object reference vulnerability in the AI CMS chat module that…4.2 Medium2.3 LowN/AOct 29, 2026
CVE-2026-118425: Red Hat: A flaw was found in the secure-redirect-uris-enforcer client policy of Keycloak, an identity and access management…6.8 MediumN/AN/AOct 29, 2026
CVE-2026-116857: Crocoblock JetSmartFilters: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-116402: Brainstorm Force SureForms: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brainstorm Force…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-116399: InstaWP InstaWP Connect: Cross-Site Request Forgery (CSRF) vulnerability in InstaWP InstaWP Connect instawp-connect allows Cross Site Request…8.8 HighN/AN/AOct 29, 2026
CVE-2026-113697: BMC BMC Helix Operations Management: Reflected cross-site scripting in the agent query feature of BMC Helix Operations Management 25.4.00 allows…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-113696: BMC BMC IT Service Management Suite: Improper authorization in the SmartIT change approval feature of BMC IT Service Management Suite versions 25.3.01,…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-113695: BMC BMC IT Service Management Suite: Reflected cross-site scripting in the SmartIT inline-image attachment feature of BMC IT Service Management Suite…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-113694: BMC BMC IT Service Management Suite: Improper authorization in the SmartIT user attachment feature of BMC IT Service Management Suite versions 25.3.01,…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-113693: BMC BMC IT Service Management Suite: Exposure of sensitive information in the SmartIT system-account settings of BMC IT Service Management Suite versions…N/A5.3 MediumN/AOct 29, 2026
CVE-2026-113692: BMC BMC IT Service Management Suite: Path traversal in the SmartIT file-management feature of BMC IT Service Management Suite versions 25.3.01, 25.4.01, and…N/A6.9 MediumN/AOct 29, 2026
CVE-2026-113691: BMC BMC IT Service Management Suite: Stored cross-site scripting in the SmartIT knowledge-article feature of BMC IT Service Management Suite versions…N/A5.1 MediumN/AOct 29, 2026
CVE-2019-25781: Python-Markdown Markdown: Python-Markdown 3.0 through 3.11.2 contains an algorithmic complexity vulnerability in inline link parsing that allows…7.5 High8.7 HighN/AOct 29, 2026
CVE-2026-93011: Red Hat: A flaw was found in dnsmasq5.3 MediumN/AN/AOct 29, 2026
CVE-2026-93007: Red Hat: A flaw was found in dnsmasq5.3 MediumN/AN/AOct 29, 2026
CVE-2026-56056: Mamunur Rashid The Post Grid: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-52709: bPlugins Video Gallery Block: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins Video…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-49142: openemr: OpenEMR before 8.5.0 contains an authenticated SQL injection vulnerability in the Syndromic Surveillance module that…8.8 High8.7 HighN/AOct 29, 2026
CVE-2026-48196: Kaliforms Kali Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kaliforms Kali…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-42703: Kaliforms Kali Forms: Missing Authorization vulnerability in Kaliforms Kali Forms kali-forms allows Exploiting Incorrectly Configured Access…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-39741: RelyWP Simple Cloudflare Turnstile: Missing Authorization vulnerability in RelyWP Simple Cloudflare Turnstile simple-cloudflare-turnstile allows Exploiting…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-39735: Crocoblock JetEngine: Missing Authorization vulnerability in Crocoblock JetEngine jet-engine allows Exploiting Incorrectly Configured Access…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-24533: CozyThemes Cozy Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CozyThemes Cozy…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-22386: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-118094: Igor Funa Ad Inserter: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Igor Funa Ad…6.5 MediumN/AN/AOct 29, 2026
326-350 of 538495