The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-123988: SililaWijesinghe Food Ordering System: A vulnerability has been found in SililaWijesinghe Food Ordering System up to ba314e897e3365600461e5ea59432e39ceaa0fa55.3 Medium5.5 MediumN/ANov 7, 2026
CVE-2026-123966: Tenda AC19: A vulnerability was determined in Tenda AC19 16.03.10.0710.0 Critical9.3 CriticalN/ANov 7, 2026
CVE-2026-120984: Red Hat: A flaw was found in the Keycloak server's client management component9.1 CriticalN/AN/ANov 7, 2026
CVE-2026-123964: OpenBMB Internet of Agents: A vulnerability was detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a4.3 Medium2.1 LowN/ANov 7, 2026
CVE-2026-123963: OpenBMB Internet of Agents: A security vulnerability has been detected in OpenBMB Internet of Agents up to 9d78e88e47160eb42ee1ee8538c05e1c2c47877a7.3 High5.5 MediumN/ANov 7, 2026
CVE-2026-123861: CrocoBlock JetFormBuilder – Hierarchical Select: Authorization Bypass Through User-Controlled Key vulnerability in CrocoBlock JetFormBuilder – Hierarchical Select…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-123860: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-123483: Crocoblock JetFormBuilder: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Crocoblock…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-123477: Crocoblock JetEngine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-123474: LeapWorx Premium Blocks – Gutenberg Blocks for WordPress: Missing Authorization vulnerability in LeapWorx Premium Blocks – Gutenberg Blocks for WordPress…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-123467: StylemixThemes Motors: Missing Authorization vulnerability in StylemixThemes Motors motors-car-dealership-classified-listings allows…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-123462: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-123183: PluginUs.Net Active Products Tables for WooCommerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in PluginUs.Net Active…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-122669: Everest Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Everest Forms…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-122663: VillaTheme CURCY: Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-122660: BAKKBONE Australia FloristPress: Missing Authorization vulnerability in BAKKBONE Australia FloristPress bakkbone-florist-companion allows Exploiting…4.3 MediumN/AN/ANov 7, 2026
CVE-2026-122659: WP ManageNinja LLC Fluent Booking: Missing Authorization vulnerability in WP ManageNinja LLC Fluent Booking fluent-booking allows Exploiting Incorrectly…5.4 MediumN/AN/ANov 7, 2026
CVE-2026-122041: Themehigh Checkout Field Editor for WooCommerce (Pro): The Checkout Field Editor for WooCommerce (Pro) plugin for WordPress is vulnerable to unauthorized deletion of…9.1 CriticalN/AN/ANov 7, 2026
CVE-2026-121784: Magepeople inc. WpBookingly: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magepeople inc6.5 MediumN/AN/ANov 7, 2026
CVE-2026-121777: Cool Plugins Cool Formkit Lite: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Cool Plugins Cool…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-121775: VillaTheme CURCY: Missing Authorization vulnerability in VillaTheme CURCY woo-multi-currency allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-121579: Unlimited Elements: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Unlimited…6.5 MediumN/AN/ANov 7, 2026
CVE-2026-121575: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 7, 2026
CVE-2026-120841: Magepeople inc. WpTravelly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.8 HighN/AN/ANov 7, 2026
CVE-2026-120839: Magepeople inc. WpTravelly: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability…8.8 HighN/AN/ANov 7, 2026
326-350 of 418627
‹›