The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-124580: Chengdu Feiyuxing Technology: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r1177510.0 Critical9.3 Critical3%Nov 9, 2026
CVE-2026-124579: aaPanel BillionMail: A vulnerability was determined in aaPanel BillionMail up to 4.97.4 High2.1 Low0%Nov 9, 2026
CVE-2026-124578: Pantum BP5100DW: A security vulnerability has been detected in Pantum BP5100DW 3.A.4.75.3 Medium6.9 Medium0%Nov 9, 2026
CVE-2026-124577: Intelbras SG 2404 PoE L2+: A weakness has been identified in Intelbras SG 2404 PoE L2+ 1.00.70/1.00.729.8 Critical8.9 High2%Nov 9, 2026
CVE-2026-120386: Effekseer: Effekseer improperly validates "effect" files4.3 Medium5.1 Medium0%Nov 9, 2026
CVE-2026-113437: DOS Co., Ltd., Rococo Co. Ltd.: Path Traversal vulnerability exists in SS1/ SS1 Cloud provided by DOS Co., Ltd5.3 Medium6.9 Medium0%Nov 9, 2026
CVE-2026-109582: DOS Co., Ltd. SS1: Insecure storage of sensitive information issue exists in SS1 provided by DOS Co., Ltd4.0 Medium5.1 Medium0%Nov 9, 2026
CVE-2026-81422: Unknown Advanced Appointment Booking & Scheduling: The Advanced Appointment Booking & Scheduling WordPress plugin before 2.7 does not verify the site's user-registration…5.3 MediumN/A0%Nov 9, 2026
CVE-2026-124576: n/a BeikeShop: A security flaw has been discovered in BeikeShop up to 2.0.0.317.3 High6.9 Medium0%Nov 9, 2026
CVE-2026-124575: SiteServer SSCMS: A vulnerability was identified in SiteServer SSCMS up to 7.1.3/7.2.1/7.4.03.7 Low6.3 Medium0%Nov 9, 2026
CVE-2026-124574: chenyme grok2api: A vulnerability was determined in chenyme grok2api up to 3.1.66.3 Medium2.1 Low0%Nov 9, 2026
CVE-2026-124573: n/a logseq: A vulnerability was found in logseq 2.0.1/2.0.27.3 High5.5 Medium0%Nov 9, 2026
CVE-2026-124572: DataLinkDC dinky: A vulnerability has been found in DataLinkDC dinky up to 1.2.55.4 Medium5.3 Medium0%Nov 9, 2026
CVE-2026-123751: Unknown WP Duplicate: The WP Duplicate WordPress plugin through 1.1.11 does not properly verify a request authentication value and does not…9.8 CriticalN/A0%Nov 9, 2026
CVE-2026-123145: Unknown WooCommerce Stripe Payment Gateway: The WooCommerce Stripe Payment Gateway WordPress plugin before 11.1.0 does not exclude the account password from the…4.4 MediumN/A0%Nov 9, 2026
CVE-2026-123131: Unknown GemBooking: The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own…5.9 MediumN/A0%Nov 9, 2026
CVE-2026-123129: Unknown Event Tickets Manager for WooCommerce: The Event Tickets Manager for WooCommerce WordPress plugin before 1.6.0 does not validate the ticket-type price sent to…5.3 MediumN/A0%Nov 9, 2026
CVE-2026-123128: Unknown GemBooking: The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing…3.7 LowN/A0%Nov 9, 2026
CVE-2026-123091: Unknown Vigilant: The Vigilant WordPress plugin before 2.11.0 does not enforce its two-factor authentication on login forms other than…7.5 HighN/A0%Nov 9, 2026
CVE-2026-123088: Unknown UniPAY Payment Gateway For WooCommerce: The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before…5.3 MediumN/A0%Nov 9, 2026
CVE-2026-123064: Unknown: The WP BASE Booking of Appointments, Services and Events WordPress plugin before 6.5.1 does not properly restrict…8.8 HighN/A0%Nov 9, 2026
CVE-2026-121875: Unknown Post Duplicator: The Post Duplicator WordPress plugin before 3.0.18 does not validate the capabilities assigned to roles through its…7.2 HighN/A0%Nov 9, 2026
CVE-2026-121874: Unknown Post Duplicator: The Post Duplicator WordPress plugin before 3.0.18 does not restrict settings saves to its own options, allowing a site…7.2 HighN/A0%Nov 9, 2026
CVE-2026-121759: Unknown Fusion Page Builder: The Fusion Page Builder WordPress plugin before 1.7.1 does not check that the user owns the content it moves to the…4.9 MediumN/A0%Nov 9, 2026
CVE-2026-120409: Unknown All-in-One Video Gallery: The All-in-One Video Gallery WordPress plugin before 5.1.1 does not check whether a video is password protected before…5.3 MediumN/A0%Nov 9, 2026
351-375 of 427771
‹›