The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-118413: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 4.0 through 6.1.6…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-118412: Apache Software Foundation Apache Roller: Improper Authentication in Apache Roller 5.1.0 through 6.1.6 allows a user whose account an administrator has disabled…3.1 LowN/AN/ANov 11, 2026
CVE-2026-118411: Apache Software Foundation Apache Roller: Cross-Site Request Forgery (CSRF) in Apache Roller 5.0.1 through 6.1.6 allows an unauthenticated attacker to create an…8.8 HighN/AN/ANov 11, 2026
CVE-2026-118410: Apache Software Foundation Apache Roller: Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an…3.7 LowN/AN/ANov 11, 2026
CVE-2026-118409: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows an unauthenticated…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-118408: Apache Software Foundation Apache Roller: Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a…3.1 LowN/AN/ANov 11, 2026
CVE-2026-118405: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows any logged-in user…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-112201: Keycloak, Red Hat: A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution4.8 MediumN/AN/ANov 11, 2026
CVE-2026-111824: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an…N/AN/AN/ANov 11, 2026
CVE-2026-108338: Apache Software Foundation Apache Roller: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 5.0.1 through…N/AN/AN/ANov 11, 2026
CVE-2026-105154: Apache Software Foundation Apache Roller: Cross-Site Request Forgery (CSRF) in the Planet feed aggregator administration of Apache Roller 4.0 through 6.1.6…6.1 MediumN/AN/ANov 11, 2026
CVE-2026-105153: Apache Software Foundation Apache Roller: Improper Restriction of XML External Entity Reference in Apache Roller 4.0 through 6.1.6 allows an authenticated user…7.7 HighN/AN/ANov 11, 2026
CVE-2026-105152: Apache Software Foundation Apache Roller: Exposure of Sensitive Information to an Unauthorized Actor in Apache Roller 4.0 through 6.1.6 allows a weblog…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124745: Red Hat: A flaw was found in BusyBox6.3 MediumN/AN/ANov 11, 2026
CVE-2026-126627: Apache Software Foundation Apache XML Graphics FOP: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOPN/AN/AN/ANov 11, 2026
CVE-2026-125784: Magnigenie RestroPress: Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request…8.8 HighN/AN/ANov 11, 2026
CVE-2026-125781: NOUS Ouvert Utile et Simple Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125777: Cozmoslabs Profile Builder: Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125761: YITH YITH WooCommerce Ajax Search: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in YITH YITH…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125680: Bold Themes Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125455: Bold Themes Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125451: bPlugins B Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125444: King Addons King Addons for Elementor: Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125439: Kit Kit (formerly ConvertKit): Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125438: Webful Creations RepairBuddy: Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
351-375 of 511254