The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-117174: Rejected reason: VUL-2026-008368 為先回報之相同問題N/AN/AN/AOct 29, 2026
CVE-2025-62841: QNAP Systems Inc.: An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid…N/A8.7 HighN/AOct 29, 2026
CVE-2025-62839: QNAP Systems Inc.: An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid…N/A8.7 HighN/AOct 29, 2026
CVE-2026-118030: Red Hat: A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and…4.2 MediumN/AN/AOct 29, 2026
CVE-2026-117859: Red Hat: A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component5.4 MediumN/AN/AOct 29, 2026
CVE-2026-117688: Red Hat: A flaw was found in the client registration component of Keycloak, an open-source identity and access management…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-117627: Red Hat: A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component5.4 MediumN/AN/AOct 29, 2026
CVE-2026-117548: Red Hat: A NULL pointer dereference flaw was found in 389-ds-base6.5 MediumN/AN/AOct 29, 2026
CVE-2026-93293: saadiqbal Password Protected – Protect Your Site Content With a Password: The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-89216: Unknown vTables: The vTables WordPress plugin before 0.3 does not properly sanitise and escape a parameter before using it in a SQL…8.6 HighN/AN/AOct 29, 2026
CVE-2026-88928: Unknown PAYCOMET for WooCommerce: The PAYCOMET for WooCommerce WordPress plugin before 5.46 does not verify the cryptographic signature on its payment…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-86794: Unknown Community Events: The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public…8.8 HighN/AN/AOct 29, 2026
CVE-2026-85007: Unknown Video Player for YouTube: The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset…3.8 LowN/AN/AOct 29, 2026
CVE-2026-78396: Unknown Link Library: The Link Library WordPress plugin before 7.10.0 does not verify that a requested link belongs to the settings set whose…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-78395: Unknown Link Library: The Link Library WordPress plugin before 7.10.0 does not re-check the selected library's own login requirement when…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-19610: Red Hat: A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-118905: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions7.0 High7.1 HighN/AOct 29, 2026
CVE-2026-115302: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not restrict access to an AJAX action that deletes…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-115301: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not sandbox the template engine used to render its…7.2 HighN/AN/AOct 29, 2026
CVE-2026-115300: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not validate a CSRF token or request origin on two…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-115299: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not verify a CSRF nonce before saving its mail…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-115282: Unknown Recipe Card Blocks Lite: The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-115259: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks…4.9 MediumN/AN/AOct 29, 2026
CVE-2026-115245: Unknown Chat AI with Dispatcher: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…9.8 CriticalN/AN/AOct 29, 2026
CVE-2026-114270: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing,…5.3 MediumN/AN/AOct 29, 2026
351-375 of 538495