The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-105256: Unknown LatePoint: The LatePoint WordPress plugin before 5.7.5 does not validate the client-supplied value that determines how much is…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-104642: Unknown Simple Shopping Cart: The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify submitted product prices against a value only…2.7 LowN/AN/AOct 21, 2026
CVE-2026-104641: Unknown Simple Shopping Cart: The Simple Shopping Cart WordPress plugin before 5.3.3 does not verify that a PayPal payment notification is for a…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-103301: Unknown Payment Gateway for Telcell: The Payment Gateway for Telcell WordPress plugin before 2.0.5 does not verify the authenticity of incoming payment…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-101138: Unknown CMP – Coming Soon & Maintenance: The CMP – Coming Soon & Maintenance WordPress plugin before 4.1.21 does not correctly apply maintenance mode to pages…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-70386: OnePlus OxygenOS: Improper neutralization of special elements used in an OS command ('OS command injection') and Missing Authorization…N/A8.5 HighN/AOct 21, 2026
CVE-2026-17557: Red Hat Red Hat OpenShift AI (RHOAI): A flaw was found in the `lm-evaluation-harness` component of Red Hat OpenShift AI6.5 MediumN/AN/AOct 21, 2026
CVE-2026-111075: Eclipse Foundation Eclipse OpenJ9: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component fails to perform cross-field validation on…N/A8.7 HighN/AOct 21, 2026
CVE-2026-111074: Eclipse Foundation Eclipse OpenJ9: In Eclipse OpenJ9 versions prior to 0.63.0, the JITServer component is vulnerable to a pre-authentication remote denial…N/A8.7 HighN/AOct 21, 2026
CVE-2026-110899: Kevin Stover Ninja Forms: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover…7.1 HighN/AN/AOct 21, 2026
CVE-2026-107435: WP Chill Strong Testimonials: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Strong…7.1 HighN/AN/AOct 21, 2026
CVE-2026-96901: Unknown Cart Abandonment Recovery for WooCommerce: The Cart Abandonment Recovery for WooCommerce WordPress plugin before 2.2.0 does not verify the integrity of its…3.7 LowN/AN/AOct 21, 2026
CVE-2026-93856: OpenStack Cinder: In OpenStack Cinder through 29.0.0, cross-project information disclosure can occur in the Messages API4.3 MediumN/AN/AOct 21, 2026
CVE-2026-92999: Unknown Click n Chat (Chat Widget Integration): The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not perform any authorization check on a…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-92998: Unknown Click n Chat (Chat Widget Integration): The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not sanitise sort parameters before using…8.6 HighN/AN/AOct 21, 2026
CVE-2026-92997: Unknown Click n Chat (Chat Widget Integration): The Click n Chat (Chat Widget Integration) WordPress plugin before 1.1.3 does not properly validate a parameter before…8.6 HighN/AN/AOct 21, 2026
CVE-2026-88784: Unknown Translate WordPress with Weglot 2.0: The Translate WordPress with Weglot 2.0 WordPress plugin before 6.4.3 does not escape the URLs it re-inserts into a…7.5 HighN/AN/AOct 21, 2026
CVE-2026-87838: Unknown Wava Payment Plugin: The Wava Payment Plugin WordPress plugin before 0.3.10 does not perform any authorisation, nonce or origin verification…6.5 MediumN/AN/AOct 21, 2026
CVE-2026-87837: Unknown Wava Payment Plugin: The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider…5.3 MediumN/AN/AOct 21, 2026
CVE-2026-86611: Unknown Download Manager: The Download Manager WordPress plugin before 3.3.71, Download Manager WordPress plugin before 7.5.9 does not have CSRF…4.3 MediumN/AN/AOct 21, 2026
CVE-2026-85642: Unknown Formidable Forms: The Formidable Forms WordPress plugin before 7.0 does not verify the identity of the caller before recording the…7.5 HighN/AN/AOct 21, 2026
CVE-2026-81813: Unknown Elementor Website Builder: The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize the text content of SVG files, checking…6.8 MediumN/AN/AOct 21, 2026
CVE-2026-81812: Unknown Elementor Website Builder: The Elementor Website Builder WordPress plugin before 4.3.5 does not sanitize uploaded SVG files on every upload route,…6.4 MediumN/AN/AOct 21, 2026
CVE-2026-79627: Unknown Advanced File Manager: The Advanced File Manager WordPress plugin before 6.0.0 does not correctly determine whether a stored file is an SVG…7.1 HighN/AN/AOct 21, 2026
CVE-2026-71195: OpenStack Manila: In OpenStack Manila before 23.0.1, multiple Manila API operations on public shares do not verify that the caller owns…9.9 CriticalN/AN/AOct 21, 2026
376-400 of 417319
‹›