The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-110380: Arraytics WP Event Solution: Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-107564: gocsaf Development Community csaf_provider: An unauthenticated remote attacker may use an allocation of resources without limits or throttling weakness in the…7.5 High8.7 HighN/AOct 16, 2026
CVE-2026-105958: Red Hat: A flaw was found in spice-server7.5 HighN/AN/AOct 16, 2026
CVE-2026-111391: sgl-project sglang: SGLang 0.5.10 through 0.5.22 contains a code injection vulnerability in _evaluate_filter() that allows remote attackers…8.1 High9.2 CriticalN/AOct 16, 2026
CVE-2026-111390: erupts erupt: Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data…5.3 Medium6.0 MediumN/AOct 16, 2026
CVE-2026-110029: Unknown Squeeze: The Squeeze WordPress plugin before 1.8.1 does not perform a capability check on one of its AJAX actions, allowing…5.4 MediumN/AN/AOct 16, 2026
CVE-2026-109930: Unknown MAIO: The MAIO WordPress plugin before 7.3.22 does not properly restrict access to its analytics data, treating a credential…5.3 MediumN/AN/AOct 16, 2026
CVE-2026-107648: switcorp WP Sessions Time Monitoring Full Automatic: The WP Sessions Time Monitoring Full Automatic plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…7.2 HighN/AN/AOct 16, 2026
CVE-2026-105959: Red Hat: A flaw was found in spice-server7.5 HighN/AN/AOct 16, 2026
CVE-2026-109119: ikus-soft rdiffweb: Improper Privilege Management in the user management API endpoint (/api/users/{username_or_id}) in Rdiffweb allows…8.8 HighN/AN/AOct 16, 2026
CVE-2026-109118: ikus-soft rdiffweb: Improper path containment check in ikus060 rdiffweb 7.1.1 allows an authenticated user to cause the browse, restore,…4.6 MediumN/AN/AOct 16, 2026
CVE-2026-96768: softaculous GoSMTP Pro: The GoSMTP Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Email Log Body…7.2 HighN/A0%Oct 16, 2026
CVE-2026-14452: Checkmk GmbH Checkmk: Improper validation of the reset_url parameter of the Setup in-page search in Checkmk <2.5.0p15, <2.4.0p38, <2.3.0p51…N/A8.6 High0%Oct 16, 2026
CVE-2026-110703: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-107649: liedekef Events Made Easy: The Events Made Easy plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'event[location_name]'…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-106030: Nord Security NordVPN: NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to…N/A6.8 Medium0%Oct 16, 2026
CVE-2026-93681: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-92766: appsbd Vitepos – Point of Sale (POS) for WooCommerce: The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the…7.5 HighN/A0%Oct 16, 2026
CVE-2026-15575: SFM Software Technologies Inc. Costifier: Active debug code vulnerability in SFM Software Technologies Inc5.3 MediumN/A0%Oct 16, 2026
CVE-2026-15219: SFM Software Technologies Inc. Costifier: Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc6.5 MediumN/A0%Oct 16, 2026
CVE-2026-14177: IKAS Technology Inc. ikas E-Commerce Infrastructure: Observable response discrepancy vulnerability in IKAS Technology Inc7.5 HighN/A0%Oct 16, 2026
CVE-2026-111472: TSG Profleet: An SQL injection vulnerability has been discovered in TSG ProfleetN/A9.3 Critical0%Oct 16, 2026
CVE-2026-111311: samuelgallegos: The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP &…8.8 HighN/A1%Oct 16, 2026
CVE-2026-109224: surecart: The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &…7.2 HighN/A0%Oct 16, 2026
CVE-2026-104726: jeroenpeters1986 Name Directory: The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in…6.4 MediumN/A0%Oct 16, 2026
376-400 of 412906
‹›