The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-126610: Improper Certificate Validation7.4 HighN/AN/ANov 11, 2026
CVE-2026-126609: Improper Certificate Validation7.5 HighN/AN/ANov 11, 2026
CVE-2026-126607: Uncontrolled Search Path Element7.8 HighN/AN/ANov 11, 2026
CVE-2026-93487: Octopus Deploy Octopus Server: In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow…N/A7.1 HighN/ANov 11, 2026
CVE-2026-92408: Unknown WPS Bookings for WooCommerce: The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-76981: Zohocorp ADAudit Plus: Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL…8.8 HighN/AN/ANov 11, 2026
CVE-2026-15785: creapuntome Joinchat – Enhanced “click to chat”: The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via…6.1 MediumN/AN/ANov 11, 2026
CVE-2026-12427: n/a ARforms: The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all…7.2 HighN/AN/ANov 11, 2026
CVE-2026-12424: n/a ARforms: The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to,…7.2 HighN/AN/ANov 11, 2026
CVE-2026-12062: Zohocorp ADAudit Plus: Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection…8.8 HighN/AN/ANov 11, 2026
CVE-2026-123668: Unknown GetPaid: The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123659: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119302: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-119171: Unknown Advanced Product Fields (Product Addons) for WooCommerce: The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-116468: Red Hat: A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component6.6 MediumN/AN/ANov 11, 2026
CVE-2026-111190: n/a ARforms: The ARForms plugin for WordPress is vulnerable to arbitrary file upload in all versions up to, and including, 7.2.4 via…8.1 HighN/AN/ANov 11, 2026
CVE-2026-105948: Octopus Deploy Octopus Server: In affected versions of Octopus Server, incorrect validation of permissions assigned to a user that would allow them to…N/A7.7 HighN/ANov 11, 2026
CVE-2025-59848: HCL Software HCL Leap: HCL Leap is vulnerable to Stored XSS through malicious application titles in the Manage page dialogs, allowing an…6.8 MediumN/AN/ANov 11, 2026
CVE-2025-59847: HCL Software HCL Domino Leap: HCL Domino Leap is vulnerable to Stored XSS through malicious application titles in Manage page dialogs, allowing an…6.8 MediumN/AN/ANov 11, 2026
CVE-2026-96414: Octopus Deploy Octopus Server: In affected versions of Octopus Server, insufficient integrity protection of authentication cookies, combined with…N/A8.7 HighN/ANov 11, 2026
CVE-2026-88813: Unknown YITH WooCommerce Gift Cards: The YITH WooCommerce Gift Cards WordPress plugin through 4.39.0 does not reconcile the value of a gift card it issues…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123705: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123704: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not restrict access to one of its REST API routes,…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123703: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123702: Unknown Security For WooCommerce: The Security For WooCommerce WordPress plugin through 1.0.16 does not check that the requester is authorised before…6.5 MediumN/AN/ANov 11, 2026
401-425 of 511254