The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6
TitleEitWModules
CVE-2026-106030: Nord Security NordVPN: NordVPN for Windows allows local attackers to stop unprotected Windows system services and change their startup type to…N/A6.8 Medium0%Oct 16, 2026
CVE-2026-93681: themeum Tutor LMS – eLearning and online course solution: The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-92766: appsbd Vitepos – Point of Sale (POS) for WooCommerce: The Vitepos – Point of Sale (POS) for WooCommerce plugin for WordPress is vulnerable to generic SQL Injection via the…7.5 HighN/A0%Oct 16, 2026
CVE-2026-15575: SFM Software Technologies Inc. Costifier: Active debug code vulnerability in SFM Software Technologies Inc5.3 MediumN/A0%Oct 16, 2026
CVE-2026-15219: SFM Software Technologies Inc. Costifier: Authorization bypass through User-Controlled key vulnerability in SFM Software Technologies Inc6.5 MediumN/A0%Oct 16, 2026
CVE-2026-14177: IKAS Technology Inc. ikas E-Commerce Infrastructure: Observable response discrepancy vulnerability in IKAS Technology Inc7.5 HighN/A0%Oct 16, 2026
CVE-2026-111472: TSG Profleet: An SQL injection vulnerability has been discovered in TSG ProfleetN/A9.3 Critical0%Oct 16, 2026
CVE-2026-111311: samuelgallegos: The DoubleScale | All-in-One CRM – Sales, Multi-Channel Marketing, Newsletter, Booking, Helpdesk, Automation, MCP &…8.8 HighN/A1%Oct 16, 2026
CVE-2026-109224: surecart: The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, &…7.2 HighN/A0%Oct 16, 2026
CVE-2026-104726: jeroenpeters1986 Name Directory: The Name Directory plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'dir' Shortcode Attribute in…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-104003: properfraction: The WP User Avatar / ProfilePress plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in versions up…5.4 MediumN/A0%Oct 16, 2026
CVE-2026-101300: Wegow Technologies Wegow: Server-Side Request Forgery (SSRF) reported in the ticket sales chart PDF export functionality of WegowN/A7.1 High0%Oct 16, 2026
CVE-2026-96870: brainstormforce: The SureDash – Community, Courses & Member Dashboard plugin for WordPress is vulnerable to Stored Cross-Site Scripting…6.4 MediumN/A0%Oct 16, 2026
CVE-2026-87111: WPEverest: The User Registration PRO – Custom Registration Form, Login Form, and User Profile WordPress Plugin plugin for…7.2 HighN/A0%Oct 16, 2026
CVE-2026-75903: manuelgalan Vulnity Security: The Vulnity Security plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including,…8.1 HighN/A1%Oct 16, 2026
CVE-2026-19621: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to strip action…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-19600: Mattermost: Mattermost versions 11.9.x <= 11.9.1, 11.8.x <= 11.8.5, 11.7.x <= 11.7.10, 11.10.x <= 11.10.1 fail to sanitize…4.5 MediumN/A0%Oct 16, 2026
CVE-2026-19076: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to reject OAuth…4.4 MediumN/A0%Oct 16, 2026
CVE-2026-18799: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to restrict Slack…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-18560: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate user’s…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-18256: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to properly restrict…4.3 MediumN/A0%Oct 16, 2026
CVE-2026-18223: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to validate the…5.0 MediumN/A0%Oct 16, 2026
CVE-2026-16453: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to verify the…7.1 HighN/A0%Oct 16, 2026
CVE-2026-16251: Mattermost: Mattermost versions 11.10.x <= 11.10.0, 11.7.x <= 11.7.9, 11.9.x <= 11.9.1, 11.8.x <= 11.8.5 fail to limit the size of…6.5 MediumN/A0%Oct 16, 2026
CVE-2026-100108: maxfoundry Social Share Buttons: The Social Share Buttons plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form (containing…6.4 MediumN/A0%Oct 16, 2026
401-425 of 521709
‹›