The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119028: oapi-codegen: oapi-codegen 2.0.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by…8.8 High8.7 HighN/AOct 29, 2026
CVE-2026-119027: oapi-codegen: oapi-codegen 2.5.0 before 2.8.1 contains a code injection vulnerability that allows attackers to inject Go code by…7.5 High7.7 HighN/AOct 29, 2026
CVE-2026-119025: sindresorhus, modelcontextprotocol, anomalyco: open 7.2.0 before 11.0.0 contains an OS command injection vulnerability that allows attackers to execute PowerShell…7.5 High7.7 HighN/AOct 29, 2026
CVE-2026-115821: NewsmanApp: The NewsmanApp plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'billing_first_name,…7.2 HighN/AN/AOct 29, 2026
CVE-2026-110184: blazethemes Newsmatic: The Newsmatic theme for WordPress is vulnerable to blind SQL Injection via the 'slug' parameter in all versions up to,…7.5 HighN/AN/AOct 29, 2026
CVE-2026-109822: Yamaha Corporation NWR100: Yamaha wireless LAN router NWR100 provided by Yamaha Corporation contains an issue with insecure storage of sensitive…6.5 Medium7.1 HighN/AOct 29, 2026
CVE-2026-109216: metabox Meta Box – A Framework for Dynamic Websites: The Meta Box – A Framework for Dynamic Websites plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…4.9 MediumN/AN/AOct 29, 2026
CVE-2026-103665: Yamaha Corporation Yamaha LAN Monitor for Windows: The installer for Yamaha LAN Monitor for Windows provided by Yamaha Corporation may insecurely load Dynamic Link…7.8 High8.4 HighN/AOct 29, 2026
CVE-2026-71569: Apache Software Foundation Apache Camel: Server-Side Request Forgery (SSRF) vulnerability in Apache Camel A2A component4.8 MediumN/AN/AOct 29, 2026
CVE-2026-33924: Nozomi Networks: Two OS command injection vulnerabilities were discovered in the update installation functionality due to insufficient…7.2 High7.5 HighN/AOct 29, 2026
CVE-2026-33923: Nozomi Networks: A signature verification vulnerability was discovered in the update installation functionality due to inconsistent…7.2 High7.5 HighN/AOct 29, 2026
CVE-2026-118989: WebToffee Product Import Export for WooCommerce: WebToffee Product Import Export for WooCommerce 2.5.1 before 2.6.8 contains a server-side request forgery vulnerability…5.5 Medium5.1 MediumN/AOct 29, 2026
CVE-2026-116409: WP Swings Upsell Order Bump Offer for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Swings Upsell…7.1 HighN/AN/AOct 29, 2026
CVE-2026-115967: Hamid Alinia Login with phone number: Weak Authentication vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Authentication…8.8 HighN/AN/AOct 29, 2026
CVE-2026-115965: BuddyPress: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in BuddyPress…8.5 HighN/AN/AOct 29, 2026
CVE-2026-115964: StylemixThemes Motors: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in StylemixThemes…9.3 CriticalN/AN/AOct 29, 2026
CVE-2026-115963: VideoWhisper.com Broadcast Live Video: Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration…7.1 HighN/AN/AOct 29, 2026
CVE-2026-115962: myCred: Authentication Bypass by Spoofing vulnerability in myCred myCred mycred allows Identity Spoofing.This issue affects…4.3 MediumN/AN/AOct 29, 2026
CVE-2026-115942: Apache Software Foundation Apache Qpid Proton C: A misconfigured wildcard TLS certificate causes a stack read overflowN/AN/AN/AOct 29, 2026
CVE-2026-115611: PluginUs.Net TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net…7.1 HighN/AN/AOct 29, 2026
CVE-2026-115599: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…7.5 HighN/AN/AOct 29, 2026
CVE-2026-115592: OceanWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP…7.1 HighN/AN/AOct 29, 2026
CVE-2026-114230: Apache Software Foundation Apache Qpid Proton C: When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL…N/AN/AN/AOct 29, 2026
CVE-2026-114193: Eyal Fitoussi GEO my WordPress: Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly…7.5 HighN/AN/AOct 29, 2026
CVE-2026-112827: VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce: Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce…7.1 HighN/AN/AOct 29, 2026
401-425 of 538495