The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-111419: Foxit Software Inc. foxit.com: A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains…8.6 HighN/AN/AOct 29, 2026
CVE-2026-111418: Foxit Software Inc. foxit.com: A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service7.5 HighN/AN/AOct 29, 2026
CVE-2026-111417: Foxit Software Inc. foxit.com: A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the…7.5 HighN/AN/AOct 29, 2026
CVE-2026-111318: devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder: The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-110707: themeisle: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress…4.7 MediumN/AN/AOct 29, 2026
CVE-2026-109215: litespeedtech LiteSpeed Cache: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content'…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-107743: mapster Mapster WP Maps: The Mapster WP Maps plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including,…7.2 HighN/AN/AOct 29, 2026
CVE-2026-107629: wpsoul Greenshift – animation and page builder blocks: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-107627: wpsoul Greenshift – animation and page builder blocks: The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-104727: berocket Sequential Order Numbers for WooCommerce: The Sequential Order Numbers for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-103875: dglingren Media Library Assistant: The Media Library Assistant plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the…4.7 MediumN/AN/AOct 29, 2026
CVE-2026-103485: hupe13 Extensions for Leaflet Map: The Extensions for Leaflet Map plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-7190: ICT Innovations ICT Innovations’ PHP-CGI/PHP-FPM configuration: A cross-site scripting (XSS) vulnerability in the ICTBroadcast software, which affects the demo environmentN/A5.1 MediumN/AOct 29, 2026
CVE-2026-115303: Unknown Contact Form by Supsystic: The Contact Form by Supsystic WordPress plugin before 1.11.1 does not strip CR/LF characters or re-validate submitted…3.7 LowN/AN/AOct 29, 2026
CVE-2026-114358: Radius Synergies Radius Xenia M2M Platform: This vulnerability exists in the Radius Xenia M2M Platform due to insufficient validation of user supplied input in the…N/A9.3 CriticalN/AOct 29, 2026
CVE-2026-88941: Kaspersky: Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center5.2 Medium6.2 MediumN/AOct 29, 2026
CVE-2026-85498: Red Hat: A flaw was found in polkit3.5 LowN/AN/AOct 29, 2026
CVE-2026-117174: Rejected reason: VUL-2026-008368 為先回報之相同問題N/AN/AN/AOct 29, 2026
CVE-2025-62841: QNAP Systems Inc.: An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid…N/A8.7 HighN/AOct 29, 2026
CVE-2025-62839: QNAP Systems Inc.: An use of hard-coded cryptographic key vulnerability has been reported to affect HBS 3 Hybrid Backup Sync and Hybrid…N/A8.7 HighN/AOct 29, 2026
CVE-2026-118030: Red Hat: A flaw was found in the HOTP authentication mechanism of the keycloak-services component, which provides identity and…4.2 MediumN/AN/AOct 29, 2026
CVE-2026-117859: Red Hat: A flaw was found in the Pushed Authorization Request PAR implementation of the keycloak-services component5.4 MediumN/AN/AOct 29, 2026
CVE-2026-117688: Red Hat: A flaw was found in the client registration component of Keycloak, an open-source identity and access management…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-117627: Red Hat: A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component5.4 MediumN/AN/AOct 29, 2026
CVE-2026-117548: Red Hat: A NULL pointer dereference flaw was found in 389-ds-base6.5 MediumN/AN/AOct 29, 2026
401-425 of 538495