The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-126621: Improper Certificate Validation7.5 HighN/AN/ANov 11, 2026
CVE-2026-126619: Misinterpretation of SQL statement text in the database layer of Progressive Robot hMailServer 6.0.0-B1 through 6.3.7…4.8 MediumN/AN/ANov 11, 2026
CVE-2026-126618: Improper Restriction of Excessive Authentication Attempts5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126617: SQL Injection8.8 HighN/AN/ANov 11, 2026
CVE-2026-126616: Improper Restriction of Excessive Authentication Attempts5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126615: Authentication Bypass by Alternate Name5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126614: Improper Restriction of Excessive Authentication Attempts5.3 MediumN/AN/ANov 11, 2026
CVE-2026-126613: Allocation of Resources Without Limits or Throttling7.5 HighN/AN/ANov 11, 2026
CVE-2026-126612: Improper Link Resolution Before File Access7.8 HighN/AN/ANov 11, 2026
CVE-2026-126611: Improper Certificate Validation7.0 HighN/AN/ANov 11, 2026
CVE-2026-126610: Improper Certificate Validation7.4 HighN/AN/ANov 11, 2026
CVE-2026-126609: Improper Certificate Validation7.5 HighN/AN/ANov 11, 2026
CVE-2026-126607: Uncontrolled Search Path Element7.8 HighN/AN/ANov 11, 2026
CVE-2026-93487: Octopus Deploy Octopus Server: In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow…N/A7.1 HighN/ANov 11, 2026
CVE-2026-92408: Unknown WPS Bookings for WooCommerce: The WPS Bookings for WooCommerce WordPress plugin before 3.13.1 does not validate a price value taken from user input…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-76981: Zohocorp ADAudit Plus: Zoho Corporation ManageEngine ADAudit Plus versions below 8711 are vulnerable to an authenticated second order SQL…8.8 HighN/AN/ANov 11, 2026
CVE-2026-15785: creapuntome Joinchat – Enhanced “click to chat”: The Joinchat – Enhanced "click to chat" plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via…6.1 MediumN/AN/ANov 11, 2026
CVE-2026-12427: n/a ARforms: The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'description' parameter in all…7.2 HighN/AN/ANov 11, 2026
CVE-2026-12424: n/a ARforms: The ARforms plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Referer Header in all versions up to,…7.2 HighN/AN/ANov 11, 2026
CVE-2026-12062: Zohocorp ADAudit Plus: Zoho Corporation ManageEngine ADAudit Plus versions below 8703 are vulnerable to an authenticated SQL injection…8.8 HighN/AN/ANov 11, 2026
CVE-2026-123668: Unknown GetPaid: The GetPaid WordPress plugin from 2.8.63 to 2.8.64 does not ensure item quantities on its payment forms are whole…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-123659: Unknown ProfilePress: The ProfilePress WordPress plugin before 4.17.6 does not restrict the role and user meta filters its member directories…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119302: Unknown NotificationX: The NotificationX WordPress plugin before 3.3.7 does not perform any capability, authentication or nonce check on its…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-119171: Unknown Advanced Product Fields (Product Addons) for WooCommerce: The Advanced Product Fields (Product Addons) for WooCommerce WordPress plugin from 1.6.22 to 1.7.3 does not validate…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-116468: Red Hat: A flaw was found in the group-move and organization group reparenting endpoints of the keycloak-services component6.6 MediumN/AN/ANov 11, 2026
426-450 of 511254