The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-111455: Apache Software Foundation Apache Airflow: Apache Airflow's asynchronous connection test checked permissions when the test was queued — only create permission…N/AN/AN/ANov 9, 2026
CVE-2026-111454: Apache Software Foundation Apache Airflow: Apache Airflow's asset API endpoints returned the IDs of Dags that are scheduled on, produce, or consume an asset…N/AN/AN/ANov 9, 2026
CVE-2026-111452: Apache Software Foundation Apache Airflow: Apache Airflow's secrets masker matched sensitive key names only in their snake_case form, so values stored under…N/AN/AN/ANov 9, 2026
CVE-2026-111395: Apache Software Foundation Apache Airflow: Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`N/AN/AN/ANov 9, 2026
CVE-2026-107474: Apache Software Foundation Apache Airflow: The Apache Airflow connections API did not mask the apprise provider's `config` connection extra, which can embed…N/AN/AN/ANov 9, 2026
CVE-2026-101031: Apache Software Foundation Apache Airflow: The `example_dag_decorator` example Dag shipped with Apache Airflow validated an IP address fetched over HTTP with…N/AN/AN/ANov 9, 2026
CVE-2026-119483: 10Web Form Maker by 10Web: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in 10Web Form Maker…7.1 HighN/AN/ANov 9, 2026
CVE-2026-119497: wpWax Directorist: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in wpWax Directorist…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-119505: Welcart Welcart e-Commerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Welcart Welcart…7.1 HighN/AN/ANov 9, 2026
CVE-2026-123463: WP Wham Checkout Files Upload for WooCommerce: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Wham Checkout…7.1 HighN/AN/ANov 9, 2026
CVE-2026-121763: WPMU DEV Hummingbird: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WPMU DEV…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-66675: StylemixThemes Motors: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in StylemixThemes…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-119514: Webful Creations RepairBuddy: Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege…6.3 MediumN/AN/ANov 9, 2026
CVE-2026-123484: Crocoblock JetFormBuilder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock…7.1 HighN/AN/ANov 9, 2026
CVE-2026-121764: FolioVision FV Flowplayer Video Player: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in FolioVision FV…7.1 HighN/AN/ANov 9, 2026
CVE-2026-119504: DynamiApps Frontend Admin by DynamiApps: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in DynamiApps…7.1 HighN/AN/ANov 9, 2026
CVE-2026-119503: Welcart Welcart e-Commerce: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Welcart Welcart…6.5 MediumN/AN/ANov 9, 2026
CVE-2026-54863: Mamunur Rashid Review Schema: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Mamunur Rashid…7.1 HighN/AN/ANov 9, 2026
CVE-2026-123465: myCred: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in myCred myCred mycred allows…7.5 HighN/AN/ANov 9, 2026
CVE-2026-121780: Gijo Varghese Flying Images: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gijo Varghese…7.1 HighN/AN/ANov 9, 2026
CVE-2026-111403: WP Inventory WP Inventory Manager: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Inventory WP…7.1 HighN/AN/ANov 9, 2026
CVE-2026-121760: weDevs weDocs: Missing Authorization vulnerability in weDevs weDocs wedocs allows Exploiting Incorrectly Configured Access Control…7.5 HighN/AN/ANov 9, 2026
CVE-2026-124587: elizaOS eliza: A vulnerability was identified in elizaOS eliza 2.0.3-beta.74.3 Medium2.1 LowN/ANov 9, 2026
CVE-2026-92606: TÜBİTAK BİLGEM Software Technologies Research Institute Pardus MyComputer: Time-of-check time-of-use (TOCTOU) race condition vulnerability in TÜBİTAK BİLGEM Software Technologies Research…6.0 MediumN/A0%Nov 9, 2026
CVE-2026-124585: Chengdu Feiyuxing Technology: A vulnerability was found in Chengdu Feiyuxing Technology VW2100 and VEC10GP 1.0 B-MB3W202-210825-r117759.9 Critical8.6 High2%Nov 9, 2026
426-450 of 427771
‹›