The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6
TitleEitWModules
CVE-2026-117627: Red Hat: A flaw was found in the JWT Authorization Grant implementation of the keycloak-services component5.4 MediumN/AN/AOct 29, 2026
CVE-2026-117548: Red Hat: A NULL pointer dereference flaw was found in 389-ds-base6.5 MediumN/AN/AOct 29, 2026
CVE-2026-93293: saadiqbal Password Protected – Protect Your Site Content With a Password: The Password Protected plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the bundled Freemius SDK's…6.4 MediumN/AN/AOct 29, 2026
CVE-2026-118905: nvm-sh nvm: Node Version Manager (nvm) is a POSIX-compliant shell function for managing multiple node.js versions7.0 High7.1 HighN/AOct 29, 2026
CVE-2026-114488: Red Hat: A flaw was found in Wildfly7.4 HighN/AN/AOct 29, 2026
CVE-2026-19610: Red Hat: A flaw was found in the platform-mbean component of JBoss EAP, which provides management access to JVM-level metrics…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-15564: Red Hat: Wildfly's IIOP listener may permit deserialization of input streams before authentication is performed7.4 HighN/AN/AOct 29, 2026
CVE-2026-86794: Unknown Community Events: The Community Events WordPress plugin before 1.6.0 does not have authorisation or nonce checks when processing public…N/AN/AN/AOct 29, 2026
CVE-2026-85007: Unknown Video Player for YouTube: The Video Player for YouTube WordPress plugin before 2.1.4 does not perform a capability check on its player-preset…N/AN/AN/AOct 29, 2026
CVE-2026-115259: Unknown Photo Engine (Media Organizer & Lightroom): The Photo Engine (Media Organizer & Lightroom) WordPress plugin before 6.6.0 does not have proper authorization checks…N/AN/AN/AOct 29, 2026
CVE-2026-115245: Unknown Chat AI with Dispatcher: The Chat AI with Dispatcher WordPress plugin before 2.4 does not properly validate uploaded files, relying only on a…N/AN/AN/AOct 29, 2026
CVE-2026-114270: Unknown GeoDirectory: The GeoDirectory WordPress plugin before 2.8.197 does not honour post password protection when rendering a listing,…N/AN/AN/AOct 29, 2026
CVE-2026-113617: Unknown Automated Import Products to Cart: The Automated Import Products to Cart WordPress plugin before 1.0.4 does not sanitize a user-supplied file path before…N/AN/AN/AOct 29, 2026
CVE-2026-113616: Unknown LogixFast Auth: The LogixFast Auth WordPress plugin before 1.0.4 does not deliver its password-reset one-time code to the resolved…N/AN/AN/AOct 29, 2026
CVE-2026-111739: Unknown: The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security (AIOS) WordPress plugin before 5.5.0…N/AN/AN/AOct 29, 2026
CVE-2026-110983: Unknown WP Photo Album Plus: The WP Photo Album Plus WordPress plugin before 9.3.04.004 does not verify the origin or a security token for one of…N/AN/AN/AOct 29, 2026
CVE-2026-110505: Unknown: The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not prevent animation elements in uploaded SVG…N/AN/AN/AOct 29, 2026
CVE-2026-110504: Unknown: The Enable SVG, WebP, and ICO Upload WordPress plugin before 1.1.6 does not sanitize uploaded SVG files whose content…N/AN/AN/AOct 29, 2026
CVE-2026-110030: Unknown Hide Price Until Login: The Hide Price Until Login WordPress plugin before 1.1.2 does not restrict a guest-registration handler and does not…N/AN/AN/AOct 29, 2026
CVE-2026-108763: Unknown Wallet System for WooCommerce: The Wallet System for WooCommerce WordPress plugin before 2.8.2 does not restrict its KYC document submission handler…N/AN/AN/AOct 29, 2026
CVE-2026-108686: Unknown WP Post Author: The WP Post Author WordPress plugin before 4.2.0 does not restrict the integration settings it returns to visitors,…N/AN/AN/AOct 29, 2026
CVE-2026-108685: Unknown WP Post Author: The WP Post Author WordPress plugin before 4.2.0 does not check that the account was created before updating its…N/AN/AN/AOct 29, 2026
CVE-2026-105258: Unknown Appointment Booking Plugin: The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings…N/AN/AN/AOct 29, 2026
CVE-2026-103693: Unknown: The Frontend Dashboard WordPress plugin before 3.0.5, ProfileGrid WordPress plugin before 6.0.0.5 do not prevent an…N/AN/AN/AOct 29, 2026
CVE-2024-3586: Unknown LetterPress: The LetterPress WordPress plugin before 2.4.0 does not sanitise and escape some of its settings, which could allow high…N/AN/AN/AOct 29, 2026
26-50 of 416436