The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-119148: AWS aws-nitro-enclaves-sdk-c: Incomplete string validation in AWS aws-nitro-enclaves-sdk-c before 0.4.6 may allow a third party to impersonate the…6.5 Medium8.2 HighN/AOct 30, 2026
CVE-2026-119116: AWS kmstool-enclave: A use-after-free and double-free issue in the SetClient command handler of the kmstool-enclave sample application of…7.8 High8.7 HighN/AOct 30, 2026
CVE-2026-115642: OpenStack keystonemiddleware: In OpenStack keystonemiddleware before 13.0.2, by supplying a custom X-Service-Token header in a request, anyone in…8.3 HighN/AN/AOct 30, 2026
CVE-2026-112816: Canonical LXD: Improper certificate validation in the HTTPS listener in Canonical LXD 4.0.14, 5.0.10, 5.21.8, 6.9 before 4.0.15,…N/A10.0 CriticalN/AOct 30, 2026
CVE-2026-104623: SUSE Rancher: A security vulnerability exists in the authorization handling for the local (management) cluster shell feature of SUSE…6.3 MediumN/AN/AOct 30, 2026
CVE-2025-49602: n/a: An issue was discovered in Keyfactor EJBCA 9N/AN/AN/AOct 30, 2026
CVE-2026-76012: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…7.5 HighN/AN/AOct 30, 2026
CVE-2026-119113: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is vulnerable to…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-105894: akbilisim Ak Framework: The Ak Framework plugin for WordPress, included in the Newsy - Viral News & Magazine WordPress Theme, is vulnerable to…8.8 HighN/AN/AOct 30, 2026
CVE-2026-115869: themifyme Themify Builder: The Themify Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'variations' repeater…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-109984: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment'…5.4 MediumN/AN/AOct 30, 2026
CVE-2026-104744: Independent Analytics Independent Analytics Pro: The Independent Analytics Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'utm_campaign'…7.2 HighN/AN/AOct 30, 2026
CVE-2026-112365: wpdevteam: The easy.jobs – AI powered Job Listing, Job Board, Career Page, Recruitment & Hiring Solution plugin for WordPress is…7.2 HighN/AN/AOct 30, 2026
CVE-2026-115346: ThemeFusion Avada | Website Builder For WordPress & WooCommerce: The Avada | Website Builder For WordPress & WooCommerce theme for WordPress is vulnerable to Arbitrary File Upload in…8.1 HighN/AN/AOct 30, 2026
CVE-2026-115820: ahmadmj Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin: The Majestic Support – The Leading-Edge Help Desk & Customer Support Plugin plugin for WordPress is vulnerable to…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-118205: wpdevteam Essential Addons for Elementor – Popular Elementor Templates & Widgets: The Essential Addons for Elementor – Popular Elementor Templates & Widgets plugin for WordPress is vulnerable to…7.4 HighN/AN/AOct 30, 2026
CVE-2026-109592: wordpressdotorg: The OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin plugin for WordPress is vulnerable to…4.3 MediumN/AN/AOct 30, 2026
CVE-2026-102918: davidanderson Redux Framework: The Redux Framework plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-102905: spacetime Ad Inserter – Ad Manager & AdSense Ads: The The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to arbitrary shortcode execution in…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-110533: foliovision FV Flowplayer Video Player: The FV Flowplayer Video Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-104739: rabilal JS Help Desk – AI-Powered Support & Ticketing System: The JS Help Desk – AI-Powered Support & Ticketing System plugin for WordPress is vulnerable to arbitrary file deletion…4.9 MediumN/AN/AOct 30, 2026
CVE-2026-96894: wedevs: The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 30, 2026
CVE-2026-97638: wpmudev: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure…7.5 HighN/AN/AOct 30, 2026
CVE-2026-118635: paoltaia GeoDirectory – WP Business Directory Plugin and Classified Listings Directory: The The GeoDirectory – WP Business Directory Plugin and Classified Listings Directory plugin for WordPress is…6.5 MediumN/AN/AOct 30, 2026
CVE-2026-107630: saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce: The Email Templates Customizer and Designer for WordPress and WooCommerce plugin for WordPress is vulnerable to…7.5 HighN/AN/AOct 30, 2026
26-50 of 418318