The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

CVEsMetasploit Modules
Emergent Threat6

TitleEitWModules
CVE-2026-44265: enspirit elo: Elo is a purely functional expression language for no-code tools7.4 HighN/AN/ANov 3, 2026
CVE-2026-39777: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-39743: WC Lovers WCFM Membership: Missing Authorization vulnerability in WC Lovers WCFM Membership wc-multivendor-membership allows Exploiting…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-38601: n/a: A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user,…N/AN/AN/ANov 3, 2026
CVE-2026-38600: n/a: A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write…N/AN/AN/ANov 3, 2026
CVE-2026-38595: n/a: An issue in im3x Scriptables through v2-dev branch allows attackers to inject arbitrary OS commands via uploading a…N/AN/AN/ANov 3, 2026
CVE-2026-121604: wlroots: wlroots before 0.20.2 contains an out-of-bounds read vulnerability in read_surface_class() in xwayland/xwm.c that…3.3 Low4.8 MediumN/ANov 3, 2026
CVE-2026-121602: solanum-ircd solanum: Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server…6.5 Medium8.5 HighN/ANov 3, 2026
CVE-2026-121588: texlyre: TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute…6.1 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121587: coollabsio coolify: Coolify before 4.1.1 contains an information disclosure vulnerability that allows unauthenticated attackers to…5.3 Medium6.9 MediumN/ANov 3, 2026
CVE-2026-121262: phpMyAdmin SQL-Parser: A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.15.3 Medium5.5 MediumN/ANov 3, 2026
CVE-2026-121261: phpMyAdmin ShapeFile: A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.14.3 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121259: Red Hat: A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad6.5 MediumN/AN/ANov 3, 2026
CVE-2026-120846: Uncanny Owl Uncanny Automator: Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-120843: Barn2 Plugins Posts Table with Search & Sort: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Barn2 Plugins…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-119521: Cozmoslabs Paid Member Subscriptions: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Cozmoslabs Paid…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-119485: weDevs Dokan: Missing Authorization vulnerability in weDevs Dokan dokan-lite allows Exploiting Incorrectly Configured Access Control…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-116859: WPMU DEV Forminator: Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access…5.3 MediumN/AN/ANov 3, 2026
CVE-2026-116858: WPMU DEV Forminator: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WPMU DEV Forminator…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-114183: WPVibes AnyWhere Elementor: Insertion of Sensitive Information Into Sent Data vulnerability in WPVibes AnyWhere Elementor anywhere-elementor allows…6.5 MediumN/AN/ANov 3, 2026
CVE-2026-103077: myCred: Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control…4.3 MediumN/AN/ANov 3, 2026
CVE-2026-121263: phpMyAdmin MoTranslator: A vulnerability was determined in phpMyAdmin MoTranslator up to 6.0.16.3 Medium2.1 LowN/ANov 3, 2026
CVE-2026-121628: bagisto: Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows…3.7 Low6.3 MediumN/ANov 3, 2026
CVE-2026-121627: jarun buku: buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows…6.1 Medium5.3 MediumN/ANov 3, 2026
CVE-2026-121626: willamowius gnugk: GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket()…3.7 Low6.3 MediumN/ANov 3, 2026
26-50 of 528356
‹›