The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-59076: Edito Edito CMS: Edito CMS is vulnerable to Stored Cross-Site Scripting (XSS)N/A5.1 MediumN/ANov 13, 2026
CVE-2026-59075: Edito Edito CMS: Edito CMS is vulnerable to Dynamic LINQ injectionN/A7.1 HighN/ANov 13, 2026
CVE-2026-59074: Edito Edito CMS: Edito CMS is vulnerable to improper cryptographic signature verification in the JWT refresh logicN/A8.7 HighN/ANov 13, 2026
CVE-2026-128637: misp misp-modules: The MISP Modules website component contains an open redirect vulnerability in its login endpointN/A5.1 MediumN/ANov 13, 2026
CVE-2026-120863: Citrix: Memory overflow in the management plane can lead to unpredictable or erroneous behavior or Denial of Service in Citrix…N/A8.7 HighN/ANov 13, 2026
CVE-2026-120862: Citrix: Memory overflow in SIP ALG (LSN) and DNS answer-section logging datapaths can lead to unpredictable or erroneous…N/A8.7 HighN/ANov 13, 2026
CVE-2026-120861: Citrix: Memory overflow / improper handling in GSLB and geolocation (MEP, static-proximity, config-sync) can lead to…N/A8.7 HighN/ANov 13, 2026
CVE-2026-120860: Citrix: Memory overflow in protocol load-balancing traffic handling (Diameter, SIP-over-TCP, MQTT, RADIUS) can lead to…N/A8.7 HighN/ANov 13, 2026
CVE-2026-116432: Dell PowerScale InsightIQ: Dell PowerScale InsightIQ, versions 6.3.0 through 6.4.0, contains an Insertion of Sensitive Information into Log File…4.3 MediumN/AN/ANov 13, 2026
CVE-2026-111339: Citrix: Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior…N/A6.9 MediumN/ANov 13, 2026
CVE-2026-111338: Citrix: Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway.N/A6.9 MediumN/ANov 13, 2026
CVE-2026-111337: Citrix: Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or…N/A8.7 HighN/ANov 13, 2026
CVE-2026-111336: Citrix: Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix…N/A8.3 HighN/ANov 13, 2026
CVE-2026-111335: Citrix: Improper request handling can lead to a denial-of-service / reboot-loop condition in Citrix NetScaler ADC and Citrix…N/A6.9 MediumN/ANov 13, 2026
CVE-2026-111334: Citrix: Memory overflow in Endpoint Analysis (EPA/EPAS) can lead to unpredictable or erroneous behavior or a Denial of Service…N/A9.3 CriticalN/ANov 13, 2026
CVE-2026-111333: Citrix: Memory overflow in an authentication request can lead to unpredictable or erroneous behavior or Denial of Service in…N/A6.9 MediumN/ANov 13, 2026
CVE-2026-128424: Red Hat streams for Apache Kafka 3: A flaw was found in Kroxylicious5.3 MediumN/AN/ANov 13, 2026
CVE-2026-126119: Unknown Streamit: The Streamit WordPress plugin before 1.3.10 does not perform any authorization or nonce verification on one of its…N/AN/AN/ANov 13, 2026
CVE-2026-125912: Unknown WP Ultimate CSV Importer: The WP Ultimate CSV Importer WordPress plugin before 9.2 does not restrict the destination filename and extension, nor…N/AN/AN/ANov 13, 2026
CVE-2026-125711: Unknown: The Widgets for Google Reviews WordPress plugin before 14.3, WP Tripadvisor Review Widgets WordPress plugin before…N/AN/AN/ANov 13, 2026
CVE-2026-124833: Unknown Ahime Image Printer: The Ahime Image Printer WordPress plugin through 1.0.0 does not validate the name, extension or type of uploaded files…N/AN/AN/ANov 13, 2026
CVE-2026-124822: Unknown Easy DragDrop File Uploader: The Easy DragDrop File Uploader WordPress plugin before 1.1.10 does not validate a user-supplied path before deleting…N/AN/AN/ANov 13, 2026
CVE-2026-124763: Unknown Woocommerce Wishlist: The Woocommerce Wishlist WordPress plugin through 1.1.0 does not have authorisation and CSRF checks in one of its…N/AN/AN/ANov 13, 2026
CVE-2026-124664: Unknown Mine CloudVod: The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or…N/AN/AN/ANov 13, 2026
CVE-2026-123711: Unknown WPCOM Member: The WPCOM Member WordPress plugin before 1.8.3 does not limit or bind attempts to verify WeChat login codes, allowing…N/AN/AN/ANov 13, 2026
26-50 of 422975