The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-115611: PluginUs.Net TableOn: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in PluginUs.Net…7.1 HighN/AN/AOct 29, 2026
CVE-2026-115599: ThimPress LearnPress: Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access…7.5 HighN/AN/AOct 29, 2026
CVE-2026-115592: OceanWP: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in OceanWP OceanWP…7.1 HighN/AN/AOct 29, 2026
CVE-2026-114230: Apache Software Foundation Apache Qpid Proton C: When dispatching SASL frames to authenticate the peer, Proton will also dispatch AMQP frames if they claim to be SASL…N/AN/AN/AOct 29, 2026
CVE-2026-114193: Eyal Fitoussi GEO my WordPress: Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly…7.5 HighN/AN/AOct 29, 2026
CVE-2026-112827: VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce: Missing Authorization vulnerability in VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce…7.1 HighN/AN/AOct 29, 2026
CVE-2026-105042: Apache Software Foundation Apache Qpid Proton C: A message body that is deeply nested and decoded by pn_message_body() could overflow the stack and cause a crashN/AN/AN/AOct 29, 2026
CVE-2026-105031: Apache Software Foundation Apache Qpid Proton C: When using the OpenSSL TLS implementation, both the pn_ssl_domain_set_trusted_ca_db() &…N/AN/AN/AOct 29, 2026
CVE-2026-5702: SABBATIC SABBATIC app: Cross-Site Request Forgery (CSRF) vulnerability in SABBATIC application that allows an attacker can trick an…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5700: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5699: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5698: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-5697: SABBATIC SABBATIC app: Stored Cross-Site Scripting (XSS) vulnerability in SABBATIC application that allows an attacker to store JavaScript…N/A4.8 MediumN/AOct 29, 2026
CVE-2026-91153: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…5.3 MediumN/AN/AOct 29, 2026
CVE-2026-91152: wpeverest: The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is…6.1 MediumN/AN/AOct 29, 2026
CVE-2026-88941: Kaspersky: Kaspersky has fixed a vulnerability in the Network Agent for Windows module of Kaspersky Security Center5.2 Medium6.2 MediumN/AOct 29, 2026
CVE-2026-118192: beardev: The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to generic SQL…6.5 MediumN/AN/AOct 29, 2026
CVE-2026-117611: Checkmk GmbH Checkmk: Improper certificate validation in Checkmk <2.5.0p18, <2.4.0p39, <2.3.0p52 and 2.2.0 (EOL): the Certificate Authority…N/A7.1 HighN/AOct 29, 2026
CVE-2026-116763: litespeedtech LiteSpeed Cache: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-111419: Foxit Software Inc. foxit.com: A sensitive information exposure vulnerability exists on the Foxit official website because JavaScript code contains…8.6 HighN/AN/AOct 29, 2026
CVE-2026-111418: Foxit Software Inc. foxit.com: A server-side request forgery (SSRF) vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service7.5 HighN/AN/AOct 29, 2026
CVE-2026-111417: Foxit Software Inc. foxit.com: A broken access control vulnerability exists in the Foxit official website’s HTML-to-PDF conversion service due to the…7.5 HighN/AN/AOct 29, 2026
CVE-2026-111318: devitemsllc HT Mega Addons for Elementor – Elementor Widgets & Template Builder: The HT Mega Addons for Elementor – Elementor Widgets & Template Builder plugin for WordPress is vulnerable to Stored…5.4 MediumN/AN/AOct 29, 2026
CVE-2026-110707: themeisle: The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress…4.7 MediumN/AN/AOct 29, 2026
CVE-2026-109215: litespeedtech LiteSpeed Cache: The LiteSpeed Cache plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'bbp_reply_content'…6.4 MediumN/AN/AOct 29, 2026
26-50 of 543846