The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-90888: LeadSnap: Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-78527: GS Plugins GS Testimonial Slider: Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.8.8 HighN/AN/AOct 30, 2026
CVE-2026-73186: ShortPixel Enable Media Replace: Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.8.8 HighN/AN/AOct 30, 2026
CVE-2026-54855: Cozmoslabs Profile Builder: Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-54854: Cozmoslabs Profile Builder: Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.6.3 MediumN/AN/AOct 30, 2026
CVE-2026-54850: magepeopleteam Booking and Rental Manager: Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-48201: Raul P. Fast Velocity Minify: Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-39786: bookingalgorithms BA Book Everything: Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-39738: FunnelKit FunnelKit Automations: Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-39734: Saad Iqbal WP EasyPay: Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.7.5 HighN/AN/AOct 30, 2026
CVE-2026-39732: Ivijan-Stefan Stipic Transliterator: Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.9.3 CriticalN/AN/AOct 30, 2026
CVE-2026-28160: e4jvikwp VikRentCar: Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-27061: wpeverest User Registration: Subscriber Cross Site Scripting (XSS) in User Registration <= 5.3.0 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-119526: ThemeREX Royal Event: Deserialization of Untrusted Data vulnerability in ThemeREX Royal Event allows Object Injection9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-62162: cardano-scaling hydra: Hydra is a layer-two scalability solution for CardanoN/A8.2 HighN/AOct 30, 2026
CVE-2026-62160: daptin: Daptin is a GraphQL/JSON-API headless CMSN/A8.7 HighN/AOct 30, 2026
CVE-2026-61854: jackh54 VoiceSentinel: VoiceSentinel is a real-time voice moderation system for Minecraft servers8.2 HighN/AN/AOct 30, 2026
CVE-2026-61840: vantern-org questbot: Quest Bot is an opensource Discord BotN/A2.3 LowN/AOct 30, 2026
CVE-2026-9239: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Attachment Alt Text (aria-label…6.4 MediumN/AN/AOct 30, 2026
CVE-2026-97638: wpmudev: The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to Insecure…7.5 HighN/AN/AOct 30, 2026
CVE-2026-96894: wedevs: The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to Stored…7.2 HighN/AN/AOct 30, 2026
CVE-2026-84243: The GNU C Library glibc: The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries…7.0 HighN/AN/AOct 30, 2026
CVE-2026-76012: smub: The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Remote Code…7.5 HighN/AN/AOct 30, 2026
CVE-2026-69446: Microsoft Microsoft Edge (Chromium-based): Incorrect authorization in Microsoft Edge (Chromium-based) allows an authorized attacker to elevate privileges locally.4.4 MediumN/AN/AOct 30, 2026
CVE-2026-13747: tigroumeow Meow Gallery: The Meow Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.5.4…6.5 MediumN/AN/AOct 30, 2026
26-50 of 418318