The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-125434: Webful Creations RepairBuddy: Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-125777: Cozmoslabs Profile Builder: Insertion of Sensitive Information Into Sent Data vulnerability in Cozmoslabs Profile Builder profile-builder allows…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125439: Kit Kit (formerly ConvertKit): Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124413: WP User Manager: Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125455: Bold Themes Bold Page Builder: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bold Themes Bold…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125451: bPlugins B Blocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bPlugins B Blocks…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-115600: DEV Institute Restrict User Access – Membership Plugin with Force: Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-125784: Magnigenie RestroPress: Cross-Site Request Forgery (CSRF) vulnerability in Magnigenie RestroPress restropress allows Cross Site Request…8.8 HighN/AN/ANov 11, 2026
CVE-2026-122671: E2Pdf.com e2pdf: Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125781: NOUS Ouvert Utile et Simple Event post: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in NOUS Ouvert Utile…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-125444: King Addons King Addons for Elementor: Missing Authorization vulnerability in King Addons King Addons for Elementor king-addons allows Exploiting Incorrectly…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124271: DEV Institute Restrict User Access – Membership Plugin with Force: Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119097: denis-de-bernardy Author Image: The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in…6.4 MediumN/AN/ANov 11, 2026
CVE-2026-119615: maltesesolutions Reset Database: The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.38.8 HighN/AN/ANov 11, 2026
CVE-2026-103883: sixstorage 6Storage Rentals: The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account…8.8 HighN/AN/ANov 11, 2026
CVE-2026-126627: Apache Software Foundation Apache XML Graphics FOP: Creation of Temporary File With Insecure Permissions vulnerability in Apache XML Graphics FOPN/AN/AN/ANov 11, 2026
CVE-2026-124743: Red Hat: A flaw was found in BusyBox5.5 MediumN/AN/ANov 11, 2026
CVE-2026-124742: Red Hat: A flaw was found in BusyBox5.5 MediumN/AN/ANov 11, 2026
CVE-2026-124740: Red Hat: A flaw was found in BusyBox's udhcpc6 DHCPv6 client4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124738: Red Hat: A flaw was found in BusyBox5.3 MediumN/AN/ANov 11, 2026
CVE-2026-78287: STAGGS: Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code…10.0 CriticalN/AN/ANov 11, 2026
CVE-2026-124253: codepeople Calculated Fields Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople…7.1 HighN/AN/ANov 11, 2026
CVE-2026-123478: Meow Apps AI Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI…7.1 HighN/AN/ANov 11, 2026
CVE-2026-118965: Checkmk GmbH Checkmk: Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an…N/A9.4 CriticalN/ANov 11, 2026
CVE-2026-111792: Apache Software Foundation Apache XML Graphics Batik: Uncontrolled Recursion vulnerability in Apache XML Graphics BatikN/AN/AN/ANov 11, 2026
26-50 of 511254