The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-122671: E2Pdf.com e2pdf: Missing Authorization vulnerability in E2Pdf.com e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-121773: GeneratePress GenerateBlocks: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GeneratePress…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-121770: VillaTheme VISeek: Cross-Site Request Forgery (CSRF) vulnerability in VillaTheme VISeek viseek-easy-custom-search allows Cross Site…5.4 MediumN/AN/ANov 11, 2026
CVE-2026-121574: WP Chill Passster: Missing Authorization vulnerability in WP Chill Passster content-protector allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121028: WP Chill Strong Testimonials: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in WP Chill Strong…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-121014: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-119615: maltesesolutions Reset Database: The Reset Database plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.1.38.8 HighN/AN/ANov 11, 2026
CVE-2026-119097: denis-de-bernardy Author Image: The Author Image plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'display_name' parameter in…6.4 MediumN/AN/ANov 11, 2026
CVE-2026-115600: DEV Institute Restrict User Access – Membership Plugin with Force: Missing Authorization vulnerability in DEV Institute Restrict User Access – Membership Plugin with Force…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-103883: sixstorage 6Storage Rentals: The 6Storage Rentals plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account…8.8 HighN/AN/ANov 11, 2026
CVE-2026-122096: Apache Software Foundation Apache DataSketches Java: Uncontrolled Resource Consumption vulnerability in the sketch deserialization of Apache DataSketches JavaN/AN/AN/ANov 11, 2026
CVE-2026-112201: Keycloak, Red Hat: A flaw was found in the login-failure storage component of Keycloak, the identity and access management solution4.8 MediumN/AN/ANov 11, 2026
CVE-2026-125446: WisdmLabs Edwiser Bridge: Cross-Site Request Forgery (CSRF) vulnerability in WisdmLabs Edwiser Bridge edwiser-bridge allows Cross Site Request…8.8 HighN/AN/ANov 11, 2026
CVE-2026-125445: Infomaniak Network VOD Infomaniak: Cross-Site Request Forgery (CSRF) vulnerability in Infomaniak Network VOD Infomaniak vod-infomaniak allows Cross Site…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-125782: Blubrry Podcasting PowerPress Podcasting: Missing Authorization vulnerability in Blubrry Podcasting PowerPress Podcasting powerpress allows Exploiting…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-125435: IdeaBox Creations PowerPack Addons for Elementor: Insertion of Sensitive Information Into Sent Data vulnerability in IdeaBox Creations PowerPack Addons for Elementor…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-124411: Brainstorm Force SureCart: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Brainstorm Force…6.5 MediumN/AN/ANov 11, 2026
CVE-2026-124417: Ahmad WP Job Portal: Missing Authorization vulnerability in Ahmad WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124269: weDevs Happy Addons for Elementor: Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting…4.3 MediumN/AN/ANov 11, 2026
CVE-2026-124262: Igor Funa Ad Inserter: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Igor Funa Ad Inserter…5.3 MediumN/AN/ANov 11, 2026
CVE-2026-78287: STAGGS: Improper Control of Generation of Code ('Code Injection') vulnerability in Staggs STAGGS staggs allows Remote Code…10.0 CriticalN/AN/ANov 11, 2026
CVE-2026-124253: codepeople Calculated Fields Form: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in codepeople…7.1 HighN/AN/ANov 11, 2026
CVE-2026-123478: Meow Apps AI Engine: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Meow Apps AI…7.1 HighN/AN/ANov 11, 2026
CVE-2026-118965: Checkmk GmbH Checkmk: Path traversal in the discovered host label synchronization in Checkmk <2.5.0p19, <2.4.0p40 and 2.3.0 (EOL) allows an…N/A9.4 CriticalN/ANov 11, 2026
CVE-2026-111792: Apache Software Foundation Apache XML Graphics Batik: Uncontrolled Recursion vulnerability in Apache XML Graphics BatikN/AN/AN/ANov 11, 2026
26-50 of 511254