The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

TitleEitWModules
CVE-2026-124814: Unknown Ultimate Addons for Elementor Forms: The Ultimate Addons for Elementor Forms WordPress plugin before 1.0.8 does not properly validate the extension of…N/AN/AN/ANov 12, 2026
CVE-2026-124665: Unknown Order Tracking: The Order Tracking WordPress plugin before 3.6.2 does not verify that a visitor owns the customer or sales…N/AN/AN/ANov 12, 2026
CVE-2026-124653: Unknown Mine CloudVod: The Mine CloudVod WordPress plugin before 2.6.6 does not restrict who can request cloud storage upload credentials from…N/AN/AN/ANov 12, 2026
CVE-2026-124652: Unknown Mine CloudVod: The Mine CloudVod WordPress plugin before 2.6.6 does not verify that an order belongs to the requesting user before…N/AN/AN/ANov 12, 2026
CVE-2026-124648: Unknown TI WooCommerce Wishlist: The TI WooCommerce Wishlist WordPress plugin before 2.13.0 does not verify that a visitor who is not logged in owns a…N/AN/AN/ANov 12, 2026
CVE-2026-124647: Unknown TI WooCommerce Wishlist: The TI WooCommerce Wishlist WordPress plugin before 2.0.7 does not sanitise and escape user input before using it in a…N/AN/AN/ANov 12, 2026
CVE-2026-123092: Unknown WP Remote Users Sync: The WP Remote Users Sync WordPress plugin before 2.3.0 does not restrict which user metadata keys may be written…N/AN/AN/ANov 12, 2026
CVE-2026-123044: Unknown ContentPen: The ContentPen WordPress plugin before 1.1.1 discloses its REST API key to unauthenticated users, who can then use it…N/AN/AN/ANov 12, 2026
CVE-2026-122003: Unknown Abilities Bridge: The Abilities Bridge WordPress plugin before 1.4.2 does not require a valid nonce before re-authenticating a REST API…N/AN/AN/ANov 12, 2026
CVE-2026-121498: Unknown AskAny: The AskAny WordPress plugin before 2.2.1 does not verify that a chat session belongs to the requester before returning…N/AN/AN/ANov 12, 2026
CVE-2026-119040: Unknown Defender Security: The Defender Security WordPress plugin before 6.4.1 does not limit the number of failed two-factor authentication…N/AN/AN/ANov 12, 2026
CVE-2026-119039: Unknown Defender Security: The Defender Security WordPress plugin before 6.4.1 does not verify that the client IP address it derives for its…N/AN/AN/ANov 12, 2026
CVE-2026-118597: Akaunting: Akaunting 3.3.0 contains a stored cross-site scripting vulnerability in custom invoice payment termsN/A7.2 HighN/ANov 12, 2026
CVE-2026-118531: Unknown: The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.11.1 does not…N/AN/AN/ANov 12, 2026
CVE-2026-118421: Unknown WP Directory Kit: The WP Directory Kit WordPress plugin before 1.6.3 does not properly sanitise and escape a parameter used to order…N/AN/AN/ANov 12, 2026
CVE-2026-110959: Unknown Descope: The Descope WordPress plugin before 1.2.0 does not validate the authentication token it receives before creating a…N/AN/AN/ANov 12, 2026
CVE-2026-110072: Unknown Photo Gallery by 10Web: The Photo Gallery by 10Web WordPress plugin before 1.8.49 does not escape a shortcode attribute that sets a gallery…N/AN/AN/ANov 12, 2026
CVE-2026-110041: Unknown Crop Thumbnails: The Crop Thumbnails WordPress plugin before 1.10.0 does not perform object-level authorization when reading and…N/AN/AN/ANov 12, 2026
CVE-2026-106027: Unknown Oxygen MyData for WooCommerce: The Oxygen MyData for WooCommerce WordPress plugin before 3.0.9 does not have proper authorisation, nor validate the…N/AN/AN/ANov 12, 2026
CVE-2026-101107: SoftBank Corp. Air Terminal 6: An OS command Injection issue exists in Air Terminal 6 provided by SoftBank Corp8.0 High8.6 HighN/ANov 12, 2026
CVE-2026-92379: Synology DiskStation Manager (DSM): An improper neutralization of input during web page generation vulnerability in the Notification API in Synology…5.4 MediumN/AN/ANov 12, 2026
CVE-2026-88266: Synology DiskStation Manager (DSM): An external control of system or configuration setting vulnerability in the synomount in Synology DiskStation Manager…4.3 MediumN/AN/ANov 12, 2026
CVE-2026-87801: Synology DiskStation Manager (DSM): An insertion of sensitive information into sent data vulnerability in the API framework in Synology DiskStation Manager…6.5 MediumN/AN/ANov 12, 2026
CVE-2026-86343: Synology DiskStation Manager (DSM): An improper neutralization of CRLF sequences vulnerability in the SNMP API in Synology DiskStation Manager (DSM) before…6.8 MediumN/AN/ANov 12, 2026
CVE-2026-85101: Synology DiskStation Manager (DSM): An authentication bypass using an alternate path or channel vulnerability in the rsync in Synology DiskStation Manager…8.6 HighN/AN/ANov 12, 2026
26-50 of 578225