The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report

Vulnerability & Exploit Database

Rapid7’s curated database of vulnerabilities, featuring exploit modules and check methods integrated into the Metasploit Framework.

Emergent Threat6

TitleEitWModules
CVE-2026-116852: Marketing Fire Widget Options: Author Remote Code Execution (RCE) in Widget Options <= 4.2.5 versions.9.1 CriticalN/AN/AOct 30, 2026
CVE-2026-116851: impleCode eCommerce Product Catalog: Unauthenticated Cross Site Scripting (XSS) in eCommerce Product Catalog <= 3.6.5 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-116847: Kitae Park Mang Board WP: Unauthenticated Cross Site Scripting (XSS) in Mang Board WP <= 2.4.6 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-116410: masteriyo Masteriyo - LMS: Unauthenticated Arbitrary Content Deletion in Masteriyo - LMS <= 3.4.3 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-116405: e4jvikwp VikRentCar: Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.9 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-116401: RealMag777 HUSKY: Unauthenticated Broken Access Control in HUSKY <= 1.4.6 versions.7.5 HighN/AN/AOct 30, 2026
CVE-2026-116386: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications: Unauthenticated Privilege Escalation in SMS Alert Order Notifications <= 4.0.2 versions.9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-115947: RealMag777 HUSKY: Unauthenticated Sensitive Data Exposure in HUSKY <= 1.4.6 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-115604: Brainstorm Force SureDash: Subscriber Arbitrary File Deletion in SureDash <= 1.12.3 versions.5.0 MediumN/AN/AOct 30, 2026
CVE-2026-114711: MultiVendorX: Subscriber Cross Site Scripting (XSS) in MultiVendorX <= 5.0.20 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-107868: YITHEMES YITH WooCommerce Product Add-Ons: Unauthenticated Bypass Vulnerability in YITH WooCommerce Product Add-Ons <= 4.34.0 versions.5.3 MediumN/AN/AOct 30, 2026
CVE-2026-105077: Spacetime Ad Inserter: Unauthenticated Cross Site Scripting (XSS) in Ad Inserter <= 2.8.19 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-94175: Saad Iqbal All In One Login: Unauthenticated Cross Site Scripting (XSS) in All In One Login <= 2.4.1 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-90888: LeadSnap: Unauthenticated PHP Object Injection in LeadSnap <= 1.25 versions.9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-78527: GS Plugins GS Testimonial Slider: Contributor PHP Object Injection in GS Testimonial Slider <= 3.3.10 versions.8.8 HighN/AN/AOct 30, 2026
CVE-2026-73186: ShortPixel Enable Media Replace: Subscriber PHP Object Injection in Enable Media Replace <= 4.2.2 versions.8.8 HighN/AN/AOct 30, 2026
CVE-2026-54855: Cozmoslabs Profile Builder: Unauthenticated Cross Site Scripting (XSS) in Profile Builder <= 4.0.5 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-54854: Cozmoslabs Profile Builder: Contributor Privilege Escalation in Profile Builder <= 4.0.5 versions.6.3 MediumN/AN/AOct 30, 2026
CVE-2026-54850: magepeopleteam Booking and Rental Manager: Subscriber Broken Access Control in Booking and Rental Manager <= 2.8.2 versions.6.5 MediumN/AN/AOct 30, 2026
CVE-2026-48201: Raul P. Fast Velocity Minify: Unauthenticated Cross Site Scripting (XSS) in Fast Velocity Minify <= 3.5.7 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-39786: bookingalgorithms BA Book Everything: Unauthenticated Cross Site Scripting (XSS) in BA Book Everything <= 1.8.33 versions.7.1 HighN/AN/AOct 30, 2026
CVE-2026-39738: FunnelKit FunnelKit Automations: Unauthenticated PHP Object Injection in FunnelKit Automations <= 3.8.6.1 versions.9.8 CriticalN/AN/AOct 30, 2026
CVE-2026-39734: Saad Iqbal WP EasyPay: Unauthenticated Path Traversal in WP EasyPay <= 4.5.4 versions.7.5 HighN/AN/AOct 30, 2026
CVE-2026-39732: Ivijan-Stefan Stipic Transliterator: Unauthenticated SQL Injection in Transliterator <= 2.5.13 versions.9.3 CriticalN/AN/AOct 30, 2026
CVE-2026-28160: e4jvikwp VikRentCar: Unauthenticated Cross Site Scripting (XSS) in VikRentCar <= 1.4.10 versions.7.1 HighN/AN/AOct 30, 2026
26-50 of 418318